Repository: envoyproxy/gateway
Pull request #3469 (2024-05-24 05:14:15)

ext_auth support backendRefs
xref: https://github.com/envoyproxy/gateway/issues/3091

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/envoyproxy/gateway/pull/3469?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) Report
Attention: Patch coverage is `60.00000%` with `2 lines` in your changes are missing coverage. Please review.
> Project coverage is 67.09%. Comparing base [(`c348370`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/c348370d076a5b5b4bd2421d7d9df5f86755a717?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) to head [(`9849ffa`)](https://app.codecov.io/gh/envoyproxy/gateway/pull/3469?dropdown=coverage&src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

| [Files](https://app.codecov.io/gh/envoyproxy/gateway/pull/3469?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) | Patch % | Lines |
|---|---|---|
| [internal/provider/kubernetes/controller.go](https://app.codecov.io/gh/envoyproxy/gateway/pull/3469?src=pr&el=tree&filepath=internal%2Fprovider%2Fkubernetes%2Fcontroller.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy#diff-aW50ZXJuYWwvcHJvdmlkZXIva3ViZXJuZXRlcy9jb250cm9sbGVyLmdv) | 0.00% | [1 Missing :warning: ](https://app.codecov.io/gh/envoyproxy/gateway/pull/3469?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) |
| [internal/provider/kubernetes/indexers.go](https://app.codecov.io/gh/envoyproxy/gateway/pull/3469?src=pr&el=tree&filepath=internal%2Fprovider%2Fkubernetes%2Findexers.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy#diff-aW50ZXJuYWwvcHJvdmlkZXIva3ViZXJuZXRlcy9pbmRleGVycy5nbw==) | 50.00% | [1 Missing :warning: ](https://app.codecov.io/gh/envoyproxy/gateway/pull/3469?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) |

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #3469      +/-   ##
==========================================
- Coverage   67.09%   67.09%   -0.01%     
==========================================
  Files         166      166              
  Lines       19618    19618              
==========================================
- Hits        13163    13162       -1     
- Misses       5504     5505       +1     
  Partials      951      951              
```



</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/envoyproxy/gateway/pull/3469?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

arkodg: just realized, this is the Api PR
zirain: > just realized, this is the Api PR :)

everything is here.

> will the support for multiple backendRefs be in a follow up ?

is there any user case for this?
zirain: wait https://github.com/envoyproxy/gateway/pull/3478

Patch:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1ecbac3d9..491e4450e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@b7cec7526559c32f1616476ff32d17ba4c59b2d6  # v3.25.5
+      uses: github/codeql-action/init@9fdb3e49720b44c48891d036bb502feb25684276  # v3.25.6
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@b7cec7526559c32f1616476ff32d17ba4c59b2d6  # v3.25.5
+      uses: github/codeql-action/autobuild@9fdb3e49720b44c48891d036bb502feb25684276  # v3.25.6
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b7cec7526559c32f1616476ff32d17ba4c59b2d6  # v3.25.5
+      uses: github/codeql-action/analyze@9fdb3e49720b44c48891d036bb502feb25684276  # v3.25.6
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b578a9ab4..b7dd2f9be 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@b7cec7526559c32f1616476ff32d17ba4c59b2d6  # v3.25.5
+      uses: github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276  # v3.25.6
       with:
         sarif_file: results.sarif
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index f4c8ac42f..c21d2f4fc 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -25,7 +25,7 @@ jobs:
         IMAGE=envoy-proxy/gateway-dev TAG=${{ github.sha }} make image
 
     - name: Run Trivy vulnerability scanner
-      uses: aquasecurity/trivy-action@b2933f565dbc598b29947660e66259e3c7bc8561  # v0.20.0
+      uses: aquasecurity/trivy-action@fd25fed6972e341ff0007ddb61f77e88103953c2  # v0.21.0
       with:
         image-ref: envoy-proxy/gateway-dev:${{ github.sha }}
         exit-code: '1'
diff --git a/api/v1alpha1/ext_auth_types.go b/api/v1alpha1/ext_auth_types.go
index 6e455aa42..906f13c40 100644
--- a/api/v1alpha1/ext_auth_types.go
+++ b/api/v1alpha1/ext_auth_types.go
@@ -9,14 +9,14 @@ import (
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
+// ExtAuth defines the configuration for External Authorization.
+//
 // +kubebuilder:validation:XValidation:rule="(has(self.grpc) || has(self.http))",message="one of grpc or http must be specified"
 // +kubebuilder:validation:XValidation:rule="(has(self.grpc) && !has(self.http)) || (!has(self.grpc) && has(self.http))",message="only one of grpc or http can be specified"
-// +kubebuilder:validation:XValidation:rule="has(self.grpc) ? (!has(self.grpc.backendRef.group) || self.grpc.backendRef.group == \"\") : true", message="group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) is supported"
-// +kubebuilder:validation:XValidation:rule="has(self.grpc) ? (!has(self.grpc.backendRef.kind) || self.grpc.backendRef.kind == 'Service') : true", message="kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported"
-// +kubebuilder:validation:XValidation:rule="has(self.http) ? (!has(self.http.backendRef.group) || self.http.backendRef.group == \"\") : true", message="group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) is supported"
-// +kubebuilder:validation:XValidation:rule="has(self.http) ? (!has(self.http.backendRef.kind) || self.http.backendRef.kind == 'Service') : true", message="kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported"
-//
-// ExtAuth defines the configuration for External Authorization.
+// +kubebuilder:validation:XValidation:rule="has(self.grpc) ? (!has(self.grpc.backendRef) || !has(self.grpc.backendRef.group) || self.grpc.backendRef.group == \"\") : true", message="group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) is supported"
+// +kubebuilder:validation:XValidation:rule="has(self.grpc) ? (!has(self.grpc.backendRef) || !has(self.grpc.backendRef.kind) || self.grpc.backendRef.kind == 'Service') : true", message="kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported"
+// +kubebuilder:validation:XValidation:rule="has(self.http) ? (!has(self.http.backendRef) || !has(self.http.backendRef.group) || self.http.backendRef.group == \"\") : true", message="group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) is supported"
+// +kubebuilder:validation:XValidation:rule="has(self.http) ? (!has(self.http.backendRef) || !has(self.http.backendRef.kind) || self.http.backendRef.kind == 'Service') : true", message="kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported"
 type ExtAuth struct {
 	// GRPC defines the gRPC External Authorization service.
 	// Either GRPCService or HTTPService must be specified,
@@ -55,19 +55,42 @@ type ExtAuth struct {
 // GRPCExtAuthService defines the gRPC External Authorization service
 // The authorization request message is defined in
 // https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+// +kubebuilder:validation:XValidation:message="backendRef or backendRefs needs to be set",rule="has(self.backendRef) || self.backendRefs.size() > 0"
 type GRPCExtAuthService struct {
 	// BackendRef references a Kubernetes object that represents the
 	// backend server to which the authorization request will be sent.
 	// Only service Kind is supported for now.
-	BackendRef gwapiv1.BackendObjectReference `json:"backendRef"`
+	// Deprecated: Use BackendRefs instead.
+	BackendRef *gwapiv1.BackendObjectReference `json:"backendRef,omitempty"`
+
+	// BackendRefs references a Kubernetes object that represents the
+	// backend server to which the authorization request will be sent.
+	// Only service Kind is supported for now.
+	//
+	// +optional
+	// +kubebuilder:validation:MaxItems=1
+	// +kubebuilder:validation:XValidation:message="only support Service kind.",rule="self.all(f, f.kind == 'Service')"
+	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
 }
 
 // HTTPExtAuthService defines the HTTP External Authorization service
+//
+// +kubebuilder:validation:XValidation:message="backendRef or backendRefs needs to be set",rule="has(self.backendRef) || self.backendRefs.size() > 0"
 type HTTPExtAuthService struct {
 	// BackendRef references a Kubernetes object that represents the
 	// backend server to which the authorization request will be sent.
 	// Only service Kind is supported for now.
-	BackendRef gwapiv1.BackendObjectReference `json:"backendRef"`
+	// Deprecated: Use BackendRefs instead.
+	BackendRef *gwapiv1.BackendObjectReference `json:"backendRef,omitempty"`
+
+	// BackendRefs references a Kubernetes object that represents the
+	// backend server to which the authorization request will be sent.
+	// Only service Kind is supported for now.
+	//
+	// +optional
+	// +kubebuilder:validation:MaxItems=1
+	// +kubebuilder:validation:XValidation:message="only support Service kind.",rule="self.all(f, f.kind == 'Service')"
+	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
 
 	// Path is the path of the HTTP External Authorization service.
 	// If path is specified, the authorization request will be sent to that path,
diff --git a/api/v1alpha1/share_types_helper.go b/api/v1alpha1/share_types_helper.go
new file mode 100644
index 000000000..ab0555356
--- /dev/null
+++ b/api/v1alpha1/share_types_helper.go
@@ -0,0 +1,18 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package v1alpha1
+
+import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+
+func ToBackendObjectReference(ref BackendRef) *gwapiv1.BackendObjectReference {
+	return &gwapiv1.BackendObjectReference{
+		Group:     ref.Group,
+		Kind:      ref.Kind,
+		Namespace: ref.Namespace,
+		Name:      ref.Name,
+		Port:      ref.Port,
+	}
+}
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index c3163b73a..67918dabd 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -2164,7 +2164,18 @@ func (in *FilterPosition) DeepCopy() *FilterPosition {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GRPCExtAuthService) DeepCopyInto(out *GRPCExtAuthService) {
 	*out = *in
-	in.BackendRef.DeepCopyInto(&out.BackendRef)
+	if in.BackendRef != nil {
+		in, out := &in.BackendRef, &out.BackendRef
+		*out = new(apisv1.BackendObjectReference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.BackendRefs != nil {
+		in, out := &in.BackendRefs, &out.BackendRefs
+		*out = make([]BackendRef, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GRPCExtAuthService.
@@ -2397,7 +2408,18 @@ func (in *HTTPClientTimeout) DeepCopy() *HTTPClientTimeout {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HTTPExtAuthService) DeepCopyInto(out *HTTPExtAuthService) {
 	*out = *in
-	in.BackendRef.DeepCopyInto(&out.BackendRef)
+	if in.BackendRef != nil {
+		in, out := &in.BackendRef, &out.BackendRef
+		*out = new(apisv1.BackendObjectReference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.BackendRefs != nil {
+		in, out := &in.BackendRefs, &out.BackendRefs
+		*out = make([]BackendRef, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	if in.Path != nil {
 		in, out := &in.Path, &out.Path
 		*out = new(string)
diff --git a/charts/gateway-helm/README.md b/charts/gateway-helm/README.md
index c2d5f63fe..3caff48fd 100644
--- a/charts/gateway-helm/README.md
+++ b/charts/gateway-helm/README.md
@@ -8,10 +8,10 @@ The Helm chart for Envoy Gateway
 
 ## Maintainers
 
-| Name                             | Email | Url                                                             |
-| -------------------------------- | ----- | --------------------------------------------------------------- |
-| envoy-gateway-steering-committee |       | <https://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md> |
-| envoy-gateway-maintainers        |       | <https://github.com/envoyproxy/gateway/blob/main/CODEOWNERS>    |
+| Name | Email | Url |
+| ---- | ------ | --- |
+| envoy-gateway-steering-committee |  | <https://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md> |
+| envoy-gateway-maintainers |  | <https://github.com/envoyproxy/gateway/blob/main/CODEOWNERS> |
 
 ## Source Code
 
@@ -57,35 +57,44 @@ To uninstall the chart:
 
 ## Values
 
-| Key                                                | Type   | Default                                           | Description |
-|----------------------------------------------------| ------ |---------------------------------------------------| ----------- |
-| config.envoyGateway.gateway.controllerName         | string | `"gateway.envoyproxy.io/gatewayclass-controller"` |             |
-| config.envoyGateway.provider.type                  | string | `"Kubernetes"`                                    |             |
-| deployment.envoyGateway.image.repository           | string | `"docker.io/envoyproxy/gateway-dev"`              |             |
-| deployment.envoyGateway.image.tag                  | string | `"latest"`                                        |             |
-| deployment.envoyGateway.imagePullPolicy            | string | `"Always"`                                        |             |
-| deployment.envoyGateway.resources.limits.cpu       | string | `"500m"`                                          |             |
-| deployment.envoyGateway.resources.limits.memory    | string | `"128Mi"`                                         |             |
-| deployment.envoyGateway.resources.requests.cpu     | string | `"10m"`                                           |             |
-| deployment.envoyGateway.resources.requests.memory  | string | `"64Mi"`                                          |             |
-| deployment.kubeRbacProxy.image.repository          | string | `"gcr.io/kubebuilder/kube-rbac-proxy"`            |             |
-| deployment.kubeRbacProxy.image.tag                 | string | `"v0.11.0"`                                       |             |
-| deployment.kubeRbacProxy.imagePullPolicy           | string | `"IfNotPresent"`                                  |             |
-| deployment.kubeRbacProxy.resources.limits.cpu      | string | `"500m"`                                          |             |
-| deployment.kubeRbacProxy.resources.limits.memory   | string | `"128Mi"`                                         |             |
-| deployment.kubeRbacProxy.resources.requests.cpu    | string | `"5m"`                                            |             |
-| deployment.kubeRbacProxy.resources.requests.memory | string | `"64Mi"`                                          |             |
-| deployment.ports[0].name                           | string | `"grpc"`                                          |             |
-| deployment.ports[0].port                           | int    | `18000`                                           |             |
-| deployment.ports[0].targetPort                     | int    | `18000`                                           |             |
-| deployment.ports[1].name                           | string | `"ratelimit"`                                     |             |
-| deployment.ports[1].port                           | int    | `18001`                                           |             |
-| deployment.ports[1].targetPort                     | int    | `18001`                                           |             |
-| deployment.replicas                                | int    | `1`                                               |             |
-| deployment.pod.annotations                         | object | `{}`                                              |             |
-| deployment.pod.labels                              | object | `{}`                                              |             |
-| envoyGatewayMetricsService.ports[0].name           | string | `"https"`                                         |             |
-| envoyGatewayMetricsService.ports[0].port           | int    | `8443`                                            |             |
-| envoyGatewayMetricsService.ports[0].protocol       | string | `"TCP"`                                           |             |
-| envoyGatewayMetricsService.ports[0].targetPort     | string | `"https"`                                         |             |
-| kubernetesClusterDomain                            | string | `"cluster.local"`                                 |             |
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| certgen.job.annotations | object | `{}` |  |
+| certgen.job.resources | object | `{}` |  |
+| certgen.job.ttlSecondsAfterFinished | int | `30` |  |
+| certgen.rbac.annotations | object | `{}` |  |
+| certgen.rbac.labels | object | `{}` |  |
+| config.envoyGateway.gateway.controllerName | string | `"gateway.envoyproxy.io/gatewayclass-controller"` |  |
+| config.envoyGateway.logging.level.default | string | `"info"` |  |
+| config.envoyGateway.provider.type | string | `"Kubernetes"` |  |
+| createNamespace | bool | `false` |  |
+| deployment.envoyGateway.image.repository | string | `""` |  |
+| deployment.envoyGateway.image.tag | string | `""` |  |
+| deployment.envoyGateway.imagePullPolicy | string | `""` |  |
+| deployment.envoyGateway.imagePullSecrets | list | `[]` |  |
+| deployment.envoyGateway.resources.limits.cpu | string | `"500m"` |  |
+| deployment.envoyGateway.resources.limits.memory | string | `"1024Mi"` |  |
+| deployment.envoyGateway.resources.requests.cpu | string | `"100m"` |  |
+| deployment.envoyGateway.resources.requests.memory | string | `"256Mi"` |  |
+| deployment.pod.affinity | object | `{}` |  |
+| deployment.pod.annotations."prometheus.io/port" | string | `"19001"` |  |
+| deployment.pod.annotations."prometheus.io/scrape" | string | `"true"` |  |
+| deployment.pod.labels | object | `{}` |  |
+| deployment.ports[0].name | string | `"grpc"` |  |
+| deployment.ports[0].port | int | `18000` |  |
+| deployment.ports[0].targetPort | int | `18000` |  |
+| deployment.ports[1].name | string | `"ratelimit"` |  |
+| deployment.ports[1].port | int | `18001` |  |
+| deployment.ports[1].targetPort | int | `18001` |  |
+| deployment.ports[2].name | string | `"metrics"` |  |
+| deployment.ports[2].port | int | `19001` |  |
+| deployment.ports[2].targetPort | int | `19001` |  |
+| deployment.replicas | int | `1` |  |
+| global.images.envoyGateway.image | string | `nil` |  |
+| global.images.envoyGateway.pullPolicy | string | `nil` |  |
+| global.images.envoyGateway.pullSecrets | list | `[]` |  |
+| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` |  |
+| global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` |  |
+| global.images.ratelimit.pullSecrets | list | `[]` |  |
+| kubernetesClusterDomain | string | `"cluster.local"` |  |
+
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index 919d272cf..00e1b791e 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -247,6 +247,7 @@ spec:
                           BackendRef references a Kubernetes object that represents the
                           backend server to which the authorization request will be sent.
                           Only service Kind is supported for now.
+                          Deprecated: Use BackendRefs instead.
                         properties:
                           group:
                             default: ""
@@ -321,9 +322,97 @@ spec:
                         - message: Must have port for Service reference
                           rule: '(size(self.group) == 0 && self.kind == ''Service'')
                             ? has(self.port) : true'
-                    required:
-                    - backendRef
+                      backendRefs:
+                        description: |-
+                          BackendRefs references a Kubernetes object that represents the
+                          backend server to which the authorization request will be sent.
+                          Only service Kind is supported for now.
+                        items:
+                          description: BackendRef defines how an ObjectReference that
+                            is specific to BackendRef.
+                          properties:
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Service
+                              description: |-
+                                Kind is the Kubernetes resource kind of the referent. For example
+                                "Service".
+
+
+                                Defaults to "Service" when not specified.
+
+
+                                ExternalName services can refer to CNAME DNS records that may live
+                                outside of the cluster and as such are difficult to reason about in
+                                terms of conformance. They also may not be safe to forward to (see
+                                CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                support ExternalName Services.
+
+
+                                Support: Core (Services with a type other than ExternalName)
+
+
+                                Support: Implementation-specific (Services with type ExternalName)
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the backend. When unspecified, the local
+                                namespace is inferred.
+
+
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+
+
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                            port:
+                              description: |-
+                                Port specifies the destination port number to use for this resource.
+                                Port is required when the referent is a Kubernetes Service. In this
+                                case, the port number is the service port number, not the target port.
+                                For other resources, destination port might be derived from the referent
+                                resource or this field.
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                          required:
+                          - name
+                          type: object
+                          x-kubernetes-validations:
+                          - message: Must have port for Service reference
+                            rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                              ? has(self.port) : true'
+                        maxItems: 1
+                        type: array
+                        x-kubernetes-validations:
+                        - message: only support Service kind.
+                          rule: self.all(f, f.kind == 'Service')
                     type: object
+                    x-kubernetes-validations:
+                    - message: backendRef or backendRefs needs to be set
+                      rule: has(self.backendRef) || self.backendRefs.size() > 0
                   headersToExtAuth:
                     description: |-
                       HeadersToExtAuth defines the client request headers that will be included
@@ -350,6 +439,7 @@ spec:
                           BackendRef references a Kubernetes object that represents the
                           backend server to which the authorization request will be sent.
                           Only service Kind is supported for now.
+                          Deprecated: Use BackendRefs instead.
                         properties:
                           group:
                             default: ""
@@ -424,6 +514,93 @@ spec:
                         - message: Must have port for Service reference
                           rule: '(size(self.group) == 0 && self.kind == ''Service'')
                             ? has(self.port) : true'
+                      backendRefs:
+                        description: |-
+                          BackendRefs references a Kubernetes object that represents the
+                          backend server to which the authorization request will be sent.
+                          Only service Kind is supported for now.
+                        items:
+                          description: BackendRef defines how an ObjectReference that
+                            is specific to BackendRef.
+                          properties:
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Service
+                              description: |-
+                                Kind is the Kubernetes resource kind of the referent. For example
+                                "Service".
+
+
+                                Defaults to "Service" when not specified.
+
+
+                                ExternalName services can refer to CNAME DNS records that may live
+                                outside of the cluster and as such are difficult to reason about in
+                                terms of conformance. They also may not be safe to forward to (see
+                                CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                support ExternalName Services.
+
+
+                                Support: Core (Services with a type other than ExternalName)
+
+
+                                Support: Implementation-specific (Services with type ExternalName)
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the backend. When unspecified, the local
+                                namespace is inferred.
+
+
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+
+
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                            port:
+                              description: |-
+                                Port specifies the destination port number to use for this resource.
+                                Port is required when the referent is a Kubernetes Service. In this
+                                case, the port number is the service port number, not the target port.
+                                For other resources, destination port might be derived from the referent
+                                resource or this field.
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                          required:
+                          - name
+                          type: object
+                          x-kubernetes-validations:
+                          - message: Must have port for Service reference
+                            rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                              ? has(self.port) : true'
+                        maxItems: 1
+                        type: array
+                        x-kubernetes-validations:
+                        - message: only support Service kind.
+                          rule: self.all(f, f.kind == 'Service')
                       headersToBackend:
                         description: |-
                           HeadersToBackend are the authorization response headers that will be added
@@ -440,9 +617,10 @@ spec:
                           If path is specified, the authorization request will be sent to that path,
                           or else the authorization request will be sent to the root path.
                         type: string
-                    required:
-                    - backendRef
                     type: object
+                    x-kubernetes-validations:
+                    - message: backendRef or backendRefs needs to be set
+                      rule: has(self.backendRef) || self.backendRefs.size() > 0
                 type: object
                 x-kubernetes-validations:
                 - message: one of grpc or http must be specified
@@ -453,21 +631,21 @@ spec:
                 - message: group is invalid, only the core API group (specified by
                     omitting the group field or setting it to an empty string) is
                     supported
-                  rule: 'has(self.grpc) ? (!has(self.grpc.backendRef.group) || self.grpc.backendRef.group
-                    == "") : true'
+                  rule: 'has(self.grpc) ? (!has(self.grpc.backendRef) || !has(self.grpc.backendRef.group)
+                    || self.grpc.backendRef.group == "") : true'
                 - message: kind is invalid, only Service (specified by omitting the
                     kind field or setting it to 'Service') is supported
-                  rule: 'has(self.grpc) ? (!has(self.grpc.backendRef.kind) || self.grpc.backendRef.kind
-                    == ''Service'') : true'
+                  rule: 'has(self.grpc) ? (!has(self.grpc.backendRef) || !has(self.grpc.backendRef.kind)
+                    || self.grpc.backendRef.kind == ''Service'') : true'
                 - message: group is invalid, only the core API group (specified by
                     omitting the group field or setting it to an empty string) is
                     supported
-                  rule: 'has(self.http) ? (!has(self.http.backendRef.group) || self.http.backendRef.group
-                    == "") : true'
+                  rule: 'has(self.http) ? (!has(self.http.backendRef) || !has(self.http.backendRef.group)
+                    || self.http.backendRef.group == "") : true'
                 - message: kind is invalid, only Service (specified by omitting the
                     kind field or setting it to 'Service') is supported
-                  rule: 'has(self.http) ? (!has(self.http.backendRef.kind) || self.http.backendRef.kind
-                    == ''Service'') : true'
+                  rule: 'has(self.http) ? (!has(self.http.backendRef) || !has(self.http.backendRef.kind)
+                    || self.http.backendRef.kind == ''Service'') : true'
               jwt:
                 description: JWT defines the configuration for JSON Web Token (JWT)
                   authentication.
diff --git a/charts/gateway-helm/templates/_helpers.tpl b/charts/gateway-helm/templates/_helpers.tpl
index 0802657f8..d9aefc2a8 100755
--- a/charts/gateway-helm/templates/_helpers.tpl
+++ b/charts/gateway-helm/templates/_helpers.tpl
@@ -88,9 +88,9 @@ Pull secrets for the Envoy Gateway image.
