Repository: envoyproxy/gateway
Pull request #5710 (2025-04-10 20:59:10)

fix: return err if direct response size exceeds limit


Patch:
diff --git a/api/v1alpha1/shared_types.go b/api/v1alpha1/shared_types.go
index 3f356755e..a4cb207d5 100644
--- a/api/v1alpha1/shared_types.go
+++ b/api/v1alpha1/shared_types.go
@@ -330,10 +330,13 @@ type KubernetesServiceSpec struct {
 }
 
 // LogLevel defines a log level for Envoy Gateway and EnvoyProxy system logs.
-// +kubebuilder:validation:Enum=debug;info;error;warn
+// +kubebuilder:validation:Enum=trace;debug;info;warn;error
 type LogLevel string
 
 const (
+	// LogLevelTrace defines the "Trace" logging level.
+	LogLevelTrace LogLevel = "trace"
+
 	// LogLevelDebug defines the "debug" logging level.
 	LogLevelDebug LogLevel = "debug"
 
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index f0eb14993..6312857ea 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -423,10 +423,11 @@ spec:
                       description: LogLevel defines a log level for Envoy Gateway
                         and EnvoyProxy system logs.
                       enum:
+                      - trace
                       - debug
                       - info
-                      - error
                       - warn
+                      - error
                       type: string
                     default:
                       default: warn
diff --git a/go.mod b/go.mod
index a588b63e8..46cb0be4b 100644
--- a/go.mod
+++ b/go.mod
@@ -3,8 +3,8 @@ module github.com/envoyproxy/gateway
 go 1.24.2
 