 {{- if .Values.deployment.envoyGateway.imagePullSecrets -}}
 imagePullSecrets:
 {{ toYaml .Values.deployment.envoyGateway.imagePullSecrets }}
-{{- else if .Values.global.images.envoyGateway.imagePullSecrets -}}
+{{- else if .Values.global.images.envoyGateway.pullSecrets -}}
 imagePullSecrets:
-{{ toYaml .Values.global.images.envoyGateway.imagePullSecrets }}
+{{ toYaml .Values.global.images.envoyGateway.pullSecrets }}
 {{- else -}}
 imagePullSecrets: []
 {{- end }}
@@ -110,6 +110,22 @@ provider:
         {{- else }}
         image: "docker.io/envoyproxy/ratelimit:master"
         {{- end }}
+      {{- with .Values.global.images.ratelimit.pullSecrets }}
+      pod:
+        imagePullSecrets:
+        {{- toYaml . | nindent 10 }}
+      {{- end }}
+      {{- with .Values.global.images.ratelimit.pullPolicy }}
+      patch:
+        type: StrategicMerge
+        value:
+          spec:
+            template:
+              spec:
+                containers:
+                - name: envoy-ratelimit
+                  imagePullPolicy: {{ . }}
+      {{- end }}
     shutdownManager:
       image: {{ include "eg.image" . }}
 {{- end }}
diff --git a/charts/gateway-helm/values.tmpl.yaml b/charts/gateway-helm/values.tmpl.yaml
index 0513ff811..21fd1e02c 100644
--- a/charts/gateway-helm/values.tmpl.yaml
+++ b/charts/gateway-helm/values.tmpl.yaml
@@ -9,17 +9,15 @@ global:
       # Default behavior: latest images will be Always else IfNotPresent.
       pullPolicy: ${GatewayImagePullPolicy}
       # List of secrets in the same namespace of the component that can be used to pull images from private repositories.
-      imagePullSecrets: []
+      pullSecrets: []
     ratelimit:
       # This is the full image name including the hub, repo, and tag.
       image: "docker.io/envoyproxy/ratelimit:master"
-      # TODO: zhaohuabing add support for imagePullSecrets for ratelimit
       # Specify image pull policy if default behavior isn't desired.
       # Default behavior: latest images will be Always else IfNotPresent.
-      # pullPolicy: IfNotPresent
+      pullPolicy: IfNotPresent
       # List of secrets in the same namespace of the component that can be used to pull images from private repositories.
-      # imagePullSecrets: []
-    # statsd: TODO: zhaohuabing add custom image support for statsd image
+      pullSecrets: []
 
 deployment:
   envoyGateway:
diff --git a/go.mod b/go.mod
index a8b6e001b..fdf1e3ca2 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/envoyproxy/gateway
 go 1.22.3
 
 require (
-	fortio.org/fortio v1.63.7
+	fortio.org/fortio v1.63.8
 	fortio.org/log v1.12.2
 	github.com/Masterminds/semver/v3 v3.2.1
 	github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b
@@ -14,7 +14,7 @@ require (
 	github.com/evanphx/json-patch/v5 v5.9.0
 	github.com/fatih/color v1.17.0
 	github.com/go-logfmt/logfmt v0.6.0
-	github.com/go-logr/logr v1.4.1
+	github.com/go-logr/logr v1.4.2
 	github.com/go-logr/zapr v1.3.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/golang/protobuf v1.5.4
@@ -28,21 +28,21 @@ require (
 	github.com/stretchr/testify v1.9.0
 	github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7
 	github.com/tsaarni/certyaml v0.9.3
-	go.opentelemetry.io/otel v1.26.0
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.26.0
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.26.0
-	go.opentelemetry.io/otel/exporters/prometheus v0.48.0
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.26.0
-	go.opentelemetry.io/otel/metric v1.26.0
-	go.opentelemetry.io/otel/sdk/metric v1.26.0
+	go.opentelemetry.io/otel v1.27.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.27.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.27.0
+	go.opentelemetry.io/otel/exporters/prometheus v0.49.0
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.27.0
+	go.opentelemetry.io/otel/metric v1.27.0
+	go.opentelemetry.io/otel/sdk/metric v1.27.0
 	go.opentelemetry.io/proto/otlp v1.2.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f
+	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
 	golang.org/x/sys v0.20.0
 	google.golang.org/grpc v1.64.0
 	google.golang.org/protobuf v1.34.1
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.15.0
+	helm.sh/helm/v3 v3.15.1
 	k8s.io/api v0.30.1
 	k8s.io/apiextensions-apiserver v0.30.1
 	k8s.io/apimachinery v0.30.1
@@ -50,7 +50,7 @@ require (
 	k8s.io/client-go v0.30.1
 	k8s.io/kubectl v0.30.1
 	k8s.io/utils v0.0.0-20240423183400-0849a56e8f22
-	sigs.k8s.io/controller-runtime v0.18.2
+	sigs.k8s.io/controller-runtime v0.18.3
 	sigs.k8s.io/gateway-api v1.1.0
 	sigs.k8s.io/mcs-api v0.1.0
 	sigs.k8s.io/yaml v1.4.0
@@ -121,7 +121,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/emicklei/go-restful/v3 v3.12.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
@@ -142,7 +142,7 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.1 // indirect
 	github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
@@ -163,26 +163,26 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/prometheus/procfs v0.15.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/tsaarni/x500dn v1.0.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.26.0
-	go.opentelemetry.io/otel/trace v1.26.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.27.0
+	go.opentelemetry.io/otel/trace v1.27.0 // indirect
 	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/mod v0.17.0 // indirect
 	golang.org/x/net v0.25.0
-	golang.org/x/oauth2 v0.19.0 // indirect
+	golang.org/x/oauth2 v0.20.0 // indirect
 	golang.org/x/sync v0.7.0 // indirect
 	golang.org/x/term v0.20.0 // indirect
 	golang.org/x/text v0.15.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.20.0 // indirect
+	golang.org/x/tools v0.21.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	k8s.io/component-base v0.30.1 // indirect
diff --git a/go.sum b/go.sum
index 7e1ca1f18..9e7d55259 100644
--- a/go.sum
+++ b/go.sum
@@ -7,8 +7,8 @@ fortio.org/assert v1.2.1 h1:48I39urpeDj65RP1KguF7akCjILNeu6vICiYMEysR7Q=
 fortio.org/assert v1.2.1/go.mod h1:039mG+/iYDPO8Ibx8TrNuJCm2T2SuhwRI3uL9nHTTls=
 fortio.org/dflag v1.7.1 h1:sDdYSw3py02awhgtWEtRtZvOM0UWgeDweRsXWROU3A0=
 fortio.org/dflag v1.7.1/go.mod h1:3KB1SSilm1WwYl7gydDCnV24+DQaycAusNyy06dDD+c=
-fortio.org/fortio v1.63.7 h1:S6e+z36nV6o8RYQSUI9EWYxhCoPJy4VdAB2HQROUqMg=
-fortio.org/fortio v1.63.7/go.mod h1:zGOS2pObMAnrE7vFfXCB6mSwFA8dQjUfvEZTYtQUgTw=
+fortio.org/fortio v1.63.8 h1:oqU+ZE2eNMt03uul48eiUYpMnV6KkjsaEOb6bsf//W0=
+fortio.org/fortio v1.63.8/go.mod h1:R6X+CAPCvRViXMV0Ce3xKR25kx3XvEtgVpCEyYmE7DE=
 fortio.org/log v1.12.2 h1:JwLDFvEUKGfqA09fcf+mOn8kxsvwhjXV92xghxNnnwA=
 fortio.org/log v1.12.2/go.mod h1:1tMBG/Elr6YqjmJCWiejJp2FPvXg7/9UAN0Rfpkyt1o=
 fortio.org/sets v1.0.4 h1:z5+qleG+9lpbpjGHvRGhfd+E5pJGsLetYl/w4pMc5MM=
@@ -90,8 +90,8 @@ github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA
 github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
 github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
@@ -216,8 +216,8 @@ github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi
 github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v0.1.0/go.mod h1:tabnROwaDl0UNxkVeFRbY8bwB37GwRv0P8lg6aAiEnk=
@@ -367,8 +367,8 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 h1:/c3QmbOGMGTOumP2iT/rCwB7b0QDGLKzqOmktBjT+Is=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1/go.mod h1:5SN9VR2LTsRFsrEC6FHgRbTWrTHu6tqPeKxEQv15giM=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -572,14 +572,14 @@ github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7z
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
 github.com/prometheus/procfs v0.0.11/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
-github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/prometheus/procfs v0.15.0 h1:A82kmvXJq2jTu5YUhSGNlYoxh85zLnKgPz4bMZgI5Ek=
+github.com/prometheus/procfs v0.15.0/go.mod h1:Y0RJ/Y5g5wJpkTisOtqwDSo4HwhGmLB4VQSw2sQJLHk=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/rubenv/sql-migrate v1.5.2 h1:bMDqOnrJVV/6JQgQ/MxOpU+AdO8uzYYA/TxFUBzFtS0=
 github.com/rubenv/sql-migrate v1.5.2/go.mod h1:H38GW8Vqf8F0Su5XignRyaRcbXbJunSWxs+kmzlg0Is=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
@@ -676,24 +676,24 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 h1:x8Z78aZx8cOF0+Kkazoc7lwUNMGy0LrzEMxTm4BbTxg=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0/go.mod h1:62CPTSry9QZtOaSsE3tOzhx6LzDhHnXJ6xHeMNNiM6Q=
-go.opentelemetry.io/otel v1.26.0 h1:LQwgL5s/1W7YiiRwxf03QGnWLb2HW4pLiAhaA5cZXBs=
-go.opentelemetry.io/otel v1.26.0/go.mod h1:UmLkJHUAidDval2EICqBMbnAd0/m2vmpf/dAM+fvFs4=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.26.0 h1:+hm+I+KigBy3M24/h1p/NHkUx/evbLH0PNcjpMyCHc4=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.26.0/go.mod h1:NjC8142mLvvNT6biDpaMjyz78kyEHIwAJlSX0N9P5KI=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.26.0 h1:HGZWGmCVRCVyAs2GQaiHQPbDHo+ObFWeUEOd+zDnp64=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.26.0/go.mod h1:SaH+v38LSCHddyk7RGlU9uZyQoRrKao6IBnJw6Kbn+c=
-go.opentelemetry.io/otel/exporters/prometheus v0.48.0 h1:sBQe3VNGUjY9IKWQC6z2lNqa5iGbDSxhs60ABwK4y0s=
-go.opentelemetry.io/otel/exporters/prometheus v0.48.0/go.mod h1:DtrbMzoZWwQHyrQmCfLam5DZbnmorsGbOtTbYHycU5o=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.26.0 h1:5fnmgteaar1VcAA69huatudPduNFz7guRtCmfZCooZI=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.26.0/go.mod h1:lsPccfZiz1cb1AhBPmicWM2E4F1VynFXEvD8SEBS4TM=
-go.opentelemetry.io/otel/metric v1.26.0 h1:7S39CLuY5Jgg9CrnA9HHiEjGMF/X2VHvoXGgSllRz30=
-go.opentelemetry.io/otel/metric v1.26.0/go.mod h1:SY+rHOI4cEawI9a7N1A4nIg/nTQXe1ccCNWYOJUrpX4=
-go.opentelemetry.io/otel/sdk v1.26.0 h1:Y7bumHf5tAiDlRYFmGqetNcLaVUZmh4iYfmGxtmz7F8=
-go.opentelemetry.io/otel/sdk v1.26.0/go.mod h1:0p8MXpqLeJ0pzcszQQN4F0S5FVjBLgypeGSngLsmirs=
-go.opentelemetry.io/otel/sdk/metric v1.26.0 h1:cWSks5tfriHPdWFnl+qpX3P681aAYqlZHcAyHw5aU9Y=
-go.opentelemetry.io/otel/sdk/metric v1.26.0/go.mod h1:ClMFFknnThJCksebJwz7KIyEDHO+nTB6gK8obLy8RyE=
-go.opentelemetry.io/otel/trace v1.26.0 h1:1ieeAUb4y0TE26jUFrCIXKpTuVK7uJGN9/Z/2LP5sQA=
-go.opentelemetry.io/otel/trace v1.26.0/go.mod h1:4iDxvGDQuUkHve82hJJ8UqrwswHYsZuWCBllGV2U2y0=
+go.opentelemetry.io/otel v1.27.0 h1:9BZoF3yMK/O1AafMiQTVu0YDj5Ea4hPhxCs7sGva+cg=
+go.opentelemetry.io/otel v1.27.0/go.mod h1:DMpAK8fzYRzs+bi3rS5REupisuqTheUlSZJ1WnZaPAQ=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.27.0 h1:bFgvUr3/O4PHj3VQcFEuYKvRZJX1SJDQ+11JXuSB3/w=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.27.0/go.mod h1:xJntEd2KL6Qdg5lwp97HMLQDVeAhrYxmzFseAMDPQ8I=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.27.0 h1:CIHWikMsN3wO+wq1Tp5VGdVRTcON+DmOJSfDjXypKOc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.27.0/go.mod h1:TNupZ6cxqyFEpLXAZW7On+mLFL0/g0TE3unIYL91xWc=
+go.opentelemetry.io/otel/exporters/prometheus v0.49.0 h1:Er5I1g/YhfYv9Affk9nJLfH/+qCCVVg1f2R9AbJfqDQ=
+go.opentelemetry.io/otel/exporters/prometheus v0.49.0/go.mod h1:KfQ1wpjf3zsHjzP149P4LyAwWRupc6c7t1ZJ9eXpKQM=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.27.0 h1:/jlt1Y8gXWiHG9FBx6cJaIC5hYx5Fe64nC8w5Cylt/0=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.27.0/go.mod h1:bmToOGOBZ4hA9ghphIc1PAf66VA8KOtsuy3+ScStG20=
+go.opentelemetry.io/otel/metric v1.27.0 h1:hvj3vdEKyeCi4YaYfNjv2NUje8FqKqUY8IlF0FxV/ik=
+go.opentelemetry.io/otel/metric v1.27.0/go.mod h1:mVFgmRlhljgBiuk/MP/oKylr4hs85GZAylncepAX/ak=
+go.opentelemetry.io/otel/sdk v1.27.0 h1:mlk+/Y1gLPLn84U4tI8d3GNJmGT/eXe3ZuOXN9kTWmI=
+go.opentelemetry.io/otel/sdk v1.27.0/go.mod h1:Ha9vbLwJE6W86YstIywK2xFfPjbWlCuwPtMkKdz/Y4A=
+go.opentelemetry.io/otel/sdk/metric v1.27.0 h1:5uGNOlpXi+Hbo/DRoI31BSb1v+OGcpv2NemcCrOL8gI=
+go.opentelemetry.io/otel/sdk/metric v1.27.0/go.mod h1:we7jJVrYN2kh3mVBlswtPU22K0SA+769l93J6bsyvqw=
+go.opentelemetry.io/otel/trace v1.27.0 h1:IqYb813p7cmbHk0a5y6pD5JPakbVfftRXABGt5/Rscw=
+go.opentelemetry.io/otel/trace v1.27.0/go.mod h1:6RiD1hkAprV4/q+yd2ln1HG9GoPx39SuvvstaLBl+l4=
 go.opentelemetry.io/proto/otlp v1.2.0 h1:pVeZGk7nXDC9O2hncA6nHldxEjm6LByfA2aN8IOkz94=
 go.opentelemetry.io/proto/otlp v1.2.0/go.mod h1:gGpR8txAl5M03pDhMC79G6SdqNV26naRm/KDsgaHD8A=
 go.starlark.net v0.0.0-20230525235612-a134d8f9ddca h1:VdD38733bfYv5tUZwEIskMM93VanwNIi5bIKnDrJdEY=
@@ -723,8 +723,8 @@ golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4
 golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f h1:99ci1mjWVBWwJiEKYY6jWa4d2nTQVIEhZIptnrVb1XY=
-golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f/go.mod h1:/lliqkxwWAhPjf5oSOIJup2XcqJaw8RGS6k3TGEc7GI=
+golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
+golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -763,8 +763,8 @@ golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.19.0 h1:9+E/EZBCbTLNrbN35fHv/a/d/mOBatymz1zbtQrXpIg=
-golang.org/x/oauth2 v0.19.0/go.mod h1:vYi7skDa1x015PmRRYZ7+s1cWyPgrPiSYRe4rnsexc8=
+golang.org/x/oauth2 v0.20.0 h1:4mQdhULixXKP1rwYBW0vAijoXnkTG0BLCDRzfe1idMo=
+golang.org/x/oauth2 v0.20.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -848,8 +848,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.20.0 h1:hz/CVckiOxybQvFw6h7b/q80NTr9IUQb4s1IIzW7KNY=
-golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
+golang.org/x/tools v0.21.0 h1:qc0xYgIbsSDt9EyWz05J5wfa7LOVW0YTLOXrqdLAWIw=
+golang.org/x/tools v0.21.0/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -866,10 +866,10 @@ google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRn
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 h1:RFiFrvy37/mpSpdySBDrUdipW/dHwsRwh3J3+A9VgT4=
-google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237/go.mod h1:Z5Iiy3jtmioajWHDGFk7CeugTyHtPvMHA4UTmUkyalE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda h1:LI5DOvAxUPMv/50agcLLoo+AdWc1irS9Rzz4vPuD1V4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
+google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 h1:P8OJ/WCl/Xo4E4zoe4/bifHpSmmKwARqyqE4nW6J2GQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5/go.mod h1:RGnPtTG7r4i8sPlNyDeikXF99hMM+hN6QMm4ooG9g2g=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e h1:Elxv5MwEkCI9f5SkoL6afed6NTdxaGoAo39eANBwHL8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e/go.mod h1:EfXuqaE1J41VCDicxHzUDm+8rk+7ZdXzHV0IhO/I6s0=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
@@ -920,8 +920,8 @@ gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-helm.sh/helm/v3 v3.15.0 h1:gcLxHeFp0Hfo7lYi6KIZ84ZyvlAnfFRSJ8lTL3zvG5U=
-helm.sh/helm/v3 v3.15.0/go.mod h1:fvfoRcB8UKRUV5jrIfOTaN/pG1TPhuqSb56fjYdTKXg=
+helm.sh/helm/v3 v3.15.1 h1:22ztacHz4gMqhXNqCQ9NAg6BFWoRUryNLvnkz6OVyw0=
+helm.sh/helm/v3 v3.15.1/go.mod h1:fvfoRcB8UKRUV5jrIfOTaN/pG1TPhuqSb56fjYdTKXg=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -975,8 +975,8 @@ oras.land/oras-go v1.2.4 h1:djpBY2/2Cs1PV87GSJlxv4voajVOMZxqqtq9AB8YNvY=
 oras.land/oras-go v1.2.4/go.mod h1:DYcGfb3YF1nKjcezfX2SNlDAeQFKSXmf+qrFmrh4324=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7/go.mod h1:PHgbrJT7lCHcxMU+mDHEm+nx46H4zuuHZkDP6icnhu0=
 sigs.k8s.io/controller-runtime v0.6.1/go.mod h1:XRYBPdbf5XJu9kpS84VJiZ7h/u1hF3gEORz0efEja7A=
-sigs.k8s.io/controller-runtime v0.18.2 h1:RqVW6Kpeaji67CY5nPEfRz6ZfFMk0lWQlNrLqlNpx+Q=
-sigs.k8s.io/controller-runtime v0.18.2/go.mod h1:tuAt1+wbVsXIT8lPtk5RURxqAnq7xkpv2Mhttslg7Hw=
+sigs.k8s.io/controller-runtime v0.18.3 h1:B5Wmmo8WMWK7izei+2LlXLVDGzMwAHBNLX68lwtlSR4=
+sigs.k8s.io/controller-runtime v0.18.3/go.mod h1:TVoGrfdpbA9VRFaRnKgk9P5/atA0pMwq+f+msb9M8Sg=
 sigs.k8s.io/controller-tools v0.3.0/go.mod h1:enhtKGfxZD1GFEoMgP8Fdbu+uKQ/cq1/WGJhdVChfvI=
 sigs.k8s.io/gateway-api v1.1.0 h1:DsLDXCi6jR+Xz8/xd0Z1PYl2Pn0TyaFMOPPZIj4inDM=
 sigs.k8s.io/gateway-api v1.1.0/go.mod h1:ZH4lHrL2sDi0FHZ9jjneb8kKnGzFWyrTya35sWUTrRs=
diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
index 8cdca113b..29305d067 100644
--- a/internal/gatewayapi/securitypolicy.go
+++ b/internal/gatewayapi/securitypolicy.go
@@ -758,10 +758,7 @@ func (t *Translator) buildBasicAuth(
 	}, nil
 }
 
-func (t *Translator) buildExtAuth(
-	policy *egv1a1.SecurityPolicy,
-	resources *Resources,
-) (*ir.ExtAuth, error) {
+func (t *Translator) buildExtAuth(policy *egv1a1.SecurityPolicy, resources *Resources) (*ir.ExtAuth, error) {
 	var (
 		http       = policy.Spec.ExtAuth.HTTP
 		grpc       = policy.Spec.ExtAuth.GRPC
@@ -775,16 +772,24 @@ func (t *Translator) buildExtAuth(
 	switch {
 	// These are sanity checks, they should never happen because the API server
 	// should have caught them
-	case http == nil && grpc == nil:
-		return nil, errors.New("one of grpc or http must be specified")
 	case http != nil && grpc != nil:
 		return nil, errors.New("only one of grpc or http can be specified")
 	case http != nil:
-		backendRef = &http.BackendRef
+		backendRef = http.BackendRef
+		if len(http.BackendRefs) != 0 {
+			backendRef = egv1a1.ToBackendObjectReference(http.BackendRefs[0])
+		}
 		protocol = ir.HTTP
 	case grpc != nil:
-		backendRef = &grpc.BackendRef
+		backendRef = grpc.BackendRef
+		if len(grpc.BackendRefs) != 0 {
+			backendRef = egv1a1.ToBackendObjectReference(grpc.BackendRefs[0])
+		}
 		protocol = ir.GRPC
+	// These are sanity checks, they should never happen because the API server
+	// should have caught them
+	default: // http == nil && grpc == nil:
+		return nil, errors.New("one of grpc or http must be specified")
 	}
 
 	if err = t.validateExtServiceBackendReference(
@@ -794,8 +799,7 @@ func (t *Translator) buildExtAuth(
 		resources); err != nil {
 		return nil, err
 	}
-	authority = fmt.Sprintf(
-		"%s.%s:%d",
+	authority = fmt.Sprintf("%s.%s:%d",
 		backendRef.Name,
 		NamespaceDerefOr(backendRef.Namespace, policy.Namespace),
 		*backendRef.Port)
diff --git a/internal/infrastructure/kubernetes/infra_resource.go b/internal/infrastructure/kubernetes/infra_resource.go
index 91b880d5d..9dcb9cb33 100644
--- a/internal/infrastructure/kubernetes/infra_resource.go
+++ b/internal/infrastructure/kubernetes/infra_resource.go
@@ -7,29 +7,67 @@ package kubernetes
 
 import (
 	"context"
+	"time"
 
 	appsv1 "k8s.io/api/apps/v1"
 	autoscalingv2 "k8s.io/api/autoscaling/v2"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/envoyproxy/gateway/internal/metrics"
 )
 
 // createOrUpdateServiceAccount creates a ServiceAccount in the kube api server based on the
 // provided ResourceRender, if it doesn't exist and updates it if it does.
-func (i *Infra) createOrUpdateServiceAccount(ctx context.Context, r ResourceRender) error {
-	sa, err := r.ServiceAccount()
-	if err != nil {
+func (i *Infra) createOrUpdateServiceAccount(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		sa        *corev1.ServiceAccount
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("ServiceAccount"),
+			nameLabel.Value(r.Name()),
+			namespaceLabel.Value(i.Namespace),
+		}
+	)
+
+	resourceApplyTotal.With(labels...).Increment()
+
+	if sa, err = r.ServiceAccount(); err != nil {
+		resourceApplyFailed.With(labels...).Increment()
+
 		return err
 	}
 
+	defer func() {
+		if err == nil {
+			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceApplySuccess.With(labels...).Increment()
+		} else {
+			resourceApplyFailed.With(labels...).Increment()
+		}
+	}()
+
 	return i.Client.ServerSideApply(ctx, sa)
 }
 
 // createOrUpdateConfigMap creates a ConfigMap in the Kube api server based on the provided
 // ResourceRender, if it doesn't exist and updates it if it does.
-func (i *Infra) createOrUpdateConfigMap(ctx context.Context, r ResourceRender) error {
-	cm, err := r.ConfigMap()
-	if err != nil {
+func (i *Infra) createOrUpdateConfigMap(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		cm        *corev1.ConfigMap
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("ConfigMap"),
+			nameLabel.Value(r.Name()),
+			namespaceLabel.Value(i.Namespace),
+		}
+	)
+
+	resourceApplyTotal.With(labels...).Increment()
+
+	if cm, err = r.ConfigMap(); err != nil {
+		resourceApplyFailed.With(labels...).Increment()
+
 		return err
 	}
 
@@ -37,142 +75,359 @@ func (i *Infra) createOrUpdateConfigMap(ctx context.Context, r ResourceRender) e
 		return nil
 	}
 
+	defer func() {
+		if err == nil {
+			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceApplySuccess.With(labels...).Increment()
+		} else {
+			resourceApplyFailed.With(labels...).Increment()
+		}
+	}()
+
 	return i.Client.ServerSideApply(ctx, cm)
 }
 
 // createOrUpdateDeployment creates a Deployment in the kube api server based on the provided
 // ResourceRender, if it doesn't exist and updates it if it does.
-func (i *Infra) createOrUpdateDeployment(ctx context.Context, r ResourceRender) error {
-	deployment, err := r.Deployment()
-	if err != nil {
+func (i *Infra) createOrUpdateDeployment(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		deployment *appsv1.Deployment
+		startTime  = time.Now()
+		labels     = []metrics.LabelValue{
+			kindLabel.Value("Deployment"),
+			nameLabel.Value(r.Name()),
+			namespaceLabel.Value(i.Namespace),
+		}
+	)
+
+	resourceApplyTotal.With(labels...).Increment()
+
+	if deployment, err = r.Deployment(); err != nil {
+		resourceApplyFailed.With(labels...).Increment()
+
 		return err
 	}
 
 	// delete the deployment and return early
 	// this handles the case where a daemonset has been
-	// congured
+	// configured.
 	if deployment == nil {
 		return i.deleteDeployment(ctx, r)
 	}
 
+	defer func() {
+		if err == nil {
+			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceApplySuccess.With(labels...).Increment()
+		} else {
+			resourceApplyFailed.With(labels...).Increment()
+		}
+	}()
+
 	return i.Client.ServerSideApply(ctx, deployment)
 }
 
 // createOrUpdateDaemonSet creates a DaemonSet in the kube api server based on the provided
 // ResourceRender, if it doesn't exist and updates it if it does.
-func (i *Infra) createOrUpdateDaemonSet(ctx context.Context, r ResourceRender) error {
-	daemonSet, err := r.DaemonSet()
-	if err != nil {
+func (i *Infra) createOrUpdateDaemonSet(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		daemonSet *appsv1.DaemonSet
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("DaemonSet"),
+			nameLabel.Value(r.Name()),
+			namespaceLabel.Value(i.Namespace),
+		}
+	)
+
+	resourceApplyTotal.With(labels...).Increment()
+
+	if daemonSet, err = r.DaemonSet(); err != nil {
+		resourceApplyFailed.With(labels...).Increment()
+
 		return err
 	}
 
 	// delete the daemonset and return early
 	// this handles the case where a deployment has been
-	// congured
+	// configured.
 	if daemonSet == nil {
 		return i.deleteDaemonSet(ctx, r)
 	}
 
+	defer func() {
+		if err == nil {
+			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceApplySuccess.With(labels...).Increment()
+		} else {
+			resourceApplyFailed.With(labels...).Increment()
+		}
+	}()
+
 	return i.Client.ServerSideApply(ctx, daemonSet)
 }
 
 // createOrUpdateHPA creates HorizontalPodAutoscaler object in the kube api server based on
 // the provided ResourceRender, if it doesn't exist and updates it if it does,
 // and delete hpa if not set.
-func (i *Infra) createOrUpdateHPA(ctx context.Context, r ResourceRender) error {
-	hpa, err := r.HorizontalPodAutoscaler()
-	if err != nil {
+func (i *Infra) createOrUpdateHPA(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		hpa       *autoscalingv2.HorizontalPodAutoscaler
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("HPA"),
+			nameLabel.Value(r.Name()),
+			namespaceLabel.Value(i.Namespace),
+		}
+	)
+
+	resourceApplyTotal.With(labels...).Increment()
+
+	if hpa, err = r.HorizontalPodAutoscaler(); err != nil {
+		resourceApplyFailed.With(labels...).Increment()
+
 		return err
 	}
 
 	// when HorizontalPodAutoscaler is not set,
-	// then delete the object in the kube api server if any.
+	// then delete the object in the kube api server if got any.
 	if hpa == nil {
 		return i.deleteHPA(ctx, r)
 	}
 
+	defer func() {
+		if err == nil {
+			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceApplySuccess.With(labels...).Increment()
+		} else {
+			resourceApplyFailed.With(labels...).Increment()
+		}
+	}()
+
 	return i.Client.ServerSideApply(ctx, hpa)
 }
 
 // createOrUpdateRateLimitService creates a Service in the kube api server based on the provided ResourceRender,
 // if it doesn't exist or updates it if it does.
-func (i *Infra) createOrUpdateService(ctx context.Context, r ResourceRender) error {
-	svc, err := r.Service()
-	if err != nil {
+func (i *Infra) createOrUpdateService(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		svc       *corev1.Service
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("Service"),
+			nameLabel.Value(r.Name()),
+			namespaceLabel.Value(i.Namespace),
+		}
+	)
+
+	resourceApplyTotal.With(labels...).Increment()
+
+	if svc, err = r.Service(); err != nil {
+		resourceApplyFailed.With(labels...).Increment()
+
 		return err
 	}
 
+	defer func() {
+		if err == nil {
+			resourceApplyDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceApplySuccess.With(labels...).Increment()
+		} else {
+			resourceApplyFailed.With(labels...).Increment()
+		}
+	}()
+
 	return i.Client.ServerSideApply(ctx, svc)
 }
 
 // deleteServiceAccount deletes the ServiceAccount in the kube api server, if it exists.
-func (i *Infra) deleteServiceAccount(ctx context.Context, r ResourceRender) error {
-	sa := &corev1.ServiceAccount{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: i.Namespace,
-			Name:      r.Name(),
-		},
-	}
+func (i *Infra) deleteServiceAccount(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		name, ns = r.Name(), i.Namespace
+		sa       = &corev1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: ns,
+				Name:      name,
+			},
+		}
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("ServiceAccount"),
+			nameLabel.Value(name),
+			namespaceLabel.Value(ns),
+		}
+	)
+
+	resourceDeleteTotal.With(labels...).Increment()
+
+	defer func() {
+		if err == nil {
+			resourceDeleteDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceDeleteSuccess.With(labels...).Increment()
+		} else {
+			resourceDeleteFailed.With(labels...).Increment()
+		}
+	}()
 
 	return i.Client.Delete(ctx, sa)
 }
 
 // deleteDeployment deletes the Envoy Deployment in the kube api server, if it exists.
-func (i *Infra) deleteDeployment(ctx context.Context, r ResourceRender) error {
-	deployment := &appsv1.Deployment{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: i.Namespace,
-			Name:      r.Name(),
-		},
-	}
+func (i *Infra) deleteDeployment(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		name, ns   = r.Name(), i.Namespace
+		deployment = &appsv1.Deployment{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: ns,
+				Name:      name,
+			},
+		}
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("Deployment"),
+			nameLabel.Value(name),
+			namespaceLabel.Value(ns),
+		}
+	)
+
+	resourceDeleteTotal.With(labels...).Increment()
+
+	defer func() {
+		if err == nil {
+			resourceDeleteDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceDeleteSuccess.With(labels...).Increment()
+		} else {
+			resourceDeleteFailed.With(labels...).Increment()
+		}
+	}()
 
 	return i.Client.Delete(ctx, deployment)
 }
 
 // deleteDaemonSet deletes the Envoy DaemonSet in the kube api server, if it exists.
-func (i *Infra) deleteDaemonSet(ctx context.Context, r ResourceRender) error {
-	daemonSet := &appsv1.DaemonSet{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: i.Namespace,
-			Name:      r.Name(),
-		},
-	}
+func (i *Infra) deleteDaemonSet(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		name, ns  = r.Name(), i.Namespace
+		daemonSet = &appsv1.DaemonSet{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: ns,
+				Name:      name,
+			},
+		}
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("DaemonSet"),
+			nameLabel.Value(name),
+			namespaceLabel.Value(ns),
+		}
+	)
+
+	resourceDeleteTotal.With(labels...).Increment()
+
+	defer func() {
+		if err == nil {
+			resourceDeleteDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceDeleteSuccess.With(labels...).Increment()
+		} else {
+			resourceDeleteFailed.With(labels...).Increment()
+		}
+	}()
 
 	return i.Client.Delete(ctx, daemonSet)
 }
 
 // deleteConfigMap deletes the ConfigMap in the kube api server, if it exists.
-func (i *Infra) deleteConfigMap(ctx context.Context, r ResourceRender) error {
-	cm := &corev1.ConfigMap{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: i.Namespace,
-			Name:      r.Name(),
-		},
-	}
+func (i *Infra) deleteConfigMap(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		name, ns = r.Name(), i.Namespace
+		cm       = &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: ns,
+				Name:      name,
+			},
+		}
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("ConfigMap"),
+			nameLabel.Value(name),
+			namespaceLabel.Value(ns),
+		}
+	)
+
+	resourceDeleteTotal.With(labels...).Increment()
+
+	defer func() {
+		if err == nil {
+			resourceDeleteDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceDeleteSuccess.With(labels...).Increment()
+		} else {
+			resourceDeleteFailed.With(labels...).Increment()
+		}
+	}()
 
 	return i.Client.Delete(ctx, cm)
 }
 
 // deleteService deletes the Service in the kube api server, if it exists.
-func (i *Infra) deleteService(ctx context.Context, r ResourceRender) error {
-	svc := &corev1.Service{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: i.Namespace,
-			Name:      r.Name(),
-		},
-	}
+func (i *Infra) deleteService(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		name, ns = r.Name(), i.Namespace
+		svc      = &corev1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: ns,
+				Name:      name,
+			},
+		}
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("Service"),
+			nameLabel.Value(name),
+			namespaceLabel.Value(ns),
+		}
+	)
+
+	resourceDeleteTotal.With(labels...).Increment()
+
+	defer func() {
+		if err == nil {
+			resourceDeleteDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceDeleteSuccess.With(labels...).Increment()
+		} else {
+			resourceDeleteFailed.With(labels...).Increment()
+		}
+	}()
 
 	return i.Client.Delete(ctx, svc)
 }
 
 // deleteHpa deletes the Horizontal Pod Autoscaler associated to its renderer, if it exists.
-func (i *Infra) deleteHPA(ctx context.Context, r ResourceRender) error {
-	hpa := &autoscalingv2.HorizontalPodAutoscaler{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: i.Namespace,
-			Name:      r.Name(),
-		},
-	}
+func (i *Infra) deleteHPA(ctx context.Context, r ResourceRender) (err error) {
+	var (
+		name, ns = r.Name(), i.Namespace
+		hpa      = &autoscalingv2.HorizontalPodAutoscaler{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: ns,
+				Name:      name,
+			},
+		}
+		startTime = time.Now()
+		labels    = []metrics.LabelValue{
+			kindLabel.Value("HPA"),
+			nameLabel.Value(name),
+			namespaceLabel.Value(ns),
+		}
+	)
+
+	resourceDeleteTotal.With(labels...).Increment()
+
+	defer func() {
+		if err == nil {
+			resourceDeleteDurationSeconds.With(labels...).Record(time.Since(startTime).Seconds())
+			resourceDeleteSuccess.With(labels...).Increment()
+		} else {
+			resourceDeleteFailed.With(labels...).Increment()
+		}
+	}()
 
 	return i.Client.Delete(ctx, hpa)
 }
diff --git a/internal/infrastructure/kubernetes/metrics.go b/internal/infrastructure/kubernetes/metrics.go
new file mode 100644
index 000000000..d417845b5
--- /dev/null
+++ b/internal/infrastructure/kubernetes/metrics.go
@@ -0,0 +1,24 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package kubernetes
+
+import "github.com/envoyproxy/gateway/internal/metrics"
+
+var (
+	resourceApplyTotal           = metrics.NewCounter("resource_apply_total", "Total number of applied resources.")
+	resourceApplyFailed          = metrics.NewCounter("resource_apply_failed", "Number of applied resources that failed.")
+	resourceApplySuccess         = metrics.NewCounter("resource_apply_success", "Number of applied resources that succeed.")
+	resourceApplyDurationSeconds = metrics.NewHistogram("resource_apply_duration_seconds", "How long in seconds a resource be applied successfully.", []float64{0.001, 0.01, 0.1, 1, 5, 10})
+
+	resourceDeleteTotal           = metrics.NewCounter("resource_delete_total", "Total number of deleted resources.")
+	resourceDeleteFailed          = metrics.NewCounter("resource_delete_failed", "Number of deleted resources that failed.")
+	resourceDeleteSuccess         = metrics.NewCounter("resource_delete_success", "Number of deleted resources that succeed.")
+	resourceDeleteDurationSeconds = metrics.NewHistogram("resource_delete_duration_seconds", "How long in seconds a resource be deleted successfully.", []float64{0.001, 0.01, 0.1, 1, 5, 10})
+
+	kindLabel      = metrics.NewLabel("kind")
+	nameLabel      = metrics.NewLabel("name")
+	namespaceLabel = metrics.NewLabel("namespace")
+)
diff --git a/internal/infrastructure/kubernetes/ratelimit/resource_provider.go b/internal/infrastructure/kubernetes/ratelimit/resource_provider.go
index 62d8e3df4..90b6eba8f 100644
--- a/internal/infrastructure/kubernetes/ratelimit/resource_provider.go
+++ b/internal/infrastructure/kubernetes/ratelimit/resource_provider.go
@@ -255,8 +255,9 @@ func (r *ResourceRender) Deployment() (*appsv1.Deployment, error) {
 	}
 
 	// apply merge patch to deployment
-	if merged, err := r.rateLimitDeployment.ApplyMergePatch(deployment); err == nil {
-		deployment = merged
+	var err error
+	if deployment, err = r.rateLimitDeployment.ApplyMergePatch(deployment); err != nil {
+		return nil, err
 	}
 
 	return deployment, nil
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index 7051d21f4..791b7fcbf 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -464,11 +464,21 @@ func (r *gatewayAPIReconciler) processSecurityPolicyObjectRefs(
 		// Add the referenced BackendRefs and ReferenceGrants in ExtAuth to Maps for later processing
 		extAuth := policy.Spec.ExtAuth
 		if extAuth != nil {
-			var backendRef gwapiv1.BackendObjectReference
+			var backendRef *gwapiv1.BackendObjectReference
 			if extAuth.GRPC != nil {
 				backendRef = extAuth.GRPC.BackendRef
+				if len(extAuth.GRPC.BackendRefs) > 0 {
+					if len(extAuth.GRPC.BackendRefs) != 0 {
+						backendRef = egv1a1.ToBackendObjectReference(extAuth.GRPC.BackendRefs[0])
+					}
+				}
 			} else {
 				backendRef = extAuth.HTTP.BackendRef
+				if len(extAuth.HTTP.BackendRefs) > 0 {
+					if len(extAuth.HTTP.BackendRefs) != 0 {
+						backendRef = egv1a1.ToBackendObjectReference(extAuth.HTTP.BackendRefs[0])
+					}
+				}
 			}
 
 			backendNamespace := gatewayapi.NamespaceDerefOr(backendRef.Namespace, policy.Namespace)
diff --git a/internal/provider/kubernetes/indexers.go b/internal/provider/kubernetes/indexers.go
index 57c13997f..d2abc6a25 100644
--- a/internal/provider/kubernetes/indexers.go
+++ b/internal/provider/kubernetes/indexers.go
@@ -507,9 +507,17 @@ func backendSecurityPolicyIndexFunc(rawObj client.Object) []string {
 
 	if securityPolicy.Spec.ExtAuth != nil {
 		if securityPolicy.Spec.ExtAuth.HTTP != nil {
-			backendRef = &securityPolicy.Spec.ExtAuth.HTTP.BackendRef
+			http := securityPolicy.Spec.ExtAuth.HTTP
+			backendRef = http.BackendRef
+			if len(http.BackendRefs) > 0 {
+				backendRef = v1alpha1.ToBackendObjectReference(http.BackendRefs[0])
+			}
 		} else if securityPolicy.Spec.ExtAuth.GRPC != nil {
-			backendRef = &securityPolicy.Spec.ExtAuth.GRPC.BackendRef
+			grpc := securityPolicy.Spec.ExtAuth.GRPC
+			backendRef = grpc.BackendRef
+			if len(grpc.BackendRefs) > 0 {
+				backendRef = v1alpha1.ToBackendObjectReference(grpc.BackendRefs[0])
+			}
 		}
 	}
 
diff --git a/site/content/en/_index.md b/site/content/en/_index.md
index dd4456c47..a20c40e5b 100644
--- a/site/content/en/_index.md
+++ b/site/content/en/_index.md
@@ -78,6 +78,8 @@ For announcement of latest features etc.
 
 {{% /blocks/section %}}
 
+{{< adopters >}}
+
 {{% blocks/lead type="row" color="white" %}}
 
 <img src="/img/cncf.svg" alt="CNCF" width="40%">
diff --git a/site/content/zh/_index.md b/site/content/zh/_index.md
index 48f75da88..cf2e7622f 100644
--- a/site/content/zh/_index.md
+++ b/site/content/zh/_index.md
@@ -77,6 +77,8 @@ title: Envoy Gateway
 
 {{% /blocks/section %}}
 
+{{< adopters >}}
+
 {{% blocks/lead type="row" color="white" %}}
 
 <img src="/img/cncf.svg" alt="CNCF" width="40%">
diff --git a/site/data/adopters.yaml b/site/data/adopters.yaml
new file mode 100644
index 000000000..542e381d1
--- /dev/null
+++ b/site/data/adopters.yaml
@@ -0,0 +1,13 @@
+adopters:
+  - name: "AllFactors"
+    logo: "/logos/allfactors.svg"
+    url: "https://allfactors.com/"
+    description: "Routing all customer traffic to our various backends. Every time a new customer signs up we dynamically add a route to a new hostname so Envoy Gateway is deeply integrated with our product."
+  - name: "Tetrate"
+    logo: "/logos/tetrate.svg"
+    url: "https://www.tetrate.io"
+    description: "Tetrate provides Enterprise Gateway (TEG) to end users, which includes a 100% upstream distribution of Envoy Gateway, and management to deliver applications securely, authenticate user traffic, protect services with rate limiting and WAF, and integrate with your observability stack to monitor and observe activity."