 require (
-	fortio.org/fortio v1.68.1
-	fortio.org/log v1.17.1
+	fortio.org/fortio v1.69.1
+	fortio.org/log v1.17.2
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/andybalholm/brotli v1.1.1
@@ -65,7 +65,7 @@ require (
 	google.golang.org/grpc v1.71.1
 	google.golang.org/protobuf v1.36.6
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.17.2
+	helm.sh/helm/v3 v3.17.3
 	k8s.io/api v0.32.3
 	k8s.io/apiextensions-apiserver v0.32.3
 	k8s.io/apimachinery v0.33.0-beta.0
@@ -99,12 +99,12 @@ require (
 	connectrpc.com/otelconnect v0.7.1 // indirect
 	dario.cat/mergo v1.0.1 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
-	fortio.org/cli v1.9.2 // indirect
-	fortio.org/dflag v1.7.3 // indirect
+	fortio.org/cli v1.10.0 // indirect
+	fortio.org/dflag v1.8.1 // indirect
 	fortio.org/safecast v1.0.0 // indirect
-	fortio.org/scli v1.15.3 // indirect
-	fortio.org/sets v1.2.0 // indirect
-	fortio.org/struct2env v0.4.1 // indirect
+	fortio.org/scli v1.16.1 // indirect
+	fortio.org/sets v1.3.0 // indirect
+	fortio.org/struct2env v0.4.2 // indirect
 	fortio.org/version v1.0.4 // indirect
 	github.com/4meepo/tagalign v1.4.2 // indirect
 	github.com/Abirdcfly/dupword v0.1.3 // indirect
@@ -477,7 +477,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
 	golang.org/x/crypto v0.37.0 // indirect
-	golang.org/x/crypto/x509roots/fallback v0.0.0-20240904212608-c9da6b9a4008 // indirect
+	golang.org/x/crypto/x509roots/fallback v0.0.0-20250406160420-959f8f3db0fb // indirect
 	golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
 	golang.org/x/mod v0.24.0 // indirect
 	golang.org/x/oauth2 v0.27.0 // indirect
diff --git a/go.sum b/go.sum
index 8210e62d5..df8de5fd8 100644
--- a/go.sum
+++ b/go.sum
@@ -35,22 +35,22 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 fortio.org/assert v1.2.1 h1:48I39urpeDj65RP1KguF7akCjILNeu6vICiYMEysR7Q=
 fortio.org/assert v1.2.1/go.mod h1:039mG+/iYDPO8Ibx8TrNuJCm2T2SuhwRI3uL9nHTTls=
-fortio.org/cli v1.9.2 h1:17eJ8QZPjXHcLBpeCe0QMO/0fj5Bw0ZTxVgL7V9jOqc=
-fortio.org/cli v1.9.2/go.mod h1:7r55OoTV8NXcTvJT4boWk8s3I2LP6TMZh/0LLMJEYw0=
-fortio.org/dflag v1.7.3 h1:yws+v+/fJ67bYgrgcWpLtgdZPEWkYuwdfqz/WyQ8UXo=
-fortio.org/dflag v1.7.3/go.mod h1:O1Pk4lKRolw9wwAGyjTo8IsNyqqNRQGKxPOfpOElMqM=
-fortio.org/fortio v1.68.1 h1:dhs9px7xkXLPzS8gVE3AKe+NRD/5aylV/qebD7vfv7E=
-fortio.org/fortio v1.68.1/go.mod h1:bZBFAxe8hfh/fdtEugVOBZvANGJcMdB91cwaul61K8w=
-fortio.org/log v1.17.1 h1:YQoGyZBnXTVIs77/nZw7BppwSOIamP3I092PGBenBZs=
-fortio.org/log v1.17.1/go.mod h1:t58Spg9njjymvRioh5F6qKGSupEsnMjXLGWIS1i3khE=
+fortio.org/cli v1.10.0 h1:BsJXuBrJxBLqE+62gHSOQBRzY+EvE/sF1MnjIexUSI8=
+fortio.org/cli v1.10.0/go.mod h1:DNxA/oD3cQaOtTean8Sgr78lJrwGLIs06X8U/G3va+M=
+fortio.org/dflag v1.8.1 h1:2ax/9IvIwMb0zPE3yZEDp9D+UewfZzj5B8UKT79tblU=
+fortio.org/dflag v1.8.1/go.mod h1:M2K61nLYfB4pAsp7mZzBtjqLP6dX11R9Vm+1I4F+sVg=
+fortio.org/fortio v1.69.1 h1:9inX4sswg8UlN5v7clL2VM/fuDtuzhf9+X3LlbFp0cE=
+fortio.org/fortio v1.69.1/go.mod h1:4zIAnGGTdAHcOgiAgSujTKLAAkbhDb2CdAqgninWjeU=
+fortio.org/log v1.17.2 h1:JPX/ApDXDoGzsNtXw0AJI4ai6tl9wHp4Ch6bVs1OK0Y=
+fortio.org/log v1.17.2/go.mod h1:1V7bPfFI7ZVTdtN9DnUCAN0ilEMs5VgKjHIDRO7Mjzk=
 fortio.org/safecast v1.0.0 h1:dr3131WPX8iS1pTf76+39WeXbTrerDYLvi9s7Oi3wiY=
 fortio.org/safecast v1.0.0/go.mod h1:xZmcPk3vi4kuUFf+tq4SvnlVdwViqf6ZSZl91Jr9Jdg=
-fortio.org/scli v1.15.3 h1:XZYONPupGOd1Q68G4aq0vWg9obw0M57sC4snkyiab9w=
-fortio.org/scli v1.15.3/go.mod h1:cWJJbXObkF+GsbtPqxE60GFctllOANYS+Yp9PJK0xK8=
-fortio.org/sets v1.2.0 h1:FBfC7R2xrOJtkcioUbY6WqEzdujuBoZRbSdp1fYF4Kk=
-fortio.org/sets v1.2.0/go.mod h1:J2BwIxNOLWsSU7IMZUg541kh3Au4JEKHrghVwXs68tE=
-fortio.org/struct2env v0.4.1 h1:rJludAMO5eBvpWplWEQNqoVDFZr4RWMQX7RUapgZyc0=
-fortio.org/struct2env v0.4.1/go.mod h1:lENUe70UwA1zDUCX+8AsO663QCFqYaprk5lnPhjD410=
+fortio.org/scli v1.16.1 h1:TzaGHhFXKlTNx7mQ5BzVnXz2/qXZHG/mS30nWfJS0kE=
+fortio.org/scli v1.16.1/go.mod h1:jrdQnLbJuapUoaOcm2NwfTpCYrc5cNNc3datQkh3sQs=
+fortio.org/sets v1.3.0 h1:UiEtck/ndNM3Tg53mJu3I7Zz1ED8+YSQLtPKSjd8LTE=
+fortio.org/sets v1.3.0/go.mod h1:y8fFzm4bPTk3Qfr/tF3Xz7oWwgzpy++QdkwURKhNbP4=
+fortio.org/struct2env v0.4.2 h1:Xh7HlS9vf2ZdRvRfmoGIasNDO8t6z36M713utVODRCo=
+fortio.org/struct2env v0.4.2/go.mod h1:lENUe70UwA1zDUCX+8AsO663QCFqYaprk5lnPhjD410=
 fortio.org/version v1.0.4 h1:FWUMpJ+hVTNc4RhvvOJzb0xesrlRmG/a+D6bjbQ4+5U=
 fortio.org/version v1.0.4/go.mod h1:2JQp9Ax+tm6QKiGuzR5nJY63kFeANcgrZ0osoQFDVm0=
 github.com/14rcole/gopopulate v0.0.0-20180821133914-b175b219e774 h1:SCbEWT58NSt7d2mcFdvxC9uyrdcTfvBbPLThhkDmXzg=
@@ -1458,8 +1458,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
 golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20240904212608-c9da6b9a4008 h1:vKHSxFhPLnBEYu9R8DcQ4gXq9EqU0VVhC9pq9wmtYsg=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20240904212608-c9da6b9a4008/go.mod h1:kNa9WdvYnzFwC79zRpLRMJbdEFlhyM5RPFBBZp/wWH8=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20250406160420-959f8f3db0fb h1:Iu0p/klM0SM7atONioa/bPhLS7cjhnip99x1OIGibwg=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20250406160420-959f8f3db0fb/go.mod h1:lxN5T34bK4Z/i6cMaU7frUU57VkDXFD4Kamfl/cp9oU=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
 golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
@@ -1744,8 +1744,8 @@ gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
 gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
-helm.sh/helm/v3 v3.17.2 h1:agYQ5ew2jq5vdx2K7q5W44KyKQrnSubUMCQsjkiv3/o=
-helm.sh/helm/v3 v3.17.2/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
+helm.sh/helm/v3 v3.17.3 h1:3n5rW3D0ArjFl0p4/oWO8IbY/HKaNNwJtOQFdH2AZHg=
+helm.sh/helm/v3 v3.17.3/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go
index 7229f58ad..5f0330cce 100644
--- a/internal/gatewayapi/backendtrafficpolicy.go
+++ b/internal/gatewayapi/backendtrafficpolicy.go
@@ -930,6 +930,18 @@ func buildResponseOverride(policy *egv1a1.BackendTrafficPolicy, resources *resou
 	}, nil
 }
 