+  - name: "Airspace Link"
+    logo: "/logos/airspacelink.svg"
+    url: "https://airspacelink.com/"
+    description: "Airspace Link is using Envoy Gateway to route all public APIs to Kubernetes clusters, developers are manipulating routes descriptions using agnostic manifest files, which are then automatically provisioned using Envoy Gateway."
diff --git a/site/layouts/shortcodes/adopters.html b/site/layouts/shortcodes/adopters.html
new file mode 100644
index 000000000..d12f706e6
--- /dev/null
+++ b/site/layouts/shortcodes/adopters.html
@@ -0,0 +1,84 @@
+{{ $adopters := .Site.Data.adopters.adopters }}
+<section id="adopters">
+  <h2 class="adopter-head">Our Adopters</h2>
+  <div class="adopters-list">
+    {{ range $adopters }}
+    <a class="adopter" href="{{ .url }}" target="_blank">
+        <img src="{{ .logo | relURL }}" alt="{{ .name }} logo">
+        <div class="adopter-info">
+            <p>{{ .description }}</p>
+        </div>
+    </a>
+    {{ end }}
+  </div>
+</section>
+
+<style>
+#adopters {
+  text-align: center;
+  padding: 0px;
+}
+
+.adopter-head {
+  padding: 50px;
+}
+
+.adopters-list {
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: flex-start; /* Center items horizontally */
+  gap: 20px;
+  max-width: 1200px; /* Adjust to fit the container width */
+  margin: 0 auto; /* Center the container */
+}
+
+.adopter {
+  position: relative;
+  flex: 0 1 calc(25% - 20px); /* Adjust width to fit 4 items per row */
+  max-width: calc(25% - 20px);
+  box-sizing: border-box;
+  padding: 20px;
+  background-color: #f9f9f9;
+  border-radius: 8px;
+  text-align: center;
+  transition: transform 0.3s ease;
+  display: grid;
+  place-items: center;
+  width: 100%;
+}
+
+.adopter img {
+  max-width: 100%;
+  height: auto;
+}
+
+.adopter-info {
+  display: none;
+  position: absolute;
+  bottom: 100%; /* Position above the logo */
+  left: 50%;
+  transform: translateX(-50%);
+  background-color: rgba(0, 0, 0, 0.8);
+  color: white;
+  padding: 10px 10px 0px 15px;
+  border-radius: 5px;
+  width: 500px; /* Adjust the width as needed */
+  z-index: 10;
+  text-align: left;
+}
+
+.adopter:hover .adopter-info {
+  display: block;
+}
+
+/* Responsive design for mobile devices */
+@media (max-width: 768px) {
+  .adopters-list {
+    justify-content: center; /* Ensure center alignment on mobile */
+  }
+  .adopter {
+    flex: 0 1 100%; /* Each item takes full width */
+    max-width: 100%;
+  }
+}
+</style>
diff --git a/site/static/logos/airspacelink.svg b/site/static/logos/airspacelink.svg
new file mode 100644
index 000000000..4a6ae0d73
--- /dev/null
+++ b/site/static/logos/airspacelink.svg
@@ -0,0 +1,1 @@
+<svg id="svg" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="400" height="52.01305767138194" viewBox="0, 0, 400,52.01305767138194"><g id="svgg"><path id="path0" d="M166.115 14.674 C 165.675 14.748,165.225 14.881,165.115 14.970 C 165.006 15.059,164.598 15.227,164.208 15.343 C 163.819 15.458,163.500 15.607,163.500 15.673 C 163.500 15.739,163.275 15.886,163.000 16.000 C 162.725 16.114,162.500 16.273,162.500 16.354 C 162.500 16.434,162.415 16.500,162.312 16.500 C 162.018 16.500,160.702 17.846,160.486 18.366 C 160.380 18.623,160.232 18.833,160.158 18.833 C 159.468 18.833,159.528 23.868,160.234 25.071 C 160.899 26.206,162.197 27.414,162.958 27.608 C 163.165 27.660,163.333 27.764,163.333 27.839 C 163.333 27.915,163.746 28.068,164.250 28.181 C 164.754 28.294,165.167 28.439,165.167 28.503 C 165.167 28.567,165.729 28.716,166.417 28.833 C 167.104 28.951,167.667 29.107,167.667 29.180 C 167.667 29.253,167.798 29.313,167.958 29.314 C 168.548 29.316,171.000 29.873,171.000 30.005 C 171.000 30.080,171.269 30.229,171.597 30.338 C 174.245 31.212,173.844 35.250,171.034 36.005 C 170.603 36.121,170.179 36.280,170.092 36.358 C 169.883 36.545,166.713 36.542,166.597 36.355 C 166.548 36.276,166.205 36.162,165.835 36.103 C 165.465 36.044,165.013 35.846,164.831 35.664 C 164.649 35.482,164.443 35.333,164.373 35.333 C 164.221 35.333,163.641 34.795,162.785 33.858 C 162.032 33.034,161.811 33.007,161.224 33.667 C 160.979 33.942,160.747 34.136,160.708 34.097 C 160.670 34.059,160.501 34.153,160.331 34.306 C 159.957 34.644,159.741 34.815,159.042 35.330 C 158.424 35.785,158.339 36.319,158.833 36.628 C 159.017 36.742,159.167 36.952,159.167 37.095 C 159.167 37.237,159.242 37.307,159.333 37.250 C 159.425 37.193,159.500 37.208,159.500 37.282 C 159.500 37.509,160.724 38.744,161.167 38.964 C 161.396 39.078,161.921 39.362,162.333 39.596 C 163.174 40.072,164.759 40.494,165.718 40.498 C 166.115 40.499,166.313 40.565,166.246 40.673 C 166.174 40.790,166.821 40.839,168.236 40.823 C 169.390 40.810,170.333 40.747,170.333 40.684 C 170.333 40.620,170.947 40.478,171.697 40.369 C 172.448 40.260,173.104 40.113,173.156 40.043 C 173.208 39.974,173.325 39.912,173.417 39.906 C 173.710 39.888,174.874 39.317,175.120 39.071 C 175.250 38.940,175.422 38.833,175.501 38.833 C 175.831 38.833,177.356 37.033,177.617 36.337 C 177.773 35.922,177.978 35.530,178.075 35.464 C 178.313 35.302,178.313 30.363,178.074 30.202 C 177.977 30.137,177.794 29.821,177.667 29.500 C 177.540 29.179,177.338 28.857,177.218 28.783 C 177.098 28.710,177.000 28.573,177.000 28.480 C 177.000 27.889,174.170 26.162,172.792 25.910 C 172.448 25.848,172.167 25.743,172.167 25.677 C 172.167 25.543,170.280 25.167,169.606 25.167 C 169.364 25.167,169.167 25.092,169.167 25.000 C 169.167 24.908,169.110 24.848,169.042 24.866 C 168.813 24.926,166.333 24.274,166.333 24.154 C 166.333 24.089,166.160 23.993,165.947 23.939 C 165.735 23.886,165.379 23.684,165.156 23.490 C 164.933 23.296,164.637 23.074,164.500 22.997 C 163.620 22.503,164.708 19.500,165.767 19.500 C 165.875 19.500,166.002 19.401,166.049 19.280 C 166.276 18.689,169.888 18.543,170.849 19.087 C 171.070 19.211,171.481 19.421,171.764 19.553 C 172.326 19.815,173.167 20.588,173.167 20.841 C 173.167 20.928,173.242 21.000,173.333 21.000 C 173.425 21.000,173.500 21.117,173.500 21.260 C 173.500 21.403,173.569 21.477,173.652 21.425 C 173.736 21.374,173.835 21.422,173.872 21.532 C 173.918 21.670,174.101 21.617,174.453 21.366 C 174.737 21.165,175.047 21.000,175.142 21.000 C 175.238 21.000,175.377 20.903,175.450 20.785 C 175.601 20.542,177.151 19.500,177.362 19.500 C 177.438 19.500,177.500 19.313,177.500 19.083 C 177.500 18.854,177.417 18.667,177.316 18.667 C 177.214 18.667,177.174 18.554,177.227 18.417 C 177.280 18.279,177.248 18.167,177.156 18.167 C 177.065 18.167,176.940 18.038,176.880 17.881 C 176.710 17.439,175.484 16.278,174.833 15.943 C 174.512 15.777,174.063 15.536,173.833 15.407 C 173.604 15.278,173.285 15.170,173.125 15.169 C 172.965 15.168,172.833 15.104,172.833 15.028 C 172.833 14.951,172.740 14.879,172.625 14.868 C 172.510 14.856,172.079 14.772,171.667 14.681 C 170.784 14.485,167.265 14.481,166.115 14.674 M195.009 14.682 C 194.602 14.762,193.947 14.978,193.553 15.163 C 193.159 15.349,192.761 15.500,192.668 15.500 C 192.576 15.500,192.500 15.567,192.500 15.649 C 192.500 15.730,192.318 15.843,192.095 15.899 C 191.872 15.955,191.591 16.096,191.470 16.212 C 191.349 16.328,190.923 16.661,190.523 16.951 C 190.123 17.242,189.688 17.634,189.555 17.823 C 189.121 18.442,189.000 18.190,189.000 16.667 L 189.000 15.167 186.750 15.167 L 184.500 15.167 184.500 33.583 L 184.500 52.000 186.750 52.000 L 189.000 52.000 189.000 44.236 C 189.000 36.317,189.038 35.857,189.595 36.965 C 189.738 37.249,190.932 38.282,192.090 39.124 C 192.766 39.615,194.318 40.219,195.276 40.363 C 195.903 40.458,196.547 40.602,196.706 40.684 C 197.069 40.871,200.333 40.882,200.333 40.697 C 200.333 40.621,200.894 40.473,201.578 40.366 C 202.263 40.260,203.106 40.021,203.451 39.836 C 203.796 39.651,204.173 39.500,204.289 39.500 C 204.405 39.500,204.500 39.421,204.500 39.323 C 204.500 39.226,204.575 39.193,204.667 39.250 C 204.758 39.307,204.833 39.286,204.833 39.203 C 204.833 39.121,205.024 38.967,205.257 38.861 C 206.219 38.422,208.290 36.306,208.913 35.125 C 209.094 34.781,209.292 34.500,209.353 34.500 C 209.414 34.500,209.561 34.167,209.681 33.761 C 209.802 33.354,209.947 33.051,210.005 33.087 C 210.064 33.123,210.115 33.062,210.119 32.951 C 210.138 32.503,210.589 31.075,210.747 30.964 C 211.011 30.779,210.974 24.464,210.708 24.375 C 210.594 24.337,210.500 24.163,210.500 23.989 C 210.500 23.513,210.115 22.167,209.979 22.167 C 209.913 22.167,209.810 21.941,209.750 21.665 C 209.689 21.389,209.552 21.070,209.445 20.957 C 209.338 20.843,209.120 20.469,208.961 20.125 C 208.802 19.781,208.596 19.500,208.503 19.500 C 208.410 19.500,208.333 19.410,208.333 19.301 C 208.333 18.803,204.794 15.833,204.201 15.833 C 204.106 15.833,204.003 15.777,203.972 15.708 C 203.907 15.562,201.920 14.905,200.833 14.670 C 199.922 14.473,196.034 14.481,195.009 14.682 M224.500 14.686 C 223.996 14.767,223.433 14.905,223.250 14.993 C 223.067 15.081,222.598 15.234,222.208 15.333 C 221.819 15.432,221.500 15.576,221.500 15.652 C 221.500 15.729,221.293 15.833,221.039 15.884 C 220.786 15.934,220.402 16.129,220.186 16.316 C 219.970 16.504,219.650 16.702,219.475 16.758 C 219.299 16.814,218.952 17.046,218.703 17.275 C 218.454 17.503,218.119 17.810,217.958 17.957 C 217.490 18.387,217.589 18.569,219.110 20.077 L 220.554 21.508 220.984 21.129 C 221.220 20.920,221.452 20.711,221.499 20.663 C 221.620 20.538,222.519 19.957,222.947 19.727 C 223.147 19.619,223.560 19.478,223.864 19.413 C 224.168 19.348,224.496 19.231,224.593 19.154 C 224.947 18.870,227.263 18.628,228.583 18.737 C 231.096 18.946,233.333 20.479,233.333 21.992 C 233.333 22.180,233.408 22.333,233.500 22.333 C 233.594 22.333,233.667 22.806,233.667 23.417 L 233.667 24.500 230.625 24.510 C 228.952 24.516,227.021 24.591,226.333 24.678 C 225.646 24.765,224.915 24.850,224.708 24.868 C 224.502 24.885,224.333 24.955,224.333 25.021 C 224.333 25.088,223.917 25.195,223.408 25.258 C 222.900 25.322,222.393 25.463,222.283 25.572 C 222.173 25.680,221.727 25.868,221.292 25.990 C 220.856 26.111,220.500 26.270,220.500 26.344 C 220.500 26.417,220.357 26.523,220.183 26.578 C 219.558 26.776,217.559 28.888,217.336 29.583 C 217.219 29.950,217.039 30.355,216.937 30.484 C 216.682 30.803,216.680 35.634,216.934 35.798 C 217.035 35.863,217.205 36.182,217.310 36.506 C 217.470 36.997,218.612 38.321,219.556 39.110 C 220.273 39.709,222.601 40.500,223.649 40.500 C 223.934 40.500,224.167 40.575,224.167 40.667 C 224.167 40.767,224.861 40.833,225.917 40.833 C 226.972 40.833,227.667 40.767,227.667 40.667 C 227.667 40.575,227.858 40.500,228.093 40.500 C 228.727 40.500,230.048 40.150,230.333 39.906 C 230.471 39.789,230.792 39.641,231.046 39.577 C 231.301 39.514,231.584 39.320,231.677 39.147 C 231.769 38.975,231.925 38.833,232.022 38.833 C 232.228 38.833,233.748 37.318,233.883 36.979 C 233.933 36.853,233.980 37.374,233.987 38.136 C 234.007 40.220,233.941 40.167,236.506 40.167 L 238.667 40.167 238.667 39.597 C 238.667 39.284,238.573 38.997,238.458 38.958 C 238.297 38.905,238.228 36.940,238.152 30.236 C 238.091 24.778,237.989 21.388,237.876 21.054 C 237.778 20.763,237.740 20.482,237.793 20.429 C 237.846 20.376,237.808 20.333,237.709 20.333 C 237.610 20.333,237.479 20.033,237.417 19.667 C 237.355 19.300,237.231 19.000,237.142 19.000 C 237.053 19.000,237.027 18.925,237.083 18.833 C 237.140 18.742,237.125 18.667,237.051 18.667 C 236.976 18.667,236.818 18.448,236.700 18.181 C 236.438 17.589,235.200 16.327,234.555 15.994 C 234.296 15.860,234.038 15.689,233.983 15.614 C 233.928 15.539,233.778 15.457,233.650 15.431 C 233.325 15.365,232.804 15.171,232.460 14.987 C 231.626 14.542,226.586 14.351,224.500 14.686 M254.708 14.702 C 254.135 14.790,253.667 14.924,253.667 15.000 C 253.667 15.076,253.365 15.188,252.997 15.251 C 252.628 15.313,252.234 15.451,252.122 15.557 C 252.009 15.663,251.692 15.862,251.417 16.000 C 251.142 16.137,250.879 16.295,250.833 16.350 C 250.787 16.405,250.575 16.542,250.361 16.655 C 249.514 17.101,247.614 18.972,247.310 19.659 C 247.186 19.938,247.030 20.167,246.962 20.167 C 246.844 20.167,246.340 21.226,246.355 21.443 C 246.359 21.500,246.292 21.592,246.206 21.648 C 245.228 22.288,244.577 31.046,245.462 31.653 C 245.540 31.706,245.698 32.181,245.814 32.708 C 245.929 33.236,246.131 33.774,246.262 33.905 C 246.393 34.036,246.500 34.204,246.500 34.280 C 246.501 34.814,249.497 38.322,249.958 38.330 C 250.073 38.332,250.167 38.396,250.167 38.473 C 250.167 38.978,254.123 40.491,255.458 40.498 C 255.756 40.499,256.000 40.575,256.000 40.667 C 256.000 40.768,256.722 40.833,257.833 40.833 C 258.944 40.833,259.667 40.768,259.667 40.667 C 259.667 40.575,259.985 40.497,260.375 40.494 C 261.180 40.487,263.003 40.086,263.151 39.883 C 263.206 39.809,263.550 39.644,263.917 39.517 C 264.283 39.390,264.621 39.241,264.667 39.185 C 264.712 39.129,265.125 38.823,265.583 38.505 C 266.463 37.894,267.500 36.886,267.500 36.642 C 267.500 36.562,266.781 35.781,265.902 34.907 L 264.305 33.317 263.467 34.168 C 261.799 35.863,260.245 36.500,257.781 36.500 C 256.816 36.500,256.167 36.433,256.167 36.333 C 256.167 36.242,256.019 36.167,255.838 36.167 C 255.371 36.167,253.838 35.427,253.266 34.925 C 252.999 34.691,252.733 34.500,252.673 34.500 C 252.293 34.500,250.388 31.334,250.625 31.097 C 250.679 31.044,250.647 31.000,250.554 31.000 C 249.877 31.000,249.822 24.354,250.495 23.833 C 250.554 23.787,250.702 23.488,250.825 23.167 C 251.364 21.753,252.702 20.266,253.995 19.644 C 254.410 19.444,254.882 19.216,255.043 19.138 C 256.227 18.561,260.151 18.627,260.757 19.234 C 260.889 19.365,261.217 19.521,261.487 19.581 C 261.760 19.640,262.438 20.129,263.011 20.678 C 264.214 21.829,264.259 21.839,264.921 21.125 C 265.198 20.827,265.611 20.486,265.841 20.367 C 266.070 20.248,266.404 19.933,266.583 19.668 C 266.761 19.402,266.939 19.217,266.979 19.257 C 267.094 19.372,267.489 18.775,267.495 18.475 C 267.501 18.173,265.731 16.500,265.406 16.500 C 265.294 16.500,265.157 16.383,265.102 16.239 C 265.047 16.096,264.938 16.019,264.859 16.067 C 264.781 16.116,264.473 15.976,264.175 15.756 C 263.878 15.537,263.341 15.308,262.984 15.247 C 262.626 15.187,262.333 15.085,262.333 15.021 C 262.333 14.957,262.202 14.892,262.042 14.877 C 261.881 14.862,261.375 14.775,260.917 14.685 C 259.874 14.479,256.096 14.489,254.708 14.702 M281.417 14.675 C 281.050 14.749,280.600 14.833,280.417 14.863 C 280.233 14.892,280.046 14.958,280.000 15.008 C 279.954 15.058,279.598 15.193,279.208 15.306 C 278.819 15.420,278.500 15.573,278.500 15.647 C 278.500 15.720,278.200 15.879,277.833 16.000 C 277.467 16.121,277.167 16.285,277.167 16.364 C 277.167 16.443,276.979 16.580,276.750 16.667 C 276.521 16.754,276.333 16.902,276.333 16.996 C 276.333 17.090,276.235 17.167,276.115 17.167 C 275.864 17.167,274.833 18.128,274.833 18.363 C 274.833 18.449,274.764 18.477,274.679 18.424 C 274.594 18.372,274.479 18.471,274.423 18.646 C 274.368 18.820,274.135 19.177,273.907 19.440 C 273.188 20.263,273.148 20.328,272.889 21.089 C 272.749 21.499,272.578 21.833,272.507 21.833 C 272.437 21.833,272.281 22.302,272.161 22.875 C 272.042 23.448,271.863 23.970,271.764 24.036 C 271.512 24.202,271.514 30.967,271.766 31.131 C 271.866 31.196,271.991 31.512,272.043 31.833 C 272.095 32.154,272.231 32.642,272.346 32.917 C 272.460 33.192,272.542 33.473,272.527 33.542 C 272.512 33.610,272.575 33.667,272.667 33.667 C 272.758 33.667,272.839 33.798,272.846 33.958 C 272.852 34.119,273.001 34.475,273.177 34.750 C 273.353 35.025,273.548 35.362,273.611 35.500 C 273.674 35.637,273.881 35.914,274.071 36.114 C 274.261 36.314,274.754 36.856,275.167 37.319 C 275.579 37.781,276.007 38.161,276.117 38.163 C 276.227 38.165,276.377 38.261,276.450 38.375 C 276.523 38.490,276.808 38.696,277.083 38.833 C 277.358 38.971,277.621 39.127,277.667 39.180 C 278.065 39.646,280.599 40.488,281.625 40.496 C 281.923 40.498,282.167 40.575,282.167 40.667 C 282.167 40.769,282.976 40.833,284.260 40.833 C 285.613 40.833,286.317 40.774,286.250 40.667 C 286.188 40.567,286.402 40.499,286.782 40.497 C 287.131 40.495,287.904 40.380,288.500 40.242 C 289.096 40.104,289.677 39.980,289.792 39.968 C 289.906 39.955,290.000 39.898,290.000 39.842 C 290.000 39.786,290.337 39.640,290.750 39.518 C 291.162 39.396,291.500 39.228,291.500 39.144 C 291.500 39.060,291.688 38.920,291.917 38.833 C 292.146 38.746,292.333 38.598,292.333 38.504 C 292.333 38.410,292.432 38.333,292.554 38.333 C 292.801 38.333,295.167 35.939,295.167 35.689 C 295.167 35.600,295.246 35.501,295.342 35.469 C 295.439 35.437,295.204 35.187,294.820 34.914 C 294.437 34.640,293.955 34.248,293.751 34.042 C 293.546 33.835,293.293 33.667,293.189 33.667 C 293.085 33.667,293.000 33.591,293.000 33.498 C 293.000 33.405,292.768 33.188,292.485 33.016 L 291.971 32.703 290.860 33.810 C 290.250 34.419,289.450 35.067,289.083 35.250 C 288.717 35.433,288.392 35.638,288.362 35.704 C 288.333 35.771,287.864 35.917,287.321 36.029 C 286.778 36.142,286.333 36.293,286.333 36.367 C 286.333 36.440,285.471 36.500,284.417 36.500 C 283.250 36.500,282.500 36.435,282.500 36.333 C 282.500 36.242,282.352 36.167,282.172 36.167 C 281.726 36.167,280.139 35.427,279.586 34.962 C 278.805 34.303,278.167 33.681,278.167 33.578 C 278.167 33.523,277.987 33.239,277.766 32.947 C 277.252 32.265,276.574 30.616,276.437 29.710 L 276.330 29.003 286.290 28.960 L 296.250 28.917 296.298 27.542 C 296.329 26.669,296.283 26.167,296.173 26.167 C 296.078 26.167,295.999 25.848,295.999 25.458 C 295.997 24.677,295.718 22.726,295.551 22.333 C 295.493 22.196,295.433 22.046,295.417 22.000 C 295.379 21.889,295.018 20.982,294.885 20.667 C 294.828 20.529,294.792 20.360,294.807 20.292 C 294.821 20.223,294.756 20.167,294.663 20.167 C 294.520 20.167,294.222 19.629,294.201 19.333 C 294.177 19.005,291.472 16.296,291.030 16.157 C 290.653 16.039,290.167 15.763,290.167 15.668 C 290.167 15.606,290.073 15.550,289.958 15.543 C 289.715 15.529,288.622 15.122,288.500 15.000 C 288.071 14.571,283.080 14.342,281.417 14.675 M199.309 18.856 C 199.907 18.960,200.749 19.222,201.180 19.439 C 201.612 19.656,202.040 19.833,202.131 19.833 C 202.223 19.833,202.341 19.946,202.394 20.083 C 202.446 20.221,202.586 20.333,202.704 20.333 C 203.199 20.333,205.096 22.817,205.376 23.833 C 205.465 24.154,205.600 24.456,205.676 24.504 C 206.164 24.811,206.216 29.329,205.744 30.417 C 205.625 30.692,205.431 31.198,205.314 31.542 C 205.196 31.885,205.045 32.167,204.978 32.167 C 204.911 32.167,204.803 32.335,204.739 32.542 C 204.674 32.748,204.407 33.163,204.144 33.464 C 203.882 33.765,203.667 34.075,203.667 34.152 C 203.667 34.230,203.442 34.386,203.167 34.500 C 202.892 34.614,202.667 34.769,202.667 34.846 C 202.667 34.922,202.404 35.109,202.083 35.261 C 201.762 35.413,201.500 35.601,201.500 35.679 C 201.500 35.757,201.050 35.913,200.500 36.027 C 199.950 36.140,199.500 36.293,199.500 36.367 C 199.500 36.885,194.345 36.243,193.833 35.661 C 193.787 35.609,193.477 35.439,193.143 35.284 C 192.809 35.129,192.493 34.889,192.440 34.751 C 192.387 34.613,192.239 34.500,192.112 34.500 C 191.984 34.500,191.738 34.299,191.565 34.054 C 191.392 33.809,191.096 33.453,190.907 33.263 C 190.461 32.813,189.905 31.717,189.660 30.807 C 189.553 30.409,189.387 30.034,189.290 29.974 C 189.058 29.829,189.044 25.603,189.276 25.305 C 189.371 25.183,189.548 24.708,189.670 24.250 C 189.792 23.792,189.944 23.379,190.007 23.333 C 190.070 23.287,190.276 22.950,190.463 22.583 C 190.809 21.909,192.235 20.333,192.499 20.333 C 192.578 20.333,192.742 20.235,192.863 20.115 C 193.150 19.831,194.155 19.333,194.442 19.333 C 194.566 19.333,194.667 19.267,194.667 19.186 C 194.667 18.786,197.679 18.572,199.309 18.856 M285.910 18.854 C 286.601 18.956,287.167 19.106,287.167 19.187 C 287.167 19.267,287.223 19.322,287.292 19.308 C 288.347 19.090,291.589 23.015,291.060 23.870 C 291.016 23.942,291.060 24.000,291.157 24.000 C 291.254 24.000,291.333 24.262,291.333 24.583 L 291.333 25.167 283.893 25.167 L 276.454 25.167 276.557 24.293 C 276.614 23.812,276.733 23.395,276.821 23.365 C 276.909 23.336,277.071 23.035,277.180 22.698 C 277.393 22.038,277.468 21.935,278.480 20.917 C 279.419 19.972,279.536 19.888,280.614 19.396 C 282.124 18.705,283.774 18.536,285.910 18.854 M233.667 29.657 C 233.667 30.385,233.604 31.019,233.528 31.066 C 233.452 31.113,233.293 31.582,233.176 32.108 C 232.963 33.059,232.400 34.112,231.764 34.750 C 231.265 35.250,229.945 36.167,229.723 36.167 C 229.616 36.167,229.503 36.242,229.472 36.334 C 229.358 36.675,226.753 36.914,225.360 36.711 C 222.799 36.338,221.504 35.058,221.501 32.900 C 221.499 31.376,222.524 29.710,223.583 29.514 C 223.675 29.498,223.920 29.372,224.129 29.235 C 224.458 29.020,226.017 28.634,226.625 28.617 C 226.740 28.614,226.833 28.549,226.833 28.472 C 226.833 28.396,228.371 28.333,230.250 28.333 L 233.667 28.333 233.667 29.657 " stroke="none" fill="#cccccc" fill-rule="evenodd"></path><path id="path1" d="M303.500 20.083 L 303.500 40.167 305.750 40.167 L 308.000 40.167 308.000 20.083 L 308.000 0.000 305.750 0.000 L 303.500 0.000 303.500 20.083 M361.000 20.083 L 361.000 40.167 363.250 40.167 L 365.500 40.167 365.519 33.792 C 365.530 30.285,365.576 27.529,365.623 27.667 C 365.669 27.804,366.209 28.367,366.822 28.917 C 367.436 29.467,368.107 30.155,368.315 30.445 C 368.522 30.736,369.436 31.730,370.346 32.655 C 371.256 33.579,372.000 34.410,372.000 34.501 C 372.000 34.592,372.113 34.667,372.250 34.667 C 372.387 34.667,372.500 34.750,372.500 34.851 C 372.500 34.953,373.279 35.811,374.231 36.759 C 375.184 37.706,375.935 38.509,375.902 38.543 C 375.868 38.577,376.213 38.956,376.668 39.385 L 377.496 40.167 380.664 40.167 C 383.329 40.167,383.833 40.128,383.833 39.924 C 383.833 39.790,382.577 38.408,381.042 36.853 C 375.499 31.238,370.593 26.168,370.923 26.395 C 370.972 26.429,371.448 26.016,371.982 25.478 C 372.515 24.940,372.996 24.500,373.050 24.500 C 373.105 24.500,373.940 23.731,374.907 22.792 C 375.873 21.852,377.235 20.558,377.932 19.917 C 378.629 19.275,379.504 18.431,379.877 18.042 C 380.249 17.652,380.659 17.333,380.787 17.333 C 380.915 17.333,380.990 17.277,380.953 17.208 C 380.890 17.091,381.406 16.504,381.580 16.496 C 381.752 16.488,382.459 15.681,382.371 15.593 C 382.320 15.542,382.365 15.500,382.472 15.500 C 382.579 15.500,382.667 15.425,382.667 15.333 C 382.667 15.228,381.481 15.167,379.443 15.167 L 376.220 15.167 375.634 15.792 C 375.312 16.135,374.681 16.766,374.232 17.193 C 373.784 17.620,373.204 18.202,372.944 18.485 C 372.684 18.768,372.382 19.000,372.272 19.000 C 372.162 19.000,371.939 19.225,371.777 19.500 C 371.614 19.775,371.415 20.000,371.334 20.000 C 371.253 20.000,369.996 21.200,368.541 22.667 C 367.086 24.133,365.807 25.333,365.698 25.333 C 365.547 25.333,365.500 22.329,365.500 12.667 L 365.500 0.000 363.250 0.000 L 361.000 0.000 361.000 20.083 M129.167 2.617 C 127.340 3.282,126.802 7.303,128.424 8.171 C 128.649 8.291,128.833 8.456,128.833 8.538 C 128.833 8.620,128.903 8.643,128.988 8.590 C 129.074 8.538,129.191 8.571,129.248 8.664 C 129.813 9.577,133.005 8.387,133.502 7.077 C 134.583 4.236,132.005 1.585,129.167 2.617 M318.198 2.606 C 316.893 3.177,315.644 6.631,316.625 6.958 C 316.740 6.997,316.833 7.132,316.833 7.258 C 316.833 8.470,319.765 9.317,321.233 8.530 C 322.543 7.828,323.469 4.598,322.527 4.016 C 322.404 3.940,322.214 3.699,322.105 3.481 C 321.996 3.262,321.813 3.083,321.697 3.083 C 321.582 3.083,321.418 2.971,321.333 2.833 C 321.175 2.577,318.678 2.396,318.198 2.606 M22.875 4.762 C 22.394 5.260,22.000 5.628,22.000 5.578 C 22.000 5.529,21.719 5.803,21.375 6.187 C 20.622 7.029,17.606 10.042,16.781 10.776 C 16.456 11.065,16.209 11.327,16.232 11.359 C 16.254 11.391,15.799 11.879,15.220 12.444 C 14.641 13.009,14.167 13.441,14.167 13.404 C 14.167 13.310,13.236 14.291,12.620 15.034 C 12.339 15.373,12.060 15.621,12.001 15.584 C 11.943 15.548,11.773 15.724,11.624 15.975 C 11.476 16.227,11.165 16.534,10.933 16.658 C 10.701 16.782,10.533 16.929,10.560 16.983 C 10.587 17.038,10.285 17.400,9.888 17.788 C 9.491 18.175,9.167 18.459,9.167 18.419 C 9.167 18.378,8.993 18.511,8.781 18.714 C 8.569 18.917,8.404 19.121,8.414 19.167 C 8.424 19.212,7.960 19.712,7.383 20.277 C 6.806 20.842,6.333 21.276,6.333 21.242 C 6.333 21.207,6.160 21.345,5.948 21.548 C 5.735 21.751,5.573 21.954,5.586 22.000 C 5.599 22.046,5.285 22.400,4.888 22.788 C 4.491 23.175,4.166 23.438,4.166 23.371 C 4.165 23.304,4.023 23.464,3.850 23.726 C 3.678 23.988,3.322 24.344,3.060 24.517 C 2.798 24.690,2.638 24.832,2.704 24.832 C 2.771 24.833,2.509 25.158,2.121 25.555 C 1.734 25.951,1.379 26.265,1.333 26.252 C 1.287 26.239,1.084 26.402,0.881 26.614 C 0.678 26.826,0.547 27.000,0.589 27.000 C 0.632 27.000,0.517 27.150,0.333 27.333 C -0.170 27.836,-0.102 27.981,1.264 29.333 C 1.959 30.021,2.653 30.720,2.805 30.886 C 2.958 31.052,4.571 32.665,6.390 34.469 C 8.208 36.274,9.783 37.838,9.890 37.946 C 14.503 42.603,19.244 47.349,19.854 47.920 C 20.293 48.331,20.629 48.667,20.600 48.667 C 20.571 48.667,21.264 49.379,22.139 50.250 C 23.094 51.200,23.864 51.833,24.066 51.833 C 24.414 51.833,36.833 39.520,36.833 39.175 C 36.833 39.079,36.933 39.000,37.056 39.000 C 37.253 39.000,37.455 38.803,38.470 37.623 C 38.723 37.328,37.490 35.929,34.347 32.948 C 33.943 32.564,33.495 32.119,33.352 31.958 C 32.908 31.459,32.783 31.560,28.428 35.917 C 26.092 38.254,24.120 40.167,24.047 40.167 C 23.973 40.167,21.758 38.005,19.123 35.362 C 16.489 32.719,14.333 30.573,14.333 30.592 C 14.333 30.611,13.721 29.999,12.974 29.233 L 11.614 27.840 13.265 26.157 C 14.174 25.231,15.053 24.348,15.220 24.195 C 16.051 23.432,22.139 17.333,22.069 17.333 C 22.025 17.333,22.385 16.984,22.869 16.556 C 23.354 16.129,23.775 15.716,23.806 15.639 C 23.910 15.378,24.314 15.499,24.574 15.870 C 24.717 16.074,24.834 16.168,24.836 16.079 C 24.837 15.990,24.932 16.103,25.047 16.330 C 25.162 16.557,25.443 16.838,25.670 16.953 C 25.897 17.068,26.034 17.163,25.973 17.164 C 25.912 17.166,26.099 17.418,26.389 17.725 C 26.679 18.032,26.973 18.252,27.042 18.215 C 27.110 18.178,27.167 18.215,27.167 18.299 C 27.167 18.507,30.646 22.000,30.853 22.000 C 30.945 22.000,30.980 22.064,30.932 22.142 C 30.884 22.219,31.027 22.381,31.250 22.500 C 31.473 22.619,31.628 22.762,31.595 22.817 C 31.562 22.872,31.640 23.013,31.767 23.132 C 31.895 23.250,32.000 23.287,32.001 23.215 C 32.002 23.143,32.151 23.308,32.333 23.583 C 32.515 23.858,32.666 24.008,32.668 23.917 C 32.670 23.825,32.766 23.936,32.881 24.163 C 32.996 24.391,33.276 24.671,33.503 24.786 C 33.731 24.901,33.842 24.997,33.750 24.999 C 33.658 25.001,33.808 25.151,34.083 25.333 C 34.358 25.515,34.529 25.665,34.463 25.666 C 34.398 25.666,34.795 26.117,35.347 26.667 C 35.898 27.217,36.426 27.667,36.518 27.667 C 36.611 27.667,36.643 27.736,36.591 27.821 C 36.538 27.906,36.634 28.020,36.804 28.074 C 36.974 28.128,37.212 28.356,37.332 28.580 C 37.452 28.805,37.614 28.949,37.692 28.901 C 37.770 28.853,37.833 28.932,37.833 29.076 C 37.833 29.220,38.077 29.486,38.375 29.668 C 38.673 29.849,38.882 30.016,38.840 30.040 C 38.798 30.064,39.004 30.330,39.298 30.631 C 39.593 30.932,39.834 31.119,39.834 31.047 C 39.835 30.976,39.985 31.142,40.167 31.417 C 40.349 31.692,40.498 31.857,40.499 31.785 C 40.500 31.713,40.605 31.750,40.734 31.868 C 40.863 31.987,40.957 32.152,40.942 32.236 C 40.928 32.321,41.085 32.477,41.291 32.585 C 41.496 32.692,41.622 32.822,41.570 32.875 C 41.518 32.927,41.619 33.015,41.794 33.071 C 41.970 33.127,42.212 33.356,42.332 33.580 C 42.452 33.805,42.603 33.956,42.667 33.916 C 42.732 33.876,42.873 34.039,42.982 34.277 C 43.090 34.515,43.226 34.663,43.283 34.605 C 43.341 34.548,43.524 34.726,43.691 35.001 C 43.858 35.275,44.113 35.500,44.257 35.500 C 44.402 35.500,44.477 35.570,44.424 35.655 C 44.372 35.740,44.484 35.859,44.674 35.919 C 44.864 35.979,45.090 36.214,45.176 36.441 C 45.262 36.668,45.408 36.807,45.500 36.750 C 45.592 36.693,45.667 36.738,45.667 36.848 C 45.667 37.097,46.641 38.058,47.052 38.216 C 47.218 38.279,47.311 38.401,47.258 38.487 C 47.205 38.573,47.317 38.692,47.507 38.752 C 47.697 38.813,47.923 39.047,48.009 39.274 C 48.095 39.501,48.230 39.647,48.309 39.599 C 48.387 39.550,48.538 39.700,48.643 39.931 C 48.748 40.163,48.891 40.318,48.959 40.277 C 49.127 40.176,49.509 40.603,49.372 40.739 C 49.313 40.798,49.436 40.891,49.645 40.946 C 49.854 41.001,50.095 41.227,50.179 41.449 C 50.264 41.672,50.408 41.807,50.500 41.750 C 50.592 41.693,50.740 41.839,50.830 42.073 C 50.919 42.308,51.088 42.500,51.206 42.500 C 51.324 42.500,51.495 42.669,51.585 42.875 C 51.676 43.081,51.862 43.250,52.000 43.250 C 52.137 43.250,52.251 43.325,52.253 43.417 C 52.254 43.508,52.479 43.807,52.753 44.081 C 53.026 44.354,53.325 44.579,53.417 44.581 C 53.508 44.582,53.583 44.696,53.583 44.833 C 53.583 44.971,53.752 45.157,53.958 45.248 C 54.165 45.338,54.333 45.509,54.333 45.627 C 54.333 45.745,54.525 45.915,54.760 46.004 C 54.997 46.094,55.138 46.245,55.077 46.344 C 55.016 46.442,55.115 46.561,55.296 46.609 C 55.478 46.656,55.709 46.876,55.809 47.097 C 55.910 47.319,56.098 47.500,56.227 47.500 C 56.356 47.500,56.500 47.650,56.548 47.833 C 56.596 48.017,56.755 48.167,56.901 48.167 C 57.047 48.167,57.167 48.281,57.167 48.420 C 57.167 48.560,57.348 48.756,57.569 48.857 C 57.791 48.958,58.011 49.189,58.058 49.370 C 58.105 49.552,58.213 49.658,58.298 49.605 C 58.382 49.553,58.536 49.696,58.639 49.922 C 58.742 50.148,58.932 50.333,59.060 50.333 C 59.189 50.333,59.335 50.489,59.385 50.679 C 59.435 50.869,59.630 51.065,59.819 51.115 C 60.008 51.164,60.119 51.276,60.065 51.363 C 60.011 51.451,60.124 51.564,60.317 51.614 C 60.509 51.664,60.667 51.772,60.667 51.853 C 60.667 52.234,61.277 51.919,62.077 51.125 C 62.561 50.644,63.099 50.131,63.271 49.986 C 63.443 49.841,63.892 49.391,64.269 48.986 C 64.645 48.581,65.283 47.942,65.685 47.565 C 66.087 47.188,66.729 46.550,67.110 46.148 C 67.492 45.746,68.129 45.105,68.527 44.724 C 68.925 44.344,69.562 43.706,69.942 43.308 C 70.323 42.909,70.961 42.275,71.359 41.899 C 71.757 41.522,72.240 41.035,72.431 40.815 C 72.623 40.596,72.960 40.258,73.181 40.064 C 73.402 39.871,74.044 39.233,74.606 38.648 C 75.168 38.062,75.921 37.320,76.278 36.997 C 76.635 36.675,77.037 36.260,77.172 36.076 C 77.306 35.891,77.957 35.236,78.618 34.620 C 79.279 34.004,79.786 33.500,79.745 33.500 C 79.704 33.500,79.913 33.272,80.210 32.992 C 81.504 31.776,82.633 30.667,82.576 30.667 C 82.543 30.667,83.112 30.092,83.841 29.389 C 85.306 27.977,85.363 27.845,84.728 27.345 C 84.486 27.155,84.330 27.000,84.380 27.000 C 84.431 27.000,84.217 26.737,83.906 26.417 C 83.594 26.096,83.304 25.833,83.260 25.833 C 83.217 25.833,81.080 23.752,78.513 21.208 C 75.946 18.665,72.736 15.517,71.381 14.214 C 70.026 12.911,67.604 10.530,66.000 8.923 C 64.396 7.317,62.946 5.957,62.779 5.902 C 62.612 5.848,62.518 5.760,62.571 5.707 C 62.709 5.569,60.799 3.842,60.503 3.837 C 60.248 3.833,54.333 9.761,54.333 10.021 C 54.333 10.101,54.253 10.167,54.155 10.167 C 53.908 10.167,53.493 10.604,53.619 10.730 C 53.676 10.787,53.629 10.833,53.516 10.833 C 53.318 10.833,52.833 11.226,52.833 11.387 C 52.833 11.430,51.371 12.944,49.583 14.752 C 47.324 17.037,46.333 18.153,46.333 18.410 C 46.333 18.792,47.546 20.065,47.732 19.879 C 47.788 19.823,47.833 19.905,47.833 20.061 C 47.833 20.217,48.002 20.412,48.208 20.495 C 48.415 20.578,48.525 20.650,48.454 20.656 C 48.280 20.670,49.348 21.833,49.535 21.833 C 49.617 21.833,50.150 22.321,50.720 22.917 C 51.783 24.028,52.299 24.252,52.451 23.669 C 52.499 23.486,52.604 23.378,52.686 23.428 C 52.767 23.479,52.833 23.449,52.833 23.362 C 52.833 23.209,60.451 15.500,60.602 15.500 C 60.753 15.500,61.995 16.665,65.081 19.702 C 66.824 21.417,69.315 23.867,70.616 25.146 C 71.917 26.426,73.110 27.545,73.267 27.633 C 73.519 27.774,73.482 27.862,72.943 28.402 C 72.608 28.737,72.333 29.084,72.333 29.172 C 72.333 29.261,72.268 29.333,72.187 29.333 C 72.024 29.333,69.500 31.768,69.500 31.925 C 69.500 32.047,69.056 32.500,68.936 32.500 C 68.763 32.500,68.037 33.315,68.129 33.407 C 68.180 33.458,68.142 33.500,68.045 33.500 C 67.825 33.500,65.500 35.808,65.500 36.027 C 65.500 36.115,65.436 36.147,65.358 36.099 C 65.281 36.051,65.119 36.194,65.000 36.417 C 64.881 36.640,64.719 36.783,64.642 36.734 C 64.564 36.686,64.500 36.732,64.500 36.835 C 64.500 37.079,64.079 37.500,63.835 37.500 C 63.732 37.500,63.693 37.575,63.750 37.667 C 63.807 37.758,63.777 37.833,63.684 37.833 C 63.501 37.833,61.667 39.597,61.667 39.773 C 61.667 39.896,61.137 40.320,60.975 40.328 C 60.915 40.331,52.654 32.121,42.617 22.083 C 31.054 10.519,24.255 3.837,24.059 3.844 C 23.889 3.850,23.356 4.263,22.875 4.762 M106.167 14.659 C 105.116 14.856,104.928 14.904,104.833 15.005 C 104.787 15.054,104.337 15.196,103.833 15.321 C 103.329 15.446,102.879 15.593,102.833 15.649 C 102.723 15.783,101.885 16.264,101.201 16.586 C 100.899 16.728,100.610 16.954,100.558 17.089 C 100.507 17.223,100.392 17.333,100.303 17.333 C 100.085 17.333,99.167 18.263,99.167 18.483 C 99.167 18.580,99.351 18.780,99.577 18.928 C 99.802 19.076,100.032 19.340,100.088 19.515 C 100.144 19.690,100.309 19.833,100.456 19.833 C 100.602 19.833,100.678 19.877,100.625 19.931 C 100.571 19.984,100.818 20.336,101.172 20.713 C 101.863 21.446,102.206 21.438,103.021 20.672 C 103.659 20.072,103.975 19.888,105.000 19.519 C 107.174 18.736,110.189 18.467,111.604 18.930 C 112.333 19.169,113.611 19.922,113.963 20.320 C 114.790 21.256,114.983 21.749,115.109 23.243 L 115.212 24.455 111.221 24.531 C 109.026 24.573,107.122 24.675,106.990 24.757 C 106.858 24.840,106.600 24.918,106.417 24.933 C 105.391 25.013,102.295 26.031,102.199 26.320 C 102.166 26.419,102.037 26.500,101.911 26.500 C 101.786 26.500,101.482 26.688,101.234 26.917 C 100.987 27.146,100.723 27.333,100.648 27.333 C 100.467 27.333,99.347 28.458,99.437 28.548 C 99.476 28.587,99.394 28.714,99.254 28.830 C 99.114 28.946,99.000 29.138,99.000 29.257 C 99.000 29.375,98.926 29.497,98.836 29.528 C 98.746 29.558,98.590 30.033,98.491 30.583 C 98.391 31.133,98.240 31.714,98.155 31.873 C 97.945 32.265,97.955 34.500,98.167 34.500 C 98.258 34.500,98.333 34.676,98.333 34.892 C 98.333 35.404,98.669 36.358,98.947 36.637 C 99.068 36.758,99.167 36.964,99.167 37.094 C 99.167 37.224,99.317 37.424,99.500 37.539 C 99.683 37.653,99.833 37.807,99.833 37.880 C 99.833 38.185,100.986 39.096,102.158 39.716 C 102.861 40.089,104.370 40.486,105.115 40.494 C 105.408 40.497,105.693 40.575,105.750 40.667 C 105.807 40.760,106.585 40.833,107.510 40.833 C 108.503 40.833,109.167 40.767,109.167 40.667 C 109.167 40.575,109.410 40.499,109.708 40.498 C 110.723 40.495,112.769 39.695,112.946 39.233 C 112.995 39.106,113.094 39.038,113.165 39.082 C 113.237 39.127,113.388 39.051,113.502 38.915 C 113.615 38.778,113.823 38.667,113.965 38.667 C 114.106 38.667,114.176 38.621,114.120 38.565 C 114.064 38.509,114.235 38.280,114.500 38.057 C 114.765 37.834,115.029 37.504,115.086 37.324 C 115.246 36.820,115.500 37.112,115.501 37.802 C 115.502 