+func checkResponseBodySize(b *string) error {
+	// Make this configurable in the future
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route.proto.html#max_direct_response_body_size_bytes
+	maxDirectResponseSize := 4096
+	lenB := len(*b)
+	if lenB > maxDirectResponseSize {
+		return fmt.Errorf("response.body size %d greater than the max size %d", lenB, maxDirectResponseSize)
+	}
+
+	return nil
+}
+
 func getCustomResponseBody(body *egv1a1.CustomResponseBody, resources *resource.Resources, policyNs string) (*string, error) {
 	if body != nil && body.Type != nil && *body.Type == egv1a1.ResponseValueTypeValueRef {
 		cm := resources.GetConfigMap(policyNs, string(body.ValueRef.Name))
@@ -937,12 +949,18 @@ func getCustomResponseBody(body *egv1a1.CustomResponseBody, resources *resource.
 			b, dataOk := cm.Data["response.body"]
 			switch {
 			case dataOk:
+				if err := checkResponseBodySize(&b); err != nil {
+					return nil, err
+				}
 				return &b, nil
 			case len(cm.Data) > 0: // Fallback to the first key if response.body is not found
 				for _, value := range cm.Data {
 					b = value
 					break
 				}
+				if err := checkResponseBodySize(&b); err != nil {
+					return nil, err
+				}
 				return &b, nil
 			default:
 				return nil, fmt.Errorf("can't find the key response.body in the referenced configmap %s", body.ValueRef.Name)
@@ -952,6 +970,9 @@ func getCustomResponseBody(body *egv1a1.CustomResponseBody, resources *resource.
 			return nil, fmt.Errorf("can't find the referenced configmap %s", body.ValueRef.Name)
 		}
 	} else if body != nil && body.Inline != nil {
+		if err := checkResponseBodySize(body.Inline); err != nil {
+			return nil, err
+		}
 		return body.Inline, nil
 	}
 
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index db1506457..b4ba3aee4 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -1225,8 +1225,7 @@ func (r *gatewayAPIReconciler) watchResources(ctx context.Context, mgr manager.M
 
 	// Watch Gateway CRUDs and reconcile affected GatewayClass.
 	gPredicates := []predicate.TypedPredicate[*gwapiv1.Gateway]{
-		predicate.Or(predicate.TypedGenerationChangedPredicate[*gwapiv1.Gateway]{},
-			predicate.TypedLabelChangedPredicate[*gwapiv1.Gateway]{}),
+		metadataPredicate[*gwapiv1.Gateway](),
 		predicate.NewTypedPredicateFuncs(func(gtw *gwapiv1.Gateway) bool {
 			return r.validateGatewayForReconcile(gtw)
 		}),
@@ -1249,10 +1248,7 @@ func (r *gatewayAPIReconciler) watchResources(ctx context.Context, mgr manager.M
 	}
 
 	// Watch HTTPRoute CRUDs and process affected Gateways.
-	httprPredicates := []predicate.TypedPredicate[*gwapiv1.HTTPRoute]{
-		predicate.Or(predicate.TypedGenerationChangedPredicate[*gwapiv1.HTTPRoute]{},
-			predicate.TypedLabelChangedPredicate[*gwapiv1.HTTPRoute]{}),
-	}
+	httprPredicates := commonPredicates[*gwapiv1.HTTPRoute]()
 	if r.namespaceLabel != nil {
 		httprPredicates = append(httprPredicates, predicate.NewTypedPredicateFuncs(func(hr *gwapiv1.HTTPRoute) bool {
 			return r.hasMatchingNamespaceLabels(hr)
@@ -1276,10 +1272,7 @@ func (r *gatewayAPIReconciler) watchResources(ctx context.Context, mgr manager.M
 		r.log.Info("GRPCRoute CRD not found, skipping GRPCRoute watch")
 	} else {
 		// Watch GRPCRoute CRUDs and process affected Gateways.
-		grpcrPredicates := []predicate.TypedPredicate[*gwapiv1.GRPCRoute]{
-			predicate.Or(predicate.TypedGenerationChangedPredicate[*gwapiv1.GRPCRoute]{},
-				predicate.TypedLabelChangedPredicate[*gwapiv1.GRPCRoute]{}),
-		}
+		grpcrPredicates := commonPredicates[*gwapiv1.GRPCRoute]()
 		if r.namespaceLabel != nil {
 			grpcrPredicates = append(grpcrPredicates, predicate.NewTypedPredicateFuncs[*gwapiv1.GRPCRoute](func(grpc *gwapiv1.GRPCRoute) bool {
 				return r.hasMatchingNamespaceLabels(grpc)
@@ -1303,10 +1296,7 @@ func (r *gatewayAPIReconciler) watchResources(ctx context.Context, mgr manager.M
 		r.log.Info("TLSRoute CRD not found, skipping TLSRoute watch")
 	} else {
 		// Watch TLSRoute CRUDs and process affected Gateways.
-		tlsrPredicates := []predicate.TypedPredicate[*gwapiv1a2.TLSRoute]{
-			predicate.Or(predicate.TypedGenerationChangedPredicate[*gwapiv1a2.TLSRoute]{},
-				predicate.TypedLabelChangedPredicate[*gwapiv1a2.TLSRoute]{}),
-		}
+		tlsrPredicates := commonPredicates[*gwapiv1a2.TLSRoute]()
 		if r.namespaceLabel != nil {
 			tlsrPredicates = append(tlsrPredicates, predicate.NewTypedPredicateFuncs[*gwapiv1a2.TLSRoute](func(route *gwapiv1a2.TLSRoute) bool {
 				return r.hasMatchingNamespaceLabels(route)
@@ -1330,10 +1320,7 @@ func (r *gatewayAPIReconciler) watchResources(ctx context.Context, mgr manager.M
 		r.log.Info("UDPRoute CRD not found, skipping UDPRoute watch")
 	} else {
 		// Watch UDPRoute CRUDs and process affected Gateways.
-		udprPredicates := []predicate.TypedPredicate[*gwapiv1a2.UDPRoute]{
-			predicate.Or(predicate.TypedGenerationChangedPredicate[*gwapiv1a2.UDPRoute]{},
-				predicate.TypedLabelChangedPredicate[*gwapiv1a2.UDPRoute]{}),
-		}
+		udprPredicates := commonPredicates[*gwapiv1a2.UDPRoute]()
 		if r.namespaceLabel != nil {
 			udprPredicates = append(udprPredicates, predicate.NewTypedPredicateFuncs[*gwapiv1a2.UDPRoute](func(route *gwapiv1a2.UDPRoute) bool {
 				return r.hasMatchingNamespaceLabels(route)
@@ -1357,10 +1344,7 @@ func (r *gatewayAPIReconciler) watchResources(ctx context.Context, mgr manager.M
 		r.log.Info("TCPRoute CRD not found, skipping TCPRoute watch")
 	} else {
 		// Watch TCPRoute CRUDs and process affected Gateways.
-		tcprPredicates := []predicate.TypedPredicate[*gwapiv1a2.TCPRoute]{
-			predicate.Or(predicate.TypedGenerationChangedPredicate[*gwapiv1a2.TCPRoute]{},
-				predicate.TypedLabelChangedPredicate[*gwapiv1a2.TCPRoute]{}),
-		}
+		tcprPredicates := commonPredicates[*gwapiv1a2.TCPRoute]()
 		if r.namespaceLabel != nil {
 			tcprPredicates = append(tcprPredicates, predicate.NewTypedPredicateFuncs[*gwapiv1a2.TCPRoute](func(route *gwapiv1a2.TCPRoute) bool {
 				return r.hasMatchingNamespaceLabels(route)
diff --git a/internal/provider/kubernetes/predicates.go b/internal/provider/kubernetes/predicates.go
index 16bb9361b..2e019182b 100644
--- a/internal/provider/kubernetes/predicates.go
+++ b/internal/provider/kubernetes/predicates.go
@@ -19,6 +19,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gwapiv1a3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
@@ -812,3 +813,16 @@ func (r *gatewayAPIReconciler) validateHTTPRouteFilterForReconcile(obj client.Ob
 	nsName := utils.NamespacedName(hrf)
 	return r.isRouteReferencingHTTPRouteFilter(&nsName)
 }
+
+func commonPredicates[T client.Object]() []predicate.TypedPredicate[T] {
+	return []predicate.TypedPredicate[T]{
+		metadataPredicate[T](),
+	}
+}
+
+func metadataPredicate[T client.Object]() predicate.TypedPredicate[T] {
+	return predicate.Or(predicate.TypedGenerationChangedPredicate[T]{},
+		predicate.TypedLabelChangedPredicate[T]{},
+		predicate.TypedAnnotationChangedPredicate[T]{},
+	)
+}
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index 6891b1daa..8831cf243 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -27,6 +27,7 @@ new features: |
   Added support for per-host circuit breaker thresholds
   Added support for egctl Websocket in addation to SPDY
   Added a configuration option in the Helm chart to set the TrafficDistribution field in the Envoy Gateway Service
+  Added support for setting the log level to trace for the Envoy Proxy
 