38.140,115.550 38.810,115.608 39.292 L 115.713 40.167 117.958 40.167 C 120.034 40.167,120.193 40.145,120.071 39.875 C 119.999 39.715,119.886 35.796,119.819 31.167 C 119.702 23.020,119.665 22.035,119.457 21.500 C 119.403 21.363,119.311 20.959,119.251 20.602 C 119.192 20.246,118.998 19.685,118.822 19.355 C 118.645 19.025,118.500 18.677,118.500 18.581 C 118.500 18.486,118.369 18.283,118.208 18.131 C 118.048 17.979,117.767 17.656,117.583 17.414 C 117.131 16.816,116.940 16.626,116.493 16.333 C 116.283 16.196,115.974 15.952,115.806 15.792 C 115.638 15.631,115.500 15.547,115.500 15.604 C 115.500 15.661,115.406 15.632,115.292 15.540 C 115.177 15.447,114.821 15.316,114.500 15.248 C 114.179 15.180,113.878 15.064,113.830 14.989 C 113.599 14.630,107.688 14.375,106.167 14.659 M151.332 14.672 C 151.010 14.749,150.523 14.928,150.248 15.071 C 149.974 15.214,149.616 15.332,149.453 15.332 C 149.290 15.333,149.116 15.439,149.066 15.568 C 149.016 15.698,148.796 15.848,148.576 15.904 C 148.356 15.959,147.686 16.496,147.088 17.097 C 146.249 17.941,146.000 18.114,146.000 17.855 C 146.000 17.671,145.925 17.473,145.833 17.417 C 145.742 17.360,145.667 16.831,145.667 16.240 L 145.667 15.167 143.542 15.167 L 141.417 15.167 141.464 27.458 C 141.490 34.219,141.543 39.844,141.583 39.958 C 141.637 40.111,142.257 40.167,143.911 40.167 L 146.167 40.167 146.168 33.625 C 146.169 27.422,146.333 24.206,146.657 24.006 C 146.737 23.956,146.856 23.631,146.921 23.283 C 146.987 22.935,147.134 22.557,147.248 22.442 C 147.362 22.328,147.507 22.075,147.569 21.880 C 147.812 21.112,149.439 19.740,150.414 19.480 C 150.782 19.381,151.172 19.228,151.281 19.139 C 151.496 18.963,154.466 19.043,155.197 19.244 L 155.645 19.368 155.716 17.642 C 155.755 16.693,155.846 15.699,155.918 15.432 C 156.128 14.657,155.737 14.497,153.676 14.517 C 152.709 14.526,151.653 14.596,151.332 14.672 M340.750 14.603 C 339.712 14.871,338.358 15.392,337.965 15.675 C 337.717 15.854,337.461 16.000,337.396 16.000 C 337.205 16.000,335.999 17.161,335.208 18.105 L 334.833 18.553 334.833 16.860 L 334.833 15.167 332.641 15.167 L 330.448 15.167 330.557 17.443 C 330.618 18.695,330.667 24.320,330.667 29.943 L 330.667 40.167 332.996 40.167 L 335.325 40.167 335.326 33.289 C 335.326 29.506,335.362 26.187,335.406 25.914 C 335.724 23.932,335.887 23.167,335.992 23.167 C 336.059 23.167,336.204 22.867,336.314 22.500 C 336.423 22.133,336.585 21.833,336.673 21.833 C 336.761 21.833,336.833 21.726,336.833 21.595 C 336.833 21.465,337.018 21.212,337.244 21.034 C 337.470 20.856,337.621 20.676,337.578 20.633 C 337.535 20.591,337.688 20.456,337.917 20.333 C 338.146 20.211,338.333 20.052,338.333 19.981 C 338.333 19.060,343.164 18.356,344.807 19.037 C 345.051 19.138,345.306 19.208,345.375 19.194 C 345.444 19.179,345.500 19.242,345.500 19.333 C 345.500 19.425,345.594 19.500,345.709 19.500 C 346.318 19.500,347.655 21.698,347.793 22.928 C 347.840 23.338,347.943 23.715,348.022 23.764 C 348.102 23.813,348.167 27.524,348.167 32.010 L 348.167 40.167 350.428 40.167 L 352.689 40.167 352.636 30.910 C 352.599 24.425,352.529 21.619,352.400 21.535 C 352.300 21.470,352.169 21.105,352.109 20.724 C 351.887 19.300,349.633 16.000,348.884 16.000 C 348.793 16.000,348.584 15.852,348.420 15.671 C 348.256 15.489,348.062 15.378,347.989 15.423 C 347.916 15.468,347.809 15.429,347.752 15.336 C 347.694 15.243,347.501 15.167,347.323 15.167 C 347.146 15.167,347.000 15.084,347.000 14.982 C 347.000 14.881,346.897 14.837,346.770 14.886 C 346.644 14.934,346.459 14.893,346.360 14.793 C 346.173 14.606,341.370 14.443,340.750 14.603 M128.333 27.667 L 128.333 40.167 130.583 40.167 L 132.833 40.167 132.833 27.667 L 132.833 15.167 130.583 15.167 L 128.333 15.167 128.333 27.667 M317.333 27.667 L 317.333 40.167 319.667 40.167 L 322.000 40.167 322.000 27.667 L 322.000 15.167 319.667 15.167 L 317.333 15.167 317.333 27.667 M115.167 29.260 C 115.167 30.475,114.828 32.500,114.624 32.500 C 114.536 32.500,114.508 32.612,114.560 32.750 C 114.613 32.887,114.584 33.000,114.495 33.000 C 114.406 33.000,114.333 33.098,114.333 33.219 C 114.333 33.339,114.183 33.598,114.000 33.795 C 113.817 33.992,113.667 34.231,113.667 34.326 C 113.667 34.422,113.592 34.500,113.500 34.500 C 113.408 34.500,113.333 34.603,113.333 34.730 C 113.333 34.856,113.105 35.054,112.827 35.169 C 112.548 35.285,112.248 35.516,112.158 35.682 C 112.069 35.849,111.735 36.035,111.416 36.094 C 111.097 36.154,110.872 36.261,110.916 36.333 C 111.152 36.714,107.788 36.957,106.417 36.657 C 105.867 36.537,105.355 36.454,105.279 36.473 C 105.204 36.493,105.185 36.439,105.237 36.354 C 105.290 36.269,105.098 36.117,104.812 36.017 C 104.187 35.800,103.542 35.141,103.400 34.576 C 103.343 34.351,103.230 34.167,103.149 34.167 C 102.882 34.167,102.981 31.924,103.274 31.317 C 103.957 29.903,105.943 28.783,108.042 28.628 C 108.294 28.609,108.500 28.535,108.500 28.464 C 108.500 28.392,110.000 28.333,111.833 28.333 L 115.167 28.333 115.167 29.260 M390.167 36.000 C 390.167 36.650,390.181 36.667,390.744 36.667 L 391.322 36.667 391.369 38.458 L 391.417 40.250 392.042 40.302 L 392.667 40.353 392.667 38.510 L 392.667 36.667 393.417 36.667 L 394.167 36.667 394.167 36.000 L 394.167 35.333 392.167 35.333 L 390.167 35.333 390.167 36.000 M394.667 37.833 L 394.667 40.333 395.333 40.333 L 396.000 40.333 396.023 39.208 C 396.035 38.590,396.078 38.252,396.118 38.458 C 396.157 38.665,396.272 38.833,396.373 38.833 C 396.473 38.833,396.508 38.881,396.450 38.939 C 396.392 38.996,396.455 39.201,396.589 39.392 C 396.723 39.584,396.833 39.874,396.833 40.037 C 396.833 40.939,397.987 40.376,398.277 39.333 C 398.430 38.783,398.617 38.333,398.694 38.333 C 398.771 38.333,398.833 38.783,398.833 39.333 L 398.833 40.333 399.417 40.333 L 400.000 40.333 400.000 37.833 L 400.000 35.333 399.179 35.333 L 398.357 35.333 398.152 36.250 C 398.039 36.754,397.890 37.167,397.821 37.167 C 397.751 37.167,397.619 37.373,397.527 37.625 C 397.375 38.041,397.358 38.049,397.346 37.708 C 397.339 37.502,397.267 37.333,397.186 37.333 C 397.106 37.333,396.952 36.987,396.846 36.564 C 396.590 35.547,396.343 35.333,395.429 35.333 L 394.667 35.333 394.667 37.833 " stroke="none" fill="#5c9cd4" fill-rule="evenodd"></path><path id="path2" d="" stroke="none" fill="#d0b4d0" fill-rule="evenodd"></path><path id="path3" d="" stroke="none" fill="#7cb4d0" fill-rule="evenodd"></path><path id="path4" d="" stroke="none" fill="#5cb8d0" fill-rule="evenodd"></path></g></svg>
\ No newline at end of file
diff --git a/site/static/logos/allfactors.svg b/site/static/logos/allfactors.svg
new file mode 100644
index 000000000..507daa0fa
--- /dev/null
+++ b/site/static/logos/allfactors.svg
@@ -0,0 +1,1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="196" height="52" xmlns:v="https://vecta.io/nano"><path d="M83.853 33.891V11.844h-4.487v22.047h4.487zm8.559-22.047v22.047h-4.487V11.844h4.487zM66.1 34.315q1.537 0 2.855-.565c.879-.377 1.564-.884 2.055-1.522v1.663h4.314V19.392H71.56l-.298 1.412q-1.632-1.914-4.754-1.914-2.118 0-3.773.981-1.655.981-2.565 2.754-.91 1.773-.91 4.127 0 2.26.847 3.962.847 1.703 2.408 2.652 1.561.949 3.585.949zm-1.31-5.068c.633.68 1.467 1.02 2.502 1.02 1.046 0 1.896-.337 2.549-1.012q.981-1.012.981-2.691 0-1.632-.981-2.628-.981-.996-2.549-.996-1.569 0-2.51 1.012-.941 1.012-.941 2.644 0 1.632.949 2.652zm37.57-7.314V33.89h-2.667V21.933H97.12V19.72h2.573v-3.342q0-2.346 1.173-3.512 1.157-1.149 3.455-1.149.863 0 1.506.126v2.213q-.361-.094-1.035-.094-1.114 0-1.647.439-.533.439-.659 1.028-.126.588-.126 1.467v2.825h3.467v2.213h-3.467zm46.559 0V33.89h-2.667V21.933h-2.761V19.72h2.761v-3.766h2.667v3.766h2.792v2.213h-2.792zm-34.235 12.349q1.836 0 3.295-.792 1.459-.792 2.165-2.111v2.511h2.51V19.72h-2.212l-.235 2.275c-.513-.837-1.229-1.496-2.149-1.977s-1.982-.722-3.185-.722q-2.024 0-3.577.934-1.553.934-2.439 2.652-.886 1.718-.886 3.962 0 2.197.847 3.884c.565 1.125 1.357 1.998 2.377 2.621q1.53.934 3.491.934zm19.369 0c1.778 0 3.292-.473 4.542-1.42a5.72 5.72 0 0 0 2.267-3.727h-2.73c-.188.837-.659 1.512-1.412 2.024s-1.663.769-2.73.769q-2.149 0-3.373-1.404-1.224-1.404-1.224-3.711c0-1.601.424-2.861 1.271-3.782q1.271-1.381 3.326-1.381c1.067 0 1.972.251 2.714.753a3.35 3.35 0 0 1 1.428 2.071h2.73c-.251-1.59-.999-2.851-2.243-3.782s-2.777-1.397-4.597-1.397q-2.149 0-3.804.934-1.655.934-2.589 2.636-.934 1.703-.934 3.915 0 2.228.918 3.931c.612 1.135 1.475 2.014 2.589 2.636q1.671.934 3.851.934zm27.646 0c1.485 0 2.806-.327 3.961-.981s2.06-1.551 2.714-2.691.981-2.406.981-3.797c0-1.412-.322-2.686-.965-3.821q-.965-1.703-2.722-2.699-1.757-.996-3.969-.996-2.212 0-3.946.996c-1.156.664-2.055 1.564-2.698 2.699s-.965 2.409-.965 3.821c0 1.402.327 2.67.981 3.805s1.558 2.03 2.714 2.683 2.46.981 3.914.981zm31.591-1.193q-1.545 1.193-4.134 1.193c-1.653 0-3.01-.398-4.071-1.193a4.1 4.1 0 0 1-1.718-3.154h2.604q.094 1.098.941 1.695c.565.398 1.313.596 2.244.596.92 0 1.637-.183 2.149-.549s.769-.884.769-1.553c0-.659-.204-1.132-.612-1.42s-.931-.5-1.569-.636l-2.51-.581c-1.245-.282-2.162-.758-2.753-1.428s-.886-1.485-.886-2.448c0-1.308.494-2.354 1.483-3.138s2.272-1.177 3.851-1.177q2.416 0 3.914 1.208 1.498 1.208 1.561 3.201h-2.604c-.021-.732-.301-1.308-.839-1.726q-.808-.628-2.063-.628c-.795 0-1.425.178-1.891.534q-.698.534-.698 1.491c0 .596.186 1.03.557 1.302q.557.408 1.467.596l2.855.643q1.773.392 2.636 1.436.863 1.044.863 2.519c0 1.349-.515 2.422-1.545 3.217zm-17.243.8v-7.642c0-1.349.348-2.406 1.043-3.17q1.043-1.146 2.973-1.146.643 0 1.004.063v-2.275a7.01 7.01 0 0 0-1.349-.126c-.879 0-1.65.196-2.314.588q-.996.588-1.357 1.687l-.314-2.15h-2.353v14.17h2.667zm-17.831-3.436c.91.962 2.071 1.444 3.483 1.444q2.181 0 3.553-1.444c.915-.963 1.373-2.176 1.373-3.641 0-1.475-.455-2.699-1.365-3.672q-1.365-1.459-3.561-1.459c-1.412 0-2.573.486-3.483 1.459s-1.365 2.197-1.365 3.672c0 1.465.455 2.678 1.365 3.641zm-46.261.008q1.255 1.404 3.31 1.404c1.391 0 2.515-.465 3.373-1.397s1.286-2.181 1.286-3.75q0-2.275-1.271-3.64-1.271-1.365-3.326-1.365-2.118 0-3.373 1.397-1.255 1.397-1.255 3.672 0 2.275 1.255 3.68z" fill="#2f2f2f" fill-rule="evenodd"/><g fill="#f4604e"><path d="M13.675 22.009c1.377 0 2.494 2.151 2.494 3.542 0 1.367-1.079 3.587-2.424 3.624l-.07.001S.806 26.942.806 25.551c0-1.367 12.869-3.542 12.869-3.542zm37.609 3.542c0 1.367-12.949 3.542-12.949 3.542-1.333 0-2.413-2.151-2.413-3.542 0-1.367 1.044-3.254 2.346-3.292 0 0 13.017 1.901 13.017 3.292zM22.503 37.924c0-1.377 2.151-2.494 3.542-2.494 1.367 0 3.504 1.079 3.541 2.424l.001.07s-2.151 12.869-3.542 12.869c-1.367 0-3.542-12.869-3.542-12.869zM26.045.308c1.367 0 3.542 12.949 3.542 12.949 0 1.333-2.151 2.413-3.542 2.413-1.367 0-3.504-1.044-3.541-2.346l-.001-.068S24.654.308 26.045.308zm-7.637 29.777c.677-.677 2.123-.33 2.779.326.644.644 1.003 2.065.359 2.744l-.034.035s-7.227 5.434-7.882 4.778c-.644-.644 4.778-7.883 4.778-7.883zM38.46 13.134c.644.644-4.818 7.922-4.818 7.922-.656.656-2.084.291-2.739-.365-.644-.644-1.021-2.048-.398-2.706l.033-.034s7.266-5.473 7.922-4.818zm-7.883 20.055c-.677-.677-.33-2.123.326-2.779.644-.644 2.065-1.003 2.744-.359l.035.034s5.434 7.227 4.778 7.883c-.644.644-7.882-4.778-7.882-4.778z"/><path d="M13.63 13.134c.644-.644 7.922 4.818 7.922 4.818.656.656.291 2.084-.365 2.739-.644.644-2.048 1.02-2.706.398l-.034-.033s-5.473-7.266-4.818-7.922z"/></g></svg>
\ No newline at end of file
diff --git a/site/static/logos/tetrate.svg b/site/static/logos/tetrate.svg
new file mode 100644
index 000000000..4757482e7
--- /dev/null
+++ b/site/static/logos/tetrate.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="162" height="36" viewBox="0 0 162 36" fill="none">
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M44.9629 11.9229H50.0427V16.9761H56.3238V21.1375H50.0427V28.1724C50.0427 29.3284 50.2143 29.9889 50.6605 30.4843C51.0724 30.9797 51.9648 31.4091 53.2347 31.4091C53.9555 31.4091 54.6419 31.343 55.3284 31.2109L56.1178 35.3724C55.0881 35.6036 54.0241 35.7357 52.9601 35.7357C49.9054 35.7357 47.6744 34.7449 46.3701 33.0935C45.4091 31.8385 44.9629 30.2201 44.9629 27.6109V11.9229ZM84.1253 11.9229H79.0455V27.6109C79.0455 30.2201 79.4917 31.8385 80.4527 33.0935C81.757 34.7449 83.988 35.7357 87.0427 35.7357C88.1067 35.7357 89.1707 35.6036 90.2347 35.3724L89.4453 31.2109C88.7589 31.343 88.0724 31.4091 87.3859 31.4091C86.116 31.4091 85.2236 30.9797 84.8117 30.4843C84.3655 29.9889 84.1939 29.3284 84.1939 28.1724V21.1375H90.475V16.9761H84.1939V11.9229H84.1253ZM67.2727 16.6128C61.6437 16.6128 58.0398 21.0715 58.0398 26.1577C58.0398 31.9045 62.3302 35.6696 67.9935 35.6696C69.4693 35.7027 70.9109 35.4054 72.2495 34.8439C73.5881 34.2825 74.7894 33.4568 75.7847 32.3999L72.9016 29.6256C72.2838 30.2531 71.563 30.7816 70.7393 31.1449C69.9155 31.5082 69.0231 31.7063 68.1308 31.7394C66.8608 31.7724 65.6252 31.343 64.6641 30.5504C63.7031 29.7577 63.1196 28.6017 62.9823 27.3797H76.1623C76.2309 26.9173 76.2653 26.455 76.2653 25.9926C76.2653 20.8733 72.5241 16.6128 67.2727 16.6128ZM63.1883 23.8128C63.3599 22.921 63.8747 22.0953 64.6298 21.5008C65.3849 20.9063 66.3116 20.6091 67.2727 20.6091C68.1994 20.6091 69.0918 20.9394 69.7782 21.5339C70.4647 22.1284 70.9109 22.954 71.0139 23.8128H63.1883ZM98.7124 18.8586V17.0091H93.8042V35.3063H98.884V23.7797C99.3645 23.0201 100.051 22.3595 100.84 21.8972C101.664 21.4348 102.557 21.1706 103.483 21.1375C104.101 21.1375 104.719 21.1706 105.337 21.3357L105.92 16.7779C105.371 16.6788 104.788 16.6458 104.238 16.6458C101.939 16.6128 99.845 17.5045 98.7124 18.8586ZM115.737 16.6128C117.762 16.5797 119.718 17.2403 121.297 18.4623V16.9761H126.205V35.2733H121.297V33.7871C119.821 35.0091 117.968 35.6696 116.011 35.6366C114.638 35.6366 113.3 35.3724 112.064 34.844C110.828 34.3155 109.73 33.5229 108.838 32.5651C107.259 30.7816 106.401 28.5027 106.401 26.1577C106.401 20.7742 110.554 16.6128 115.737 16.6128ZM119.1 30.5834C119.89 30.1871 120.576 29.5926 121.091 28.899H121.16V23.4495C120.61 22.7229 119.924 22.1614 119.1 21.7651C118.276 21.3687 117.384 21.1706 116.457 21.1706C113.471 21.1706 111.549 23.5485 111.549 26.1907C111.515 26.8513 111.618 27.5118 111.858 28.1063C112.098 28.7008 112.442 29.2623 112.922 29.7247C113.368 30.1871 113.952 30.5504 114.57 30.8146C115.187 31.0458 115.84 31.1779 116.526 31.1779C117.418 31.1779 118.311 30.9797 119.1 30.5834ZM134.58 11.9229H129.5V27.6109C129.5 30.2201 129.946 31.8385 130.907 33.0935C132.212 34.7449 134.443 35.7357 137.497 35.7357C138.561 35.7357 139.625 35.6036 140.655 35.3724L139.866 31.2109C139.179 31.343 138.493 31.4091 137.772 31.4091C136.502 31.4091 135.61 30.9797 135.198 30.4843C134.752 29.9889 134.58 29.3284 134.58 28.1724V21.1375H140.861V16.9761H134.58V11.9229ZM150.746 16.6128C155.997 16.6128 159.738 20.8733 159.738 25.9595C159.738 26.3928 159.678 26.8261 159.614 27.2866L159.601 27.3797H146.455C146.593 28.6017 147.176 29.7577 148.137 30.5504C149.098 31.343 150.334 31.7724 151.604 31.7394C152.496 31.7063 153.389 31.5082 154.212 31.1449C155.036 30.7816 155.757 30.2531 156.375 29.6256L159.258 32.3999C158.262 33.4568 157.061 34.2825 155.723 34.8439C154.384 35.4054 152.942 35.7027 151.467 35.6696C145.803 35.6696 141.513 31.9045 141.513 26.1577C141.513 21.0715 145.117 16.6128 150.746 16.6128ZM148.103 21.5008C147.348 22.0953 146.833 22.921 146.661 23.8128H154.487C154.384 22.954 153.938 22.1284 153.251 21.5339C152.565 20.9394 151.673 20.6091 150.746 20.6091C149.785 20.6091 148.858 20.9063 148.103 21.5008Z" fill="#0A0D0F"></path>
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M26.4292 6.83675C28.111 7.79454 30.0674 8.09179 31.9552 7.76151C35.6964 7.29913 38.4079 11.2294 36.4858 14.367C34.6324 17.5377 29.7242 17.2074 28.2826 13.8716C24.8847 5.41656 12.3225 5.41656 8.89024 13.8716C7.48301 17.2074 2.54052 17.5377 0.687086 14.367C-1.20067 11.2294 1.51083 7.29913 5.2177 7.76151C7.10545 8.09179 9.06186 7.76152 10.7437 6.83675C12.4598 5.91198 13.6954 4.45876 14.3476 2.7083C15.8578 -0.891699 21.3151 -0.891699 22.8253 2.7083C23.4774 4.42573 24.7474 5.91198 26.4292 6.83675ZM18.6036 11.3945C22.3448 11.3945 24.5415 15.589 22.2419 18.4955C21.0062 19.8826 20.3198 21.6661 20.3198 23.5487C20.3198 25.3982 21.0062 27.1817 22.2419 28.6019C24.5758 31.5083 22.3448 35.7358 18.6036 35.7028C14.8624 35.7028 12.6658 31.5083 14.9654 28.6019C16.201 27.2147 16.8875 25.4312 16.8875 23.5487C16.8875 21.6991 16.201 19.9156 14.9654 18.4955C12.6315 15.589 14.8624 11.3615 18.6036 11.3945Z" fill="#FF5500"></path>
+</svg>
diff --git a/tools/helm-docs/api.gotmpl b/tools/helm-docs/api.gotmpl
new file mode 100644
index 000000000..4c12c157c
--- /dev/null
+++ b/tools/helm-docs/api.gotmpl
@@ -0,0 +1,21 @@
++++
+title = "Gateway Helm Chart"
++++
+
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.badgesSection" . }}
+
+{{ template "chart.description" . }}
+
+{{ template "chart.homepageLine" . }}
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}
+
+{{ template "helm-docs.versionFooter" . }}
diff --git a/tools/helm-docs/readme.gotmpl b/tools/helm-docs/readme.gotmpl
new file mode 100644
index 000000000..0f892587f
--- /dev/null
+++ b/tools/helm-docs/readme.gotmpl
@@ -0,0 +1,56 @@
+{{ template "chart.header" . }}
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.badgesSection" . }}
+
+{{ template "chart.description" . }}
+
+{{ template "chart.homepageLine" . }}
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+## Usage
+
+[Helm](https://helm.sh) must be installed to use the charts.  Please refer to
+Helm's [documentation](https://helm.sh/docs) to get started.