 bug fixes: |
   Fix traffic splitting when filters are attached to the backendRef.
diff --git a/site/content/en/v1.3/tasks/traffic/direct-response.md b/site/content/en/v1.3/tasks/traffic/direct-response.md
index dfaa6755d..4d043a59d 100644
--- a/site/content/en/v1.3/tasks/traffic/direct-response.md
+++ b/site/content/en/v1.3/tasks/traffic/direct-response.md
@@ -13,6 +13,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 
 ## Testing Direct Response 
 
+Note: the size of the response body (whether provided in-line or via a reference) cannot exceed 4096 bytes.
+
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
 
diff --git a/site/data/adopters.yaml b/site/data/adopters.yaml
index d1a3c56e8..269eb4660 100644
--- a/site/data/adopters.yaml
+++ b/site/data/adopters.yaml
@@ -47,6 +47,10 @@ adopters:
     logo: "/logos/kubermatic.svg"
     url: "https://www.kubermatic.com/"
     description: "Kubermatic is using Envoy Gateway in KubeLB to provide L7 Load Balancing for multiple Kubernetes clusters using GatewayAPI."
+  - name: "Rackspace"
+    logo: "/logos/rackspace.svg"
+    url: "https://www.rackspace.com/"
+    description: "Rackspace OpenStack leverages Envoy Gateway within it's openCenter platform to handle dynamic routing across containerized services and virtualized workloads, enhancing traffic management and observability while also consolidating important security policies such as rate limiting, IP blocking, and access control."
   - name: "Docker"
     logo: "/logos/docker.png"
     url: "https://www.docker.com/"
diff --git a/site/layouts/partials/version-banner.html b/site/layouts/partials/version-banner.html
index 91b70fd2a..89ecff48d 100644
--- a/site/layouts/partials/version-banner.html
+++ b/site/layouts/partials/version-banner.html
@@ -1,6 +1,19 @@
 {{ $color := "primary" }}
 {{ $latest_version := .Site.Params.url_latest_version }}
 {{ $path := strings.TrimPrefix (add hugo.WorkingDir "/content/en/") $.File.Filename -}}
+
+{{ if strings.HasPrefix $path "latest" }}
+<div class="alert alert-warning">
+    Notice:
+    <br />
+    This is the "latest" release of Envoy Gateway, which contains the most recent commits from the main branch.
+    <br />
+    This release <strong>might not be stable</strong>.
+    <br />
+    Please refer to the <a href="{{ $latest_version | safeURL }}" target="_blank">/docs</a> documentation for the most current information.
+</div>
+{{ end }}
+
 {{ range .Site.Params.versions -}}
 
 {{ $eol_time := time.AsTime .eol }}
diff --git a/site/static/logos/rackspace.svg b/site/static/logos/rackspace.svg
new file mode 100644
index 000000000..ba1826aa0
--- /dev/null
+++ b/site/static/logos/rackspace.svg
@@ -0,0 +1,1 @@
+<svg viewBox="0 0 400 124" xmlns="http://www.w3.org/2000/svg"><path d="m209.54373 49.94388a15.55835 15.55835 0 0 1 -4.57177 11.482c-4.03269 4.00323-10.57473 6.186-18.44087 6.12551-5.64524-.0934-11.34888-1.46556-14.57576-3.44837l2.14967-11.30816a32.47292 32.47292 0 0 0 13.85364 3.90544c3.67131 0 6.14441-1.69394 6.14441-4.4112 0-2.46307-1.73844-4.18438-6.1791-6.357-7.02408-3.5123-10.53848-7.96487-10.53848-13.21258 0-10.32556 8.79471-17.30326 21.98985-17.30326 6.982 0 11.52742 1.64536 14.04775 3.26272l-2.14568 11.28577c-1.99764-1.50118-7.07486-3.59546-12.61249-3.59546-3.84589 0-6.35034 1.61078-6.35034 4.30735 0 1.93433 1.91647 3.66755 5.9734 5.64513 5.28562 2.64087 11.25577 6.5507 11.25577 13.62211zm-91.461-34.42411c-18.588 0-32.59372 13.57355-32.59372 31.57364 0 12.431 8.26011 20.458 21.07319 20.458 5.48048 0 10.8076-1.0042 14.23747-2.67359l2.34826-12.40166a26.23616 26.23616 0 0 1 -12.40616 3.20766c-4.68575 0-9.71219-2.69626-9.71219-10.22224 0-8.86856 6.28974-18.07228 16.84733-18.07228a16.14427 16.14427 0 0 1 8.18594 1.94864l2.29815-12.05778a28.61731 28.61731 0 0 0 -10.27829-1.76039zm260.63984 40.46823a33.06356 33.06356 0 0 0 17.42527-4.91748l-2.37542 12.48357c-7.069 3.60915-15.37371 4.001-18.61711 4.001-13.79994 0-21.68886-7.67454-21.68886-21.07361a33.098 33.098 0 0 1 7.78173-21.24087 27.69478 27.69478 0 0 1 21.34806-9.82283c10.44 0 17.40376 6.06533 17.40376 15.05832a13.63316 13.63316 0 0 1 -4.01858 10.1771c-4.986 4.85929-17.27484 7.5826-28.4667 5.38469-.53313 6.30617 4.21406 9.95011 11.20785 9.95011zm-9.58589-19.57254c8.70454.07146 13.60091-.809 15.73761-2.92484 2.31336-2.29863 1.58905-7.22332-4.11365-7.22332-6.41626 0-10.50118 5.26026-11.62396 10.14816zm-23.17479-20.89569c-18.588 0-32.59361 13.57355-32.59361 31.57364 0 12.431 8.26011 20.458 21.07319 20.458 5.48048 0 10.8076-1.0042 14.23747-2.67359l2.34826-12.40166a26.23515 26.23515 0 0 1 -12.40615 3.20766c-4.68576 0-9.7122-2.69616-9.7122-10.22224 0-8.86856 6.28974-18.07228 16.84733-18.07228a16.14427 16.14427 0 0 1 8.18594 1.94864l2.29821-12.05763a28.61741 28.61741 0 0 0 -10.27844-1.76054zm-35.03442 23.02132-5.34865 27.99217h-14.16654l1.84094-9.63467c-1.987 6.00463-6.82757 10.75651-14.94832 10.75651-9.85584 0-14.31-8.74936-14.3152-17.50552-.00679-9.94726 3.90126-19.79788 10.44675-26.34859a28.3221 28.3221 0 0 1 20.47027-8.38464c6.01863.024 10.47078 1.76612 13.26065 5.14721 4.12943 5.00387 3.79063 12.51554 2.7601 17.97753zm-13.639-6.44018c-.173-3.52965-2.01028-5.43264-5.30475-5.43264-6.97645 0-13.02036 12.04133-13.015 20.415.00188 5.23184 1.941 8.49 5.31489 8.49 5.39618 0 10.0439-5.64325 11.64266-13.90712.54453-2.79273 1.46149-7.37693 1.36224-9.56524zm-214.23989 6.44018-5.34858 27.99217h-14.16659l1.84093-9.63467c-1.98698 6.00463-6.82767 10.75651-14.94834 10.75651-9.85595 0-14.31-8.74936-14.3152-17.50552-.0068-9.94726 3.9012-19.79788 10.44667-26.34858a28.32235 28.32235 0 0 1 20.47038-8.38464c6.01852.024 10.47078 1.76612 13.26054 5.14721 4.12954 5.00386 3.79072 12.51553 2.76019 17.97752zm-13.63894-6.44018c-.173-3.52965-2.01028-5.43264-5.30476-5.43264-6.97644 0-13.02035 12.04133-13.01513 20.415.002 5.23184 1.941 8.49 5.315 8.49 5.39617 0 10.0439-5.64325 11.64266-13.90712.54452-2.79273 1.46148-7.37693 1.36223-9.56524zm193.58986 2.35055c0 12.16137-5.83894 24.63073-16.36341 30.24118a23.61072 23.61072 0 0 1 -10.78169 2.96288c-5.26861-.00031-8.2223-1.96964-9.90631-5.00628l-3.76753 19.912h-14.83162l12.591-66.22351h13.0634l-1.5273 8.03873c3.69064-5.3688 9.15649-8.96008 15.34323-8.96008 9.816-.00003 16.18023 7.43912 16.18023 19.03508zm-15.42471 1.12341c0-2.35735-.55664-8.08219-5.98928-8.08219-5.524 0-10.18754 6.29349-11.99546 15.83947-.6187 3.26376-2.35056 13.06392 4.47325 13.06392 7.7904 0 13.51149-11.05855 13.51149-20.8212zm-226.91218-8.10936 2.11423-11.12781h-13.06203l-9.71481 51.07889h14.83412l4.00563-21.06045c2.36184-12.41879 9.48674-17.3883 19.62644-15.85316l2.897-15.23572a20.54939 20.54939 0 0 0 -20.70058 12.19825zm118.97523 39.06775 5.10916-26.87639 10.51633 26.87639h15.95053l-10.88071-27.08983 19.80174-23.10573h-16.19228l-19.10679 22.8523 7.39068-38.87868h-14.73027l-12.59034 66.22194zm170.67071 35.11436c0 7.23495-5.00914 13.41446-12.23984 13.41446-5.35387 0-8.66493-3.7026-8.66493-8.75 0-7.18815 5.00914-13.41447 12.23985-13.41447 5.70285-.00004 8.66492 4.0941 8.66492 8.75001zm-15.67855 4.53248c0 2.91527 1.5236 4.96659 4.1367 4.96659 3.792 0 6.31569-5.22619 6.31569-9.45652 0-2.17474-1.00013-4.87721-4.05158-4.87721-4.04735.00004-6.40081 5.40494-6.40081 