+
+### Install from DockerHub
+
+Once Helm has been set up correctly, install the chart from dockerhub:
+
+``` shell
+  helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace
+```
+You can find all helm chart release in [Dockerhub](https://hub.docker.com/r/envoyproxy/gateway-helm/tags)
+
+### Install from Source Code
+
+You can also install the helm chart from the source code:
+
+To install the eg chart along with Gateway API CRDs and Envoy Gateway CRDs:
+
+``` shell
+    make kube-deploy TAG=latest
+```
+
+### Skip install CRDs
+
+You can install the eg chart along without Gateway API CRDs and Envoy Gateway CRDs, make sure CRDs exist in Cluster first if you want to skip to install them, otherwise EG may fail to start:
+
+``` shell
+    helm install eg --create-namespace oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --skip-crds
+```
+
+To uninstall the chart:
+
+``` shell
+    helm delete eg
+```
+
+{{ template "chart.valuesSection" . }}
+
+{{ template "helm-docs.versionFooter" . }}
diff --git a/tools/make/docs.mk b/tools/make/docs.mk
index 4cec8e458..bd2c273cc 100644
--- a/tools/make/docs.mk
+++ b/tools/make/docs.mk
@@ -38,8 +38,9 @@ docs-api: docs-api-gen helm-readme-gen docs-api-headings
 helm-readme-gen: $(tools/helm-docs)
 	@$(LOG_TARGET)
 	@ImageRepository=docker.io/envoyproxy/gateway ImageTag=latest ImagePullPolicy=IfNotPresent envsubst < charts/gateway-helm/values.tmpl.yaml > ./charts/gateway-helm/values.yaml # use production ENV to generate helm api doc
-	$(tools/helm-docs) charts/gateway-helm/ -f values.yaml -o api.md
-	mv charts/gateway-helm/api.md site/content/en/latest/install/api.md
+	$(tools/helm-docs) --template-files=tools/helm-docs/readme.gotmpl charts/gateway-helm/ -f values.yaml -o README.md
+	$(tools/helm-docs) --template-files=tools/helm-docs/api.gotmpl charts/gateway-helm/ -f values.yaml -o api.md
+	mv charts/gateway-helm/api.md site/content/en/latest/install/gateway-helm-api.md
 
 .PHONY: docs-api-gen
 docs-api-gen: $(tools/crd-ref-docs)
@@ -56,7 +57,6 @@ docs-api-gen: $(tools/crd-ref-docs)
 docs-api-headings:
 	@$(LOG_TARGET)
 	tools/hack/docs-headings.sh site/content/en/latest/api/extension_types.md
-	tools/hack/docs-headings.sh site/content/en/latest/install/api.md
 
 .PHONY: docs-release-prepare
 docs-release-prepare:
diff --git a/tools/src/buf/go.mod b/tools/src/buf/go.mod
index 2041c8a10..975b6ba7d 100644
--- a/tools/src/buf/go.mod
+++ b/tools/src/buf/go.mod
@@ -2,7 +2,7 @@ module local
 
 go 1.22.3
 
-require github.com/bufbuild/buf v1.32.0
+require github.com/bufbuild/buf v1.32.1
 
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 // indirect
diff --git a/tools/src/buf/go.sum b/tools/src/buf/go.sum
index e998de677..b98688e6c 100644
--- a/tools/src/buf/go.sum
+++ b/tools/src/buf/go.sum
@@ -15,8 +15,8 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
-github.com/bufbuild/buf v1.32.0 h1:ycoJJzTFvpUV1+Hewcv0lja+OPzmVjORmvmL+Dxy9Sg=
-github.com/bufbuild/buf v1.32.0/go.mod h1:trWT7vC+ujoZayhIVBOoU8JEOUVxWDFNs4+ixc5bLEA=
+github.com/bufbuild/buf v1.32.1 h1:EsGUKtT1IFRAVS52v/OYcmvUAZ3o6hb6GoEOLM7WSlU=
+github.com/bufbuild/buf v1.32.1/go.mod h1:trWT7vC+ujoZayhIVBOoU8JEOUVxWDFNs4+ixc5bLEA=
 github.com/bufbuild/protocompile v0.13.1-0.20240510201809-752249dfc37f h1:cQLFPZXf32tbTLzUTg0n69Vi5kddhUiZMzpMzKRW0XU=
 github.com/bufbuild/protocompile v0.13.1-0.20240510201809-752249dfc37f/go.mod h1:QJcgsTVPSBEMt+/3i2M/RpwjZc+DAXyPPDg0slmMk4c=
 github.com/bufbuild/protoplugin v0.0.0-20240323223605-e2735f6c31ee h1:E6ET8YUcYJ1lAe6ctR3as7yqzW2BNItDFnaB5zQq/8M=
diff --git a/tools/src/golangci-lint/go.mod b/tools/src/golangci-lint/go.mod
index ea08b5a8e..1ced182b8 100644
--- a/tools/src/golangci-lint/go.mod
+++ b/tools/src/golangci-lint/go.mod
@@ -2,7 +2,7 @@ module local
 
 go 1.22.3
 
-require github.com/golangci/golangci-lint v1.58.2
+require github.com/golangci/golangci-lint v1.59.0
 
 require (
 	4d63.com/gocheckcompilerdirectives v1.2.1 // indirect
@@ -11,8 +11,8 @@ require (
 	github.com/Abirdcfly/dupword v0.0.14 // indirect
 	github.com/Antonboom/errname v0.1.13 // indirect
 	github.com/Antonboom/nilnil v0.1.9 // indirect
-	github.com/Antonboom/testifylint v1.2.0 // indirect
-	github.com/BurntSushi/toml v1.3.2 // indirect
+	github.com/Antonboom/testifylint v1.3.0 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/Crocmagnon/fatcontext v0.2.2 // indirect
 	github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
 	github.com/GaijinEntertainment/go-exhaustruct/v3 v3.2.0 // indirect
@@ -49,7 +49,7 @@ require (
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
 	github.com/ghostiam/protogetter v0.3.6 // indirect
-	github.com/go-critic/go-critic v0.11.3 // indirect
+	github.com/go-critic/go-critic v0.11.4 // indirect
 	github.com/go-toolsmith/astcast v1.1.0 // indirect
 	github.com/go-toolsmith/astcopy v1.1.0 // indirect
 	github.com/go-toolsmith/astequal v1.2.0 // indirect
@@ -75,7 +75,7 @@ require (
 	github.com/gostaticanalysis/comment v1.4.2 // indirect
 	github.com/gostaticanalysis/forcetypeassert v0.1.0 // indirect
 	github.com/gostaticanalysis/nilerr v0.1.1 // indirect
-	github.com/hashicorp/go-version v1.6.0 // indirect
+	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -133,7 +133,7 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
 	github.com/sashamelentyev/usestdlibvars v1.25.0 // indirect
-	github.com/securego/gosec/v2 v2.20.0 // indirect
+	github.com/securego/gosec/v2 v2.20.1-0.20240525090044-5f0084eb01a9 // indirect
 	github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
@@ -167,7 +167,7 @@ require (
 	github.com/ykadowak/zerologlint v0.1.5 // indirect
 	gitlab.com/bosi/decorder v0.4.2 // indirect
 	go-simpler.org/musttag v0.12.2 // indirect
-	go-simpler.org/sloglint v0.6.0 // indirect
+	go-simpler.org/sloglint v0.7.0 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/automaxprocs v1.5.3 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
diff --git a/tools/src/golangci-lint/go.sum b/tools/src/golangci-lint/go.sum
index 9800dac8d..be04ca737 100644
--- a/tools/src/golangci-lint/go.sum
+++ b/tools/src/golangci-lint/go.sum
@@ -35,7 +35,6 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/4meepo/tagalign v1.3.3/go.mod h1:Q9c1rYMZJc9dPRkbQPpcBNCLEmY2njbAsXhQOZFE2dE=
 github.com/4meepo/tagalign v1.3.4 h1:P51VcvBnf04YkHzjfclN6BbsopfJR5rxs1n+5zHt+w8=
 github.com/4meepo/tagalign v1.3.4/go.mod h1:M+pnkHH2vG8+qhE5bVc/zeP7HS/j910Fwa9TUSyZVI0=
 github.com/Abirdcfly/dupword v0.0.14 h1:3U4ulkc8EUo+CaT105/GJ1BQwtgyj6+VaBVbAX11Ba8=
@@ -44,11 +43,11 @@ github.com/Antonboom/errname v0.1.13 h1:JHICqsewj/fNckzrfVSe+T33svwQxmjC+1ntDsHO
 github.com/Antonboom/errname v0.1.13/go.mod h1:uWyefRYRN54lBg6HseYCFhs6Qjcy41Y3Jl/dVhA87Ns=
 github.com/Antonboom/nilnil v0.1.9 h1:eKFMejSxPSA9eLSensFmjW2XTgTwJMjZ8hUHtV4s/SQ=
 github.com/Antonboom/nilnil v0.1.9/go.mod h1:iGe2rYwCq5/Me1khrysB4nwI7swQvjclR8/YRPl5ihQ=
-github.com/Antonboom/testifylint v1.2.0 h1:015bxD8zc5iY8QwTp4+RG9I4kIbqwvGX9TrBbb7jGdM=
-github.com/Antonboom/testifylint v1.2.0/go.mod h1:rkmEqjqVnHDRNsinyN6fPSLnoajzFwsCcguJgwADBkw=
+github.com/Antonboom/testifylint v1.3.0 h1:UiqrddKs1W3YK8R0TUuWwrVKlVAnS07DTUVWWs9c+y4=
+github.com/Antonboom/testifylint v1.3.0/go.mod h1:NV0hTlteCkViPW9mSR4wEMfwp+Hs1T3dY60bkvSfhpM=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
-github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
+github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Crocmagnon/fatcontext v0.2.2 h1:OrFlsDdOj9hW/oBEJBNSuH7QWf+E9WPVHw+x52bXVbk=
 github.com/Crocmagnon/fatcontext v0.2.2/go.mod h1:WSn/c/+MMNiD8Pri0ahRj0o9jVpeowzavOQplBJw6u0=
@@ -148,11 +147,10 @@ github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwV
 github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
 github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
-github.com/ghostiam/protogetter v0.3.5/go.mod h1:7lpeDnEJ1ZjL/YtyoN99ljO4z0pd3H0d18/t2dPBxHw=
 github.com/ghostiam/protogetter v0.3.6 h1:R7qEWaSgFCsy20yYHNIJsU9ZOb8TziSRRxuAOTVKeOk=
 github.com/ghostiam/protogetter v0.3.6/go.mod h1:7lpeDnEJ1ZjL/YtyoN99ljO4z0pd3H0d18/t2dPBxHw=
-github.com/go-critic/go-critic v0.11.3 h1:SJbYD/egY1noYjTMNTlhGaYlfQ77rQmrNH7h+gtn0N0=
-github.com/go-critic/go-critic v0.11.3/go.mod h1:Je0h5Obm1rR5hAGA9mP2PDiOOk53W+n7pyvXErFKIgI=
+github.com/go-critic/go-critic v0.11.4 h1:O7kGOCx0NDIni4czrkRIXTnit0mkyKOCePh3My6OyEU=
+github.com/go-critic/go-critic v0.11.4/go.mod h1:2QAdo4iuLik5S9YG0rT4wcZ8QxwHYkrr6/2MWAiv/vc=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -228,8 +226,8 @@ github.com/golangci/dupl v0.0.0-20180902072040-3e9179ac440a h1:w8hkcTqaFpzKqonE9
 github.com/golangci/dupl v0.0.0-20180902072040-3e9179ac440a/go.mod h1:ryS0uhF+x9jgbj/N71xsEqODy9BN81/GonCZiOzirOk=
 github.com/golangci/gofmt v0.0.0-20231018234816-f50ced29576e h1:ULcKCDV1LOZPFxGZaA6TlQbiM3J2GCPnkx/bGF6sX/g=
 github.com/golangci/gofmt v0.0.0-20231018234816-f50ced29576e/go.mod h1:Pm5KhLPA8gSnQwrQ6ukebRcapGb/BG9iUkdaiCcGHJM=
-github.com/golangci/golangci-lint v1.58.2 h1:YHfceEW3CmHmJTPkmVNlqEa4xcjIulYIaVIiB5sNbC4=
-github.com/golangci/golangci-lint v1.58.2/go.mod h1:QH/aRLQIdNuOqEiki+4En6/k2SmeOsRJU/oiYffM1Ow=
+github.com/golangci/golangci-lint v1.59.0 h1:st69YDnAH/v2QXDcgUaZ0seQajHScPALBVkyitYLXEk=
+github.com/golangci/golangci-lint v1.59.0/go.mod h1:QNA32UWdUdHXnu+Ap5/ZU4WVwyp2tL94UxEXrSErjg0=
 github.com/golangci/misspell v0.5.1 h1:/SjR1clj5uDjNLwYzCahHwIOPmQgoH04AyQIiWGbhCM=
 github.com/golangci/misspell v0.5.1/go.mod h1:keMNyY6R9isGaSAu+4Q8NMBwMPkh15Gtc8UCVoDtAWo=
 github.com/golangci/modinfo v0.3.4 h1:oU5huX3fbxqQXdfspamej74DFX0kyGLkw1ppvXoJ8GA=
@@ -286,8 +284,8 @@ github.com/gostaticanalysis/testutil v0.3.1-0.20210208050101-bfb5c8eec0e4/go.mod
 github.com/gostaticanalysis/testutil v0.4.0 h1:nhdCmubdmDF6VEatUNjgUZBJKWRqugoISdUv3PPQgHY=
 github.com/gostaticanalysis/testutil v0.4.0/go.mod h1:bLIoPefWXrRi/ssLFWX1dx7Repi5x3CuviD3dgAZaBU=
 github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
-github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
@@ -397,8 +395,8 @@ github.com/nunnatsa/ginkgolinter v0.16.2 h1:8iLqHIZvN4fTLDC0Ke9tbSZVcyVHoBs0HIbn
 github.com/nunnatsa/ginkgolinter v0.16.2/go.mod h1:4tWRinDN1FeJgU+iJANW/kz7xKN5nYRAOfJDQUS9dOQ=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/ginkgo/v2 v2.17.2 h1:7eMhcy3GimbsA3hEnVKdw/PQM9XN9krpKVXsZdph0/g=
-github.com/onsi/ginkgo/v2 v2.17.2/go.mod h1:nP2DPOQoNsQmsVyv5rDA8JkXQoCs6goXIvr/PRJ1eCc=
+github.com/onsi/ginkgo/v2 v2.17.3 h1:oJcvKpIb7/8uLpDDtnQuf18xVnwKp8DTD7DQ6gTd/MU=
+github.com/onsi/ginkgo/v2 v2.17.3/go.mod h1:nP2DPOQoNsQmsVyv5rDA8JkXQoCs6goXIvr/PRJ1eCc=
 github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
 github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
@@ -470,8 +468,8 @@ github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tM
 github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
 github.com/sashamelentyev/usestdlibvars v1.25.0 h1:IK8SI2QyFzy/2OD2PYnhy84dpfNo9qADrRt6LH8vSzU=
 github.com/sashamelentyev/usestdlibvars v1.25.0/go.mod h1:9nl0jgOfHKWNFS43Ojw0i7aRoS4j6EBye3YBhmAIRF8=
-github.com/securego/gosec/v2 v2.20.0 h1:z/d5qp1niWa2avgFyUIglYTYYuGq2LrJwNj1HRVXsqc=
-github.com/securego/gosec/v2 v2.20.0/go.mod h1:hkiArbBZLwK1cehBcg3oFWUlYPWTBffPwwJVWChu83o=
+github.com/securego/gosec/v2 v2.20.1-0.20240525090044-5f0084eb01a9 h1:rnO6Zp1YMQwv8AyxzuwsVohljJgp4L0ZqiCgtACsPsc=
+github.com/securego/gosec/v2 v2.20.1-0.20240525090044-5f0084eb01a9/go.mod h1:dg7lPlu/xK/Ut9SedURCoZbVCR4yC7fM65DtH9/CDHs=
 github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c h1:W65qqJCIOVP4jpqPQ0YvHYKwcMEMVWIzWC5iNQQfBTU=
 github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c/go.mod h1:/PevMnwAxekIXwN8qQyfc5gl2NlkB3CQlkizAbOkeBs=
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
@@ -568,8 +566,8 @@ go-simpler.org/assert v0.9.0 h1:PfpmcSvL7yAnWyChSjOz6Sp6m9j5lyK8Ok9pEL31YkQ=
 go-simpler.org/assert v0.9.0/go.mod h1:74Eqh5eI6vCK6Y5l3PI8ZYFXG4Sa+tkr70OIPJAUr28=
 go-simpler.org/musttag v0.12.2 h1:J7lRc2ysXOq7eM8rwaTYnNrHd5JwjppzB6mScysB2Cs=
 go-simpler.org/musttag v0.12.2/go.mod h1:uN1DVIasMTQKk6XSik7yrJoEysGtR2GRqvWnI9S7TYM=
-go-simpler.org/sloglint v0.6.0 h1:0YcqSVG7LI9EVBfRPhgPec79BH6X6mwjFuUR5Mr7j1M=
-go-simpler.org/sloglint v0.6.0/go.mod h1:+kJJtebtPePWyG5boFwY46COydAggADDOHM22zOvzBk=
+go-simpler.org/sloglint v0.7.0 h1:rMZRxD9MbaGoRFobIOicMxZzum7AXNFDlez6xxJs5V4=
+go-simpler.org/sloglint v0.7.0/go.mod h1:g9SXiSWY0JJh4LS39/Q0GxzP/QX2cVcbTOYhDpXrJEs=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -754,7 +752,6 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -839,7 +836,6 @@ golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
 golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.5.0/go.mod h1:N+Kgy78s5I24c24dU8OfWNEotWjutIs8SnJvn5IDq+k=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
 golang.org/x/tools v0.21.0 h1:qc0xYgIbsSDt9EyWz05J5wfa7LOVW0YTLOXrqdLAWIw=
 golang.org/x/tools v0.21.0/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=


Test patch:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.in.yaml
new file mode 100644
index 000000000..e36258312
--- /dev/null
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.in.yaml
@@ -0,0 +1,171 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo1
+          backendRefs:
+            - name: service-1
+              port: 8080
+        - matches:
+            - path:
+                value: /foo2
+          backendRefs:
+            - name: service-2
+              port: 8080
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-2
+    spec:
+      hostnames:
+        - www.bar.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /bar
+          backendRefs:
+            - name: service-3
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: envoy-gateway
+      name: http-backend
+    spec:
+      ports:
+        - port: 80
+          name: http
+          protocol: TCP
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: default
+      name: grpc-backend
+    spec:
+      ports:
+        - port: 9000
+          name: grpc
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: envoy-gateway
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 80
+    endpoints:
+      - addresses:
+          - 7.7.7.7
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-grpc-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: grpc-backend
+    addressType: IPv4
+    ports:
+      - name: grpc
+        protocol: TCP
+        port: 9000
+    endpoints:
+      - addresses:
+          - 8.8.8.8
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: envoy-gateway
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.envoyproxy.io
+          kind: SecurityPolicy
+          namespace: default
+      to:
+        - group: ''
+          kind: Service
+securityPolicies:
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-http-route-1
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+      extAuth:
+        failOpen: true
+        headersToExtAuth:
+          - header1
+          - header2
+        grpc:
+          backendRef:
+            name: grpc-backend
+            port: 9000
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway-1          # This will only apply to the httproute-2
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+      extAuth:
+        failOpen: false
+        http:
+          backendRef:
+            Name: http-backend
+            Namespace: envoy-gateway
+            Port: 80
+          Path: /auth
+          headersToBackend:
+            - header1
+            - header2
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml
new file mode 100755
index 000000000..4d7686f8f
--- /dev/null
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml
@@ -0,0 +1,337 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo1
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /foo2
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-3
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route-1
+    namespace: default
+  spec:
+    extAuth:
+      failOpen: true
+      grpc:
+        backendRef:
+          name: grpc-backend
+          port: 9000
+      headersToExtAuth:
+      - header1
+      - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: default
+  spec:
+    extAuth:
+      failOpen: false
+      http:
+        backendRef:
+          name: http-backend
+          namespace: envoy-gateway
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+        path: /auth
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo1
+        security:
+          extAuth:
+            failOpen: true
+            grpc:
+              authority: grpc-backend.default:9000
+              destination:
+                name: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
+                settings:
+                - addressType: IP
+                  endpoints:
+                  - host: 8.8.8.8
+                    port: 9000
+                  protocol: GRPC
+                  weight: 1
+            headersToExtAuth:
+            - header1
+            - header2
+            name: securitypolicy/default/policy-for-http-route-1
+      - destination:
+          name: httproute/default/httproute-1/rule/1
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/1/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo2
+        security:
+          extAuth:
+            failOpen: true
+            grpc:
+              authority: grpc-backend.default:9000
+              destination:
+                name: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
+                settings:
+                - addressType: IP
+                  endpoints:
+                  - host: 8.8.8.8
+                    port: 9000
+                  protocol: GRPC
+                  weight: 1
+            headersToExtAuth:
+            - header1
+            - header2
+            name: securitypolicy/default/policy-for-http-route-1
+      - destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
+        security:
+          extAuth:
+            failOpen: false
+            http:
+              authority: http-backend.envoy-gateway:80
+              destination:
+                name: securitypolicy/default/policy-for-gateway-1/envoy-gateway/http-backend
+                settings:
+                - addressType: IP
+                  endpoints:
+                  - host: 7.7.7.7
+                    port: 80
+                  protocol: HTTP
+                  weight: 1
+              headersToBackend:
+              - header1
+              - header2
+              path: /auth
+            name: securitypolicy/default/policy-for-gateway-1
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml
index 1ffcb3027..d562b1c7e 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml
@@ -55,10 +55,10 @@ securityPolicies:
         name: gateway-1
       extAuth:
         http:
-          backendRef:
-            name: http-backend
-            namespace: default
-            port: 80
+          backendRefs:
+            - name: http-backend
+              namespace: default
+              port: 80
           headersToBackend:
             - header1
             - header2
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
index 582db7cf2..14bbc4ea0 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
@@ -105,8 +105,8 @@ securityPolicies:
     extAuth:
       failOpen: false
       http:
-        backendRef:
-          name: http-backend
+        backendRefs:
+        - name: http-backend
           namespace: default
           port: 80
         headersToBackend:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml
index 75c777585..3f743d180 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml
@@ -55,9 +55,9 @@ securityPolicies:
         name: gateway-1
       extAuth:
         http:
-          backendRef:
-            name: http-backend
-            namespace: default
+          backendRefs:
+            - name: http-backend
+              namespace: default
           headersToBackend:
             - header1
             - header2
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
index fa9d38b25..f7cbe8322 100755
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
@@ -105,8 +105,8 @@ securityPolicies:
     extAuth:
       failOpen: false
       http:
-        backendRef:
-          name: http-backend
+        backendRefs:
+        - name: http-backend
           namespace: default
         headersToBackend:
         - header1
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml
index c0397d678..06cb84324 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml
@@ -55,10 +55,10 @@ securityPolicies:
         name: gateway-1
       extAuth:
         http:
-          backendRef:
-            name: http-backend
-            namespace: envoy-gateway
-            port: 80
+          backendRefs:
+            - name: http-backend
+              namespace: envoy-gateway
+              port: 80
           headersToBackend:
             - header1
             - header2
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
index 9afc90b09..e1317710c 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
@@ -105,8 +105,8 @@ securityPolicies:
     extAuth:
       failOpen: false
       http:
-        backendRef:
-          name: http-backend
+        backendRefs:
+        - name: http-backend
           namespace: envoy-gateway
           port: 80
         headersToBackend:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml
index 3c2fba3e7..e47a1b0f5 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml
@@ -46,10 +46,10 @@ securityPolicies:
         name: gateway-1
       extAuth:
         http:
-          backendRef:
-            name: http-backend
-            namespace: default
-            port: 80
+          backendRefs:
+            - name: http-backend
+              namespace: default
+              port: 80
           headersToBackend:
             - header1
             - header2
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
index cc079ddf6..fba4578b3 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
@@ -105,8 +105,8 @@ securityPolicies:
     extAuth:
       failOpen: false
       http:
-        backendRef:
-          name: http-backend
+        backendRefs:
+        - name: http-backend
           namespace: default
           port: 80
         headersToBackend:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml
index 669e9443f..d2aee51b2 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml
@@ -197,10 +197,10 @@ securityPolicies:
         name: gateway-1
       extAuth:
         http:
-          backendRef:
-            Name: http-backend
-            Namespace: envoy-gateway
-            Port: 80
+          backendRefs:
+            - Name: http-backend
+              Namespace: envoy-gateway
+              Port: 80
           Path: /auth
           headersToBackend:
             - header1
@@ -221,7 +221,7 @@ securityPolicies:
           - header1
           - header2
         grpc:
-          backendRef:
-            name: grpc-backend
-            port: 9000
+          backendRefs:
+            - name: grpc-backend
+              port: 9000
         failOpen: true
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
index 6ac00a0e5..b750c2d61 100755
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
@@ -208,8 +208,8 @@ securityPolicies:
     extAuth:
       failOpen: true
       grpc:
-        backendRef:
-          name: grpc-backend
+        backendRefs:
+        - name: grpc-backend
           port: 9000
       headersToExtAuth:
       - header1
@@ -243,8 +243,8 @@ securityPolicies:
     extAuth:
       failOpen: false
       http:
-        backendRef:
-          name: http-backend
+        backendRefs:
+        - name: http-backend
           namespace: envoy-gateway
           port: 80
         headersToBackend:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth.in.yaml
index e36258312..ada3900ed 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth.in.yaml
@@ -126,7 +126,7 @@ referenceGrants:
           kind: SecurityPolicy
           namespace: default
       to:
-        - group: ''
+        - group: ""
           kind: Service
 securityPolicies:
   - apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -145,14 +145,15 @@ securityPolicies:
           - header1
           - header2
         grpc:
-          backendRef:
-            name: grpc-backend
-            port: 9000
+          backendRefs:
+            - name: grpc-backend
+              port: 9000
   - apiVersion: gateway.envoyproxy.io/v1alpha1
     kind: SecurityPolicy
     metadata:
       namespace: default
-      name: policy-for-gateway-1          # This will only apply to the httproute-2
+      # This will only apply to the httproute-2
+      name: policy-for-gateway-1
     spec:
       targetRef:
         group: gateway.networking.k8s.io
@@ -161,10 +162,10 @@ securityPolicies:
       extAuth:
         failOpen: false
         http:
-          backendRef:
-            Name: http-backend
-            Namespace: envoy-gateway
-            Port: 80
+          backendRefs:
+            - Name: http-backend
+              Namespace: envoy-gateway
+              Port: 80
           Path: /auth
           headersToBackend:
             - header1
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
index 4d7686f8f..2e0ca0067 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
@@ -149,8 +149,8 @@ securityPolicies:
     extAuth:
       failOpen: true
       grpc:
-        backendRef:
-          name: grpc-backend
+        backendRefs:
+        - name: grpc-backend
           port: 9000
       headersToExtAuth:
       - header1
@@ -184,8 +184,8 @@ securityPolicies:
     extAuth:
       failOpen: false
       http:
-        backendRef:
-          name: http-backend
+        backendRefs:
+        - name: http-backend
           namespace: envoy-gateway
           port: 80
         headersToBackend:
diff --git a/internal/provider/kubernetes/predicates_test.go b/internal/provider/kubernetes/predicates_test.go
index f5416c198..c7b6054e5 100644
--- a/internal/provider/kubernetes/predicates_test.go
+++ b/internal/provider/kubernetes/predicates_test.go
@@ -595,8 +595,12 @@ func TestValidateServiceForReconcile(t *testing.T) {
 						},
 						ExtAuth: &v1alpha1.ExtAuth{
 							HTTP: &v1alpha1.HTTPExtAuthService{
-								BackendRef: gwapiv1.BackendObjectReference{
-									Name: "ext-auth-http-service",
+								BackendRefs: []v1alpha1.BackendRef{
+									{
+										BackendObjectReference: gwapiv1.BackendObjectReference{
+											Name: "ext-auth-http-service",
+										},
+									},
 								},
 							},
 						},
@@ -606,6 +610,37 @@ func TestValidateServiceForReconcile(t *testing.T) {
 			service: test.GetService(types.NamespacedName{Name: "ext-auth-http-service"}, nil, nil),
 			expect:  true,
 		},
+		{
+			name: "service referenced by SecurityPolicy ExtAuth GRPC service",
+			configs: []client.Object{
+				&v1alpha1.SecurityPolicy{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "ext-auth-http",
+					},
+					Spec: v1alpha1.SecurityPolicySpec{
+						TargetRef: gwapiv1a2.LocalPolicyTargetReferenceWithSectionName{
+							LocalPolicyTargetReference: gwapiv1a2.LocalPolicyTargetReference{
+								Kind: "Gateway",
+								Name: "scheduled-status-test",
+							},
+						},
+						ExtAuth: &v1alpha1.ExtAuth{
+							GRPC: &v1alpha1.GRPCExtAuthService{
+								BackendRefs: []v1alpha1.BackendRef{
+									{
+										BackendObjectReference: gwapiv1.BackendObjectReference{
+											Name: "ext-auth-grpc-service",
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			service: test.GetService(types.NamespacedName{Name: "ext-auth-grpc-service"}, nil, nil),
+			expect:  true,
+		},
 		{
 			name: "service referenced by EnvoyExtensionPolicy ExtPrc GRPC service",
 			configs: []client.Object{
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index b4bfec6a2..d28b28339 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -284,6 +284,8 @@ BackendRef defines how an ObjectReference that is specific to BackendRef.