9.36714zm50.19359-4.53248c0 7.23495-5.00914 13.41446-12.23984 13.41446-5.35387 0-8.66493-3.7026-8.66493-8.75 0-7.18815 5.00914-13.41447 12.23985-13.41447 5.70282-.00004 8.66489 4.0941 8.66489 8.75001zm-15.67859 4.53248c0 2.91527 1.5236 4.96659 4.1367 4.96659 3.792 0 6.31569-5.22619 6.31569-9.45652 0-2.17474-1.00013-4.87721-4.05158-4.87721-4.04734.00004-6.40081 5.40494-6.40081 9.36714zm-11.2474-19.74672-5.35457 28.152h5.05579l5.3934-28.152zm-81.75589 6.50678a13.36486 13.36486 0 0 0 -13.457 13.63152c0 5.05167 3.26423 8.44784 8.57979 8.44784a14.26853 14.26853 0 0 0 6.25362-1.29436l.8368-4.40129a11.43927 11.43927 0 0 1 -5.69875 1.60151c-2.83014 0-4.66016-1.78745-4.66016-4.96231 0-4.44312 3.094-8.92877 7.97123-8.92877a7.67664 7.67664 0 0 1 3.90772.98891l.802-4.21829a11.68155 11.68155 0 0 0 -4.53527-.86476zm-28.97384 15.94243a5.8339 5.8339 0 0 1 -.566-3.00887c8.18823.17446 13.89108-1.57041 13.89108-7.00943 0-3.57491-2.65562-5.96669-6.83913-5.96669-7.31584 0-12.01853 6.96685-12.01853 13.36763 0 5.18361 2.83014 8.79682 8.71173 8.79682a16.51836 16.51836 0 0 0 8.01627-1.98822l.86812-4.56626a12.77184 12.77184 0 0 1 -7.70981 2.54977 4.68634 4.68634 0 0 1 -4.35375-2.17475zm5.83474-12.19726c1.613 0 2.69825.82564 2.69825 2.179 0 2.5663-3.35364 3.26427-8.57984 3.21743.61286-2.56629 2.70245-5.39643 5.88157-5.39643zm72.90289 2.04274c0-4.00477-2.35348-5.83053-5.40067-5.83053a9.17946 9.17946 0 0 0 -7.74683 4.44808l.78531-4.09915h-4.57331l-4.05871 21.33892h5.05578l1.87693-9.797c.915-4.97085 3.82609-7.75418 6.13276-7.75418 2.00452 0 2.65992 1.25973 2.65992 3.04719a14.16911 14.16911 0 0 1 -.25008 2.528l-2.27788 11.976h5.05578l2.36938-12.36752a19.87965 19.87965 0 0 0 .3716-3.48981zm-29.3697-5.83053a8.94158 8.94158 0 0 0 -7.05494 3.50879l1.91064-9.97295h-5.09462l-5.35457 28.152h5.05579l1.87692-9.79694c.915-4.97085 3.82609-7.7542 6.13278-7.7542 2.00455 0 2.65994 1.25973 2.65994 3.04718a14.16574 14.16574 0 0 1 -.25012 2.528l-2.27788 11.976h5.05579l2.36938-12.36752a19.87961 19.87961 0 0 0 .37155-3.4898c-.00002-4.0048-2.35346-5.83056-5.40068-5.83056zm-58.8692-4.98243h-4.932l-1.0835 5.45914h-2.8303l-.74055 3.91957h2.83457l-1.83024 9.45233a19.76593 19.76593 0 0 0 -.43835 3.91956c0 2.43869 1.528 4.35387 5.00926 4.35387a10.1187 10.1187 0 0 0 3.31112-.43419l.0001-.00054.76477-4.02077a10.01442 10.01442 0 0 1 -2.02893.191 1.67459 1.67459 0 0 1 -1.87249-1.91944 15.01425 15.01425 0 0 1 .3914-3.00466l1.65567-8.53721h4.74953l.783-3.91957h-4.74954zm170.3867 34.59707c3.88553 1.79743 7.71473 1.00187 10.49132-3.96508v-.00829l14.18906-25.29234h-5.40068l-8.05826 15.78909-1.95674-15.78909h-5.31557l3.78015 20.76942-1.65458 3.31541c-1.48671 2.54016-4.081 1.71123-5.28774 1.04182zm-6.90281-29.61464c-9.01974 0-13.63888 7.97486-13.63888 14.68546 0 3.79109 1.87378 7.49511 6.40584 7.49511a8.54174 8.54174 0 0 0 7.05046-3.78709l-.40618 1.8559c-1.04269 4.92406-3.57069 6.4902-6.8817 6.4902a12.261 12.261 0 0 1 -5.57518-1.264l-.78691 4.13906a15.06639 15.06639 0 0 0 6.25655 1.1765 12.46182 12.46182 0 0 0 7.92045-2.35348c2.42086-2.00023 3.61193-5.31129 4.40311-9.448l1.92035-9.61991a17.517 17.517 0 0 0 .43537-3.66049c0-3.83463-2.65829-5.70926-7.10328-5.70926zm1.61256 9.1077-.39183 1.96085c-.87159 4.27085-3.57341 6.97267-6.18816 6.97267-2.35268 0-3.35573-1.96085-3.35573-4.27085 0-4.18292 2.92036-9.89132 7.3645-9.89132a2.53434 2.53434 0 0 1 2.83243 2.70182 10.82485 10.82485 0 0 1 -.26121 2.52683zm35.62089 8.20622a4.37053 4.37053 0 0 0 -4.42249-4.87086 5.43124 5.43124 0 0 0 -5.29884 4.87086 4.35159 4.35159 0 0 0 4.42249 4.85048 5.39637 5.39637 0 0 0 5.29884-4.85048zm-.69293-.06114a4.7246 4.7246 0 0 1 -4.60591 4.21869 3.67361 3.67361 0 0 1 -3.72958-4.09641 4.726 4.726 0 0 1 4.60591-4.21869 3.68448 3.68448 0 0 1 3.72957 4.09641zm-3.36273.65216.77446 2.2622h-.75406l-.75405-2.20106h-1.08016l-.40761 2.20106h-.7133l1.08016-5.72682h1.875a1.48444 1.48444 0 0 1 1.52851 1.447 2.11636 2.11636 0 0 1 -1.54888 2.01763zm.02038-2.7717h-1.30434l-.4076 2.13992h1.18206a1.445 1.445 0 0 0 1.34508-1.14129.82458.82458 0 0 0 -.8152-.99863z" fill="#eb0000"/></svg>
\ No newline at end of file
diff --git a/tools/docker/envoy-gateway/Dockerfile b/tools/docker/envoy-gateway/Dockerfile
index 7de2492a3..cec7a9eec 100644
--- a/tools/docker/envoy-gateway/Dockerfile
+++ b/tools/docker/envoy-gateway/Dockerfile
@@ -6,7 +6,7 @@ RUN mkdir -p /var/lib/eg
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 FROM gcr.io/distroless/base-nossl:nonroot@sha256:d1fc914c43cea489c26c896721344a49a1761b9bb678bcba1758772d22913302
 ARG TARGETPLATFORM
-COPY $TARGETPLATFORM/envoy-gateway /usr/local/bin/
+COPY --chown=65532:65532 $TARGETPLATFORM/envoy-gateway /usr/local/bin/
 COPY --from=source --chown=65532:65532 /var/lib /var/lib
 
 USER 65532:65532


Test patch:
diff --git a/internal/gatewayapi/testdata/httproute-with-direct-response.in.yaml b/internal/gatewayapi/testdata/httproute-with-direct-response.in.yaml
index bd9a31622..29f5b5c7f 100644
--- a/internal/gatewayapi/testdata/httproute-with-direct-response.in.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-direct-response.in.yaml
@@ -49,7 +49,7 @@ httpRoutes:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
-    name: direct-response-with-errors
+    name: direct-response-with-value-not-found
     namespace: default
   spec:
     parentRefs:
@@ -67,6 +67,27 @@ httpRoutes:
           group: gateway.envoyproxy.io
           kind: HTTPRouteFilter
           name: direct-response-value-ref-not-found
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    name: direct-response-too-long
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /too-long
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: gateway.envoyproxy.io
+          kind: HTTPRouteFilter
+          name: direct-response-too-long
 configMaps:
 - apiVersion: v1
   kind: ConfigMap
@@ -117,3 +138,14 @@ httpFilters:
           group: ""
           kind: ConfigMap
           name: value-ref-response
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: HTTPRouteFilter
+  metadata:
+    name: direct-response-too-long
+    namespace: default
+  spec:
+    directResponse:
+      contentType: text/plain
+      body:
+        type: Inline
+        inline: "-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------"
diff --git a/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml b/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml
index ca1005fde..fbe18fd92 100644
--- a/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml
@@ -17,7 +17,7 @@ gateways:
       protocol: HTTP
   status:
     listeners:
-    - attachedRoutes: 2
+    - attachedRoutes: 3
       conditions:
       - lastTransitionTime: null
         message: Sending translated listener configuration to the data plane
@@ -95,7 +95,7 @@ httpRoutes:
   kind: HTTPRoute
   metadata:
     creationTimestamp: null
-    name: direct-response-with-errors
+    name: direct-response-with-value-not-found
     namespace: default
   spec:
     parentRefs:
@@ -131,6 +131,47 @@ httpRoutes:
         name: gateway-1
         namespace: envoy-gateway
         sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: direct-response-too-long
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - extensionRef:
+          group: gateway.envoyproxy.io
+          kind: HTTPRouteFilter
+          name: direct-response-too-long
+        type: ExtensionRef
+      matches:
+      - path:
+          type: PathPrefix
+          value: /too-long
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Invalid filter HTTPRouteFilter: response.body size 4097 greater
+          than the max size 4096'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
 infraIR:
   envoy-gateway/gateway-1:
     proxy:
diff --git a/internal/infrastructure/kubernetes/proxy/resource_provider_test.go b/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
index 478a70dec..5d8708639 100644
--- a/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
+++ b/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
@@ -374,7 +374,7 @@ func TestDeployment(t *testing.T) {
 			infra:    newTestInfra(),
 			deploy:   nil,
 			proxyLogging: map[egv1a1.ProxyLogComponent]egv1a1.LogLevel{
-				egv1a1.LogComponentDefault: egv1a1.LogLevelError,
+				egv1a1.LogComponentDefault: egv1a1.LogLevelTrace,
 				egv1a1.LogComponentFilter:  egv1a1.LogLevelInfo,
 			},
 			bootstrap: `test bootstrap config`,
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
index 7b7d7f175..04289454d 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
@@ -42,7 +42,7 @@ spec:
         - --service-cluster default
         - --service-node $(ENVOY_POD_NAME)
         - --config-yaml test bootstrap config
-        - --log-level error
+        - --log-level trace
         - --cpuset-threads
         - --drain-strategy immediate
         - --component-log-level filter:info
diff --git a/internal/wasm/premissioncache_test.go b/internal/wasm/premissioncache_test.go
index 5066a4189..0c1684651 100644
--- a/internal/wasm/premissioncache_test.go
+++ b/internal/wasm/premissioncache_test.go
@@ -74,7 +74,7 @@ func TestPermissionCache(t *testing.T) {
 		defer ctx.Done()
 		cache, entry := setupTestPermissionCache(
 			permissionCacheOptions{
-				checkInterval:    10 * time.Nanosecond,
+				checkInterval:    1 * time.Nanosecond,
 				permissionExpiry: 10 * time.Nanosecond,
 			},
 			image,
@@ -85,7 +85,7 @@ func TestPermissionCache(t *testing.T) {
 		lastAccessTime := entry.lastAccess
 		lastCheckTime := entry.lastCheck
 