 _Appears in:_
 - [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog)
 - [ExtProc](#extproc)
+- [GRPCExtAuthService](#grpcextauthservice)
+- [HTTPExtAuthService](#httpextauthservice)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -1589,7 +1591,8 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Only service Kind is supported for now. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Only service Kind is supported for now.<br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Only service Kind is supported for now. |
 
 
 #### Gateway
@@ -1751,7 +1754,8 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Only service Kind is supported for now. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Only service Kind is supported for now.<br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Only service Kind is supported for now. |
 | `path` | _string_ |  true  | Path is the path of the HTTP External Authorization service.<br />If path is specified, the authorization request will be sent to that path,<br />or else the authorization request will be sent to the root path. |
 | `headersToBackend` | _string array_ |  false  | HeadersToBackend are the authorization response headers that will be added<br />to the original client request before sending it to the backend server.<br />Note that coexisting headers will be overridden.<br />If not specified, no authorization response headers will be added to the<br />original client request. |
 
diff --git a/site/content/en/latest/install/api.md b/site/content/en/latest/install/gateway-helm-api.md
similarity index 93%
rename from site/content/en/latest/install/api.md
rename to site/content/en/latest/install/gateway-helm-api.md
index b5d318e22..7dbf2a58a 100644
--- a/site/content/en/latest/install/api.md
+++ b/site/content/en/latest/install/gateway-helm-api.md
@@ -1,8 +1,7 @@
 +++
-title = "gateway-helm"
+title = "Gateway Helm Chart"
 +++
 
-
 ![Version: v0.0.0-latest](https://img.shields.io/badge/Version-v0.0.0--latest-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
 
 The Helm chart for Envoy Gateway
@@ -56,8 +55,10 @@ The Helm chart for Envoy Gateway
 | deployment.ports[2].targetPort | int | `19001` |  |
 | deployment.replicas | int | `1` |  |
 | global.images.envoyGateway.image | string | `nil` |  |
-| global.images.envoyGateway.imagePullSecrets | list | `[]` |  |
 | global.images.envoyGateway.pullPolicy | string | `nil` |  |
+| global.images.envoyGateway.pullSecrets | list | `[]` |  |
 | global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` |  |
+| global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` |  |
+| global.images.ratelimit.pullSecrets | list | `[]` |  |
 | kubernetesClusterDomain | string | `"cluster.local"` |  |
 
diff --git a/site/content/en/latest/install/install-helm.md b/site/content/en/latest/install/install-helm.md
index 4c3351e62..cd7cb44ec 100644
--- a/site/content/en/latest/install/install-helm.md
+++ b/site/content/en/latest/install/install-helm.md
@@ -64,7 +64,7 @@ consideration when debugging.
 Some of the quick ways of using the helm install command for envoy gateway installation are below.
 
 {{% alert title="Helm Chart Values" color="primary" %}}
-If you want to know all the available fields inside the values.yaml file, please see the [Helm Chart Values](./api).
+If you want to know all the available fields inside the values.yaml file, please see the [Helm Chart Values](./gateway-helm-api).
 {{% /alert %}}
 
 ### Increase the replicas
diff --git a/site/content/en/latest/tasks/observability/gateway-exported-metrics.md b/site/content/en/latest/tasks/observability/gateway-exported-metrics.md
index a06f83aee..9878775e1 100644
--- a/site/content/en/latest/tasks/observability/gateway-exported-metrics.md
+++ b/site/content/en/latest/tasks/observability/gateway-exported-metrics.md
@@ -71,7 +71,28 @@ Envoy Gateway collects the following metrics in xDS Server:
 | `xds_stream_duration_seconds`       | How long a xds stream takes to finish.                        |
 | `xds_delta_stream_duration_seconds` | How long a xds delta stream takes to finish.                  |
 
-For xDS snapshot cache update and xDS stream connection status, each metric includes `nodeID` label to identify the connection peer.
-For xDS stream connection status, each metric also includes `streamID` label to identify the connection stream.
+- For xDS snapshot cache update and xDS stream connection status, each metric includes `nodeID` label to identify the connection peer.
+- For xDS stream connection status, each metric also includes `streamID` label to identify the connection stream.
+
+## Infrastructure Manager
+
+Envoy Gateway monitors the `apply` (`create` or `update`) and `delete` operations in Infrastructure Manager.
+
+Envoy Gateway collects the following metrics in Infrastructure Manager:
+
+| Name                               | Description                                             |
+|------------------------------------|---------------------------------------------------------|
+| `resource_apply_total`             | Total number of applied resources.                      |
+| `resource_apply_failed`            | Number of applied resources that failed.                |
+| `resource_apply_success`           | Number of applied resources that succeed.               |
+| `resource_apply_duration_seconds`  | How long in seconds a resource be applied successfully. |
+| `resource_delete_total`            | Total number of deleted resources.                      |
+| `resource_delete_failed`           | Number of deleted resources that failed.                |
+| `resource_delete_success`          | Number of deleted resources that succeed.               |
+| `resource_delete_duration_seconds` | How long in seconds a resource be deleted successfully. |
+
+Each metric includes the `kind` label to identify the corresponding resources being applied or deleted by Infrastructure Manager.
+
+Metrics may also include `name` and `namespace` label to identify the name and namespace of corresponding Infrastructure Manager.
 
 [prom-format]: https://prometheus.io/docs/instrumenting/exposition_formats/#text-based-format
diff --git a/test/cel-validation/securitypolicy_test.go b/test/cel-validation/securitypolicy_test.go
index 984903cf7..9c2466565 100644
--- a/test/cel-validation/securitypolicy_test.go
+++ b/test/cel-validation/securitypolicy_test.go
@@ -354,7 +354,7 @@ func TestSecurityPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.SecurityPolicySpec{
 					ExtAuth: &egv1a1.ExtAuth{
 						GRPC: &egv1a1.GRPCExtAuthService{
-							BackendRef: gwapiv1.BackendObjectReference{
+							BackendRef: &gwapiv1.BackendObjectReference{
 								Name: "grpc-auth-service",
 								Port: ptr.To(gwapiv1.PortNumber(80)),
 							},
@@ -371,13 +371,59 @@ func TestSecurityPolicyTarget(t *testing.T) {
 			},
 			wantErrors: []string{},
 		},
+		{
+			desc: "GRPC external auth service with backendRefs",
+			mutate: func(sp *egv1a1.SecurityPolicy) {
+				sp.Spec = egv1a1.SecurityPolicySpec{
+					ExtAuth: &egv1a1.ExtAuth{
+						GRPC: &egv1a1.GRPCExtAuthService{
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Name: "grpc-auth-service",
+										Kind: ptr.To(gwapiv1a2.Kind("Service")),
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
+								},
+							},
+						},
+					},
+					TargetRef: gwapiv1a2.LocalPolicyTargetReferenceWithSectionName{
+						LocalPolicyTargetReference: gwapiv1a2.LocalPolicyTargetReference{
+							Group: "gateway.networking.k8s.io",
+							Kind:  "Gateway",
+							Name:  "eg",
+						},
+					},
+				}
+			},
+			wantErrors: []string{},
+		},
+		{
+			desc: "empty GRPC external auth service",
+			mutate: func(sp *egv1a1.SecurityPolicy) {
+				sp.Spec = egv1a1.SecurityPolicySpec{
+					ExtAuth: &egv1a1.ExtAuth{
+						GRPC: &egv1a1.GRPCExtAuthService{},
+					},
+					TargetRef: gwapiv1a2.LocalPolicyTargetReferenceWithSectionName{
+						LocalPolicyTargetReference: gwapiv1a2.LocalPolicyTargetReference{
+							Group: "gateway.networking.k8s.io",
+							Kind:  "Gateway",
+							Name:  "eg",
+						},
+					},
+				}
+			},
+			wantErrors: []string{" backendRef or backendRefs needs to be set"},
+		},
 		{
 			desc: "HTTP external auth service",
 			mutate: func(sp *egv1a1.SecurityPolicy) {
 				sp.Spec = egv1a1.SecurityPolicySpec{
 					ExtAuth: &egv1a1.ExtAuth{
 						HTTP: &egv1a1.HTTPExtAuthService{
-							BackendRef: gwapiv1.BackendObjectReference{
+							BackendRef: &gwapiv1.BackendObjectReference{
 								Name: "http-auth-service",
 								Port: ptr.To(gwapiv1.PortNumber(15001)),
 							},
@@ -394,6 +440,34 @@ func TestSecurityPolicyTarget(t *testing.T) {
 			},
 			wantErrors: []string{},
 		},
+		{
+			desc: "HTTP external auth service with backendRefs",
+			mutate: func(sp *egv1a1.SecurityPolicy) {
+				sp.Spec = egv1a1.SecurityPolicySpec{
+					ExtAuth: &egv1a1.ExtAuth{
+						HTTP: &egv1a1.HTTPExtAuthService{
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Name: "grpc-auth-service",
+										Kind: ptr.To(gwapiv1a2.Kind("Service")),
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
+								},
+							},
+						},
+					},
+					TargetRef: gwapiv1a2.LocalPolicyTargetReferenceWithSectionName{
+						LocalPolicyTargetReference: gwapiv1a2.LocalPolicyTargetReference{
+							Group: "gateway.networking.k8s.io",
+							Kind:  "Gateway",
+							Name:  "eg",
+						},
+					},
+				}
+			},
+			wantErrors: []string{},
+		},
 		{
 			desc: "no extAuth",
 			mutate: func(sp *egv1a1.SecurityPolicy) {
@@ -418,13 +492,13 @@ func TestSecurityPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.SecurityPolicySpec{
 					ExtAuth: &egv1a1.ExtAuth{
 						GRPC: &egv1a1.GRPCExtAuthService{
-							BackendRef: gwapiv1.BackendObjectReference{
+							BackendRef: &gwapiv1.BackendObjectReference{
 								Name: "grpc-auth-service",
 								Port: ptr.To(gwapiv1.PortNumber(80)),
 							},
 						},
 						HTTP: &egv1a1.HTTPExtAuthService{
-							BackendRef: gwapiv1.BackendObjectReference{
+							BackendRef: &gwapiv1.BackendObjectReference{
 								Name: "http-auth-service",
 								Port: ptr.To(gwapiv1.PortNumber(15001)),
 							},
@@ -449,7 +523,7 @@ func TestSecurityPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.SecurityPolicySpec{
 					ExtAuth: &egv1a1.ExtAuth{
 						HTTP: &egv1a1.HTTPExtAuthService{
-							BackendRef: gwapiv1.BackendObjectReference{
+							BackendRef: &gwapiv1.BackendObjectReference{
 								Group: ptr.To(gwapiv1.Group("unsupported")),
 								Name:  "http-auth-service",
 								Port:  ptr.To(gwapiv1.PortNumber(15001)),
@@ -475,7 +549,7 @@ func TestSecurityPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.SecurityPolicySpec{
 					ExtAuth: &egv1a1.ExtAuth{
 						HTTP: &egv1a1.HTTPExtAuthService{
-							BackendRef: gwapiv1.BackendObjectReference{
+							BackendRef: &gwapiv1.BackendObjectReference{
 								Kind: ptr.To(gwapiv1.Kind("unsupported")),
 								Name: "http-auth-service",
 								Port: ptr.To(gwapiv1.PortNumber(15001)),
@@ -495,13 +569,41 @@ func TestSecurityPolicyTarget(t *testing.T) {
 				"spec.extAuth: Invalid value: \"object\": kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported",
 			},
 		},
+		{
+			desc: "http extAuth service backendRefs invalid Kind",
+			mutate: func(sp *egv1a1.SecurityPolicy) {
+				sp.Spec = egv1a1.SecurityPolicySpec{
+					ExtAuth: &egv1a1.ExtAuth{
+						HTTP: &egv1a1.HTTPExtAuthService{
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Name: "grpc-auth-service",
+										Kind: ptr.To(gwapiv1a2.Kind("unsupported")),
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
+								},
+							},
+						},
+					},
+					TargetRef: gwapiv1a2.LocalPolicyTargetReferenceWithSectionName{
+						LocalPolicyTargetReference: gwapiv1a2.LocalPolicyTargetReference{
+							Group: "gateway.networking.k8s.io",
+							Kind:  "Gateway",
+							Name:  "eg",
+						},
+					},
+				}
+			},
+			wantErrors: []string{" only support Service kind"},
+		},
 		{
 			desc: "grpc extAuth service invalid Group",
 			mutate: func(sp *egv1a1.SecurityPolicy) {
 				sp.Spec = egv1a1.SecurityPolicySpec{
 					ExtAuth: &egv1a1.ExtAuth{
 						GRPC: &egv1a1.GRPCExtAuthService{
-							BackendRef: gwapiv1.BackendObjectReference{
+							BackendRef: &gwapiv1.BackendObjectReference{
 								Group: ptr.To(gwapiv1.Group("unsupported")),
 								Name:  "http-auth-service",
 								Port:  ptr.To(gwapiv1.PortNumber(15001)),
@@ -527,7 +629,7 @@ func TestSecurityPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.SecurityPolicySpec{
 					ExtAuth: &egv1a1.ExtAuth{
 						GRPC: &egv1a1.GRPCExtAuthService{
-							BackendRef: gwapiv1.BackendObjectReference{
+							BackendRef: &gwapiv1.BackendObjectReference{
 								Kind: ptr.To(gwapiv1.Kind("unsupported")),
 								Name: "http-auth-service",
 								Port: ptr.To(gwapiv1.PortNumber(15001)),
@@ -547,6 +649,35 @@ func TestSecurityPolicyTarget(t *testing.T) {
 				"spec.extAuth: Invalid value: \"object\": kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported",
 			},
 		},
+		{
+			desc: "grpc extAuth service backendRefs invalid Kind",
+			mutate: func(sp *egv1a1.SecurityPolicy) {
+				sp.Spec = egv1a1.SecurityPolicySpec{
+					ExtAuth: &egv1a1.ExtAuth{
+						GRPC: &egv1a1.GRPCExtAuthService{
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Name: "grpc-auth-service",
+										Kind: ptr.To(gwapiv1a2.Kind("unsupported")),
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
+								},
+							},
+						},
+					},
+					TargetRef: gwapiv1a2.LocalPolicyTargetReferenceWithSectionName{
+						LocalPolicyTargetReference: gwapiv1a2.LocalPolicyTargetReference{
+							Group: "gateway.networking.k8s.io",
+							Kind:  "Gateway",
+							Name:  "eg",
+						},
+					},
+				}
+			},
+			wantErrors: []string{" only support Service kind"},
+		},
+
 		// JWT
 		{
 			desc: "valid jwt",
diff --git a/test/e2e/testdata/ext-auth-grpc-securitypolicy.yaml b/test/e2e/testdata/ext-auth-grpc-securitypolicy.yaml
index 840977aa6..3f40fc583 100644
--- a/test/e2e/testdata/ext-auth-grpc-securitypolicy.yaml
+++ b/test/e2e/testdata/ext-auth-grpc-securitypolicy.yaml
@@ -47,8 +47,8 @@ spec:
     name: http-with-ext-auth
   extAuth:
     grpc:
-      backendRef:
-        name: grpc-ext-auth
+      backendRefs:
+      - name: grpc-ext-auth
         namespace: gateway-conformance-infra
         port: 9002
 ---
diff --git a/test/e2e/testdata/ext-auth-http-securitypolicy.yaml b/test/e2e/testdata/ext-auth-http-securitypolicy.yaml
index 1ebcc9e34..e77dbde80 100644
--- a/test/e2e/testdata/ext-auth-http-securitypolicy.yaml
+++ b/test/e2e/testdata/ext-auth-http-securitypolicy.yaml
@@ -47,8 +47,8 @@ spec:
     name: http-with-ext-auth
   extAuth:
     http:
-      backendRef:
-        name: http-ext-auth
+      backendRefs:
+      - name: http-ext-auth
         namespace: gateway-conformance-infra
         port: 9002
       headersToBackend: ["x-current-user"]
diff --git a/test/helm/default-config.out.yaml b/test/helm/default-config.out.yaml
index ba4840ee0..25326c677 100644
--- a/test/helm/default-config.out.yaml
+++ b/test/helm/default-config.out.yaml
@@ -38,6 +38,15 @@ data:
         rateLimitDeployment:
           container:
             image: docker.io/envoyproxy/ratelimit:master
+          patch:
+            type: StrategicMerge
+            value:
+              spec:
+                template:
+                  spec:
+                    containers:
+                    - imagePullPolicy: IfNotPresent
+                      name: envoy-ratelimit
         shutdownManager:
           image: docker.io/envoyproxy/gateway-dev:latest
       type: Kubernetes
diff --git a/test/helm/deployment-images-config.out.yaml b/test/helm/deployment-images-config.out.yaml
index 78256bf94..b13dc2261 100644
--- a/test/helm/deployment-images-config.out.yaml
+++ b/test/helm/deployment-images-config.out.yaml
@@ -38,6 +38,15 @@ data:
         rateLimitDeployment:
           container:
             image: docker.io/envoyproxy/ratelimit:master
+          patch:
+            type: StrategicMerge
+            value:
+              spec:
+                template:
+                  spec:
+                    containers:
+                    - imagePullPolicy: IfNotPresent
+                      name: envoy-ratelimit
         shutdownManager:
           image: private-hub/envoyproxy/gateway:abcdef12
       type: Kubernetes
diff --git a/test/helm/envoy-gateway-config.out.yaml b/test/helm/envoy-gateway-config.out.yaml
index a2b051ea2..612306e1f 100644
--- a/test/helm/envoy-gateway-config.out.yaml
+++ b/test/helm/envoy-gateway-config.out.yaml
@@ -40,6 +40,15 @@ data:
         rateLimitDeployment:
           container:
             image: private-hub/envoyproxy/ratelimit:master
+          patch:
+            type: StrategicMerge
+            value:
+              spec:
+                template:
+                  spec:
+                    containers:
+                    - imagePullPolicy: IfNotPresent
+                      name: envoy-ratelimit
         shutdownManager:
           image: docker.io/envoyproxy/gateway-dev:latest
       type: Kubernetes
diff --git a/test/helm/global-images-config.in.yaml b/test/helm/global-images-config.in.yaml
index bbcb3a202..ee8250cbe 100644
--- a/test/helm/global-images-config.in.yaml
+++ b/test/helm/global-images-config.in.yaml
@@ -3,8 +3,12 @@ global:
     envoyGateway:
       image: "private-hub/envoyproxy/gateway:abcdef12"
       pullPolicy: Always
-      imagePullSecrets:
+      pullSecrets:
         - name: "secret1"
         - name: "secret2"
     ratelimit:
       image: "private-hub/envoyproxy/ratelimit:test"
+      pullPolicy: Always
+      pullSecrets:
+        - name: "secret3"
+        - name: "secret4"
diff --git a/test/helm/global-images-config.out.yaml b/test/helm/global-images-config.out.yaml
index 0d417c210..89788eaef 100644
--- a/test/helm/global-images-config.out.yaml
+++ b/test/helm/global-images-config.out.yaml
@@ -38,6 +38,19 @@ data:
         rateLimitDeployment:
           container:
             image: private-hub/envoyproxy/ratelimit:test
+          patch:
+            type: StrategicMerge
+            value:
+              spec:
+                template:
+                  spec:
+                    containers:
+                    - imagePullPolicy: Always
+                      name: envoy-ratelimit
+          pod:
+            imagePullSecrets:
+            - name: secret3
+            - name: secret4
         shutdownManager:
           image: private-hub/envoyproxy/gateway:abcdef12
       type: Kubernetes