-		time.Sleep(1 * time.Millisecond)
+		time.Sleep(10 * time.Millisecond)
 		allowed, err := cache.IsAllowed(context.Background(), image, secret, true)
 		require.True(
 			t,
@@ -111,7 +111,7 @@ func TestPermissionCache(t *testing.T) {
 		defer ctx.Done()
 		cache, entry := setupTestPermissionCache(
 			permissionCacheOptions{
-				checkInterval:    10 * time.Nanosecond,
+				checkInterval:    1 * time.Nanosecond,
 				permissionExpiry: 10 * time.Nanosecond,
 			},
 			image,
@@ -122,7 +122,7 @@ func TestPermissionCache(t *testing.T) {
 		lastAccessTime := entry.lastAccess
 		lastCheckTime := entry.lastCheck
 
-		time.Sleep(1 * time.Millisecond)
+		time.Sleep(10 * time.Millisecond)
 		allowed, err := cache.IsAllowed(context.Background(), image, secret, true)
 		require.False(t, isRetriableError(err), "permission check error should not be retriable")
 		require.False(
@@ -149,7 +149,7 @@ func TestPermissionCache(t *testing.T) {
 		defer ctx.Done()
 		cache, entry := setupTestPermissionCache(
 			permissionCacheOptions{
-				checkInterval: 10 * time.Nanosecond,
+				checkInterval: 1 * time.Nanosecond,
 				cacheExpiry:   10 * time.Nanosecond,
 			},
 			image,
@@ -160,7 +160,7 @@ func TestPermissionCache(t *testing.T) {
 		lastAccessTime := entry.lastAccess
 		lastCheckTime := entry.lastCheck
 
-		time.Sleep(1 * time.Millisecond)
+		time.Sleep(10 * time.Millisecond)
 		key := entry.key()
 		entry, ok := cache.getForTest(key)
 		require.False(t, ok, "cache entry should be removed after expiry")
@@ -186,7 +186,7 @@ func TestPermissionCache(t *testing.T) {
 		defer ctx.Done()
 		cache, entry := setupTestPermissionCache(
 			permissionCacheOptions{
-				checkInterval: 10 * time.Nanosecond,
+				checkInterval: 1 * time.Nanosecond,
 			},
 			image,
 			latestImage,
@@ -223,7 +223,7 @@ func TestPermissionCache(t *testing.T) {
 		defer ctx.Done()
 		cache, entry := setupTestPermissionCache(
 			permissionCacheOptions{
-				checkInterval: 10 * time.Nanosecond,
+				checkInterval: 1 * time.Nanosecond,
 			},
 			image,
 			latestImage,
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 683e2f8c3..23355bd2a 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -2920,6 +2920,7 @@ _Appears in:_
 
 | Value | Description |
 | ----- | ----------- |
+| `trace` | LogLevelTrace defines the "Trace" logging level.<br /> | 
 | `debug` | LogLevelDebug defines the "debug" logging level.<br /> | 
 | `info` | LogLevelInfo defines the "Info" logging level.<br /> | 
 | `warn` | LogLevelWarn defines the "Warn" logging level.<br /> | 
diff --git a/site/content/en/latest/tasks/traffic/direct-response.md b/site/content/en/latest/tasks/traffic/direct-response.md
index dfaa6755d..4d043a59d 100644
--- a/site/content/en/latest/tasks/traffic/direct-response.md
+++ b/site/content/en/latest/tasks/traffic/direct-response.md
@@ -13,6 +13,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 
 ## Testing Direct Response 
 
+Note: the size of the response body (whether provided in-line or via a reference) cannot exceed 4096 bytes.
+
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}