Repository: envoyproxy/gateway
Pull request #3295 (2024-04-29 04:24:20)

build(deps): bump the go-opentelemetry-io group with 8 updates
Bumps the go-opentelemetry-io group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.25.0` | `1.26.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.25.0` | `1.26.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp](https://github.com/open-telemetry/opentelemetry-go) | `1.25.0` | `1.26.0` |
| [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go) | `0.47.0` | `0.48.0` |
| [go.opentelemetry.io/otel/exporters/stdout/stdoutmetric](https://github.com/open-telemetry/opentelemetry-go) | `1.25.0` | `1.26.0` |
| [go.opentelemetry.io/otel/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.25.0` | `1.26.0` |
| [go.opentelemetry.io/otel/sdk/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.25.0` | `1.26.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.25.0` | `1.26.0` |

Updates `go.opentelemetry.io/otel` from 1.25.0 to 1.26.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel's changelog</a>.</em></p>
<blockquote>
<h2>[1.26.0/0.48.0/0.2.0-alpha] 2024-04-24</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Recorder</code> in <code>go.opentelemetry.io/otel/log/logtest</code> to facilitate testing the log bridge implementations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5134">#5134</a>)</li>
<li>Add span flags to OTLP spans and links exported by <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5194">#5194</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/sdk/log</code>.
This new module contains the Go implementation of the OpenTelemetry Logs SDK.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
This new module contains an OTLP exporter that transmits log telemetry using HTTP.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>.
This new module contains an exporter prints log records to STDOUT.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.25.0</code> package.
The package contains semantic conventions from the <code>v1.25.0</code> version of the OpenTelemetry Semantic Conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update <code>go.opentelemetry.io/proto/otlp</code> from v1.1.0 to v1.2.0. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5177">#5177</a>)</li>
<li>Improve performance of baggage member character validation in <code>go.opentelemetry.io/otel/baggage</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5214">#5214</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9656d0afa72646101e859bf8a1c6d05b73ee094d"><code>9656d0a</code></a> Release 1.26.0/0.48.0/0.2.0-alpha (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5260">#5260</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/29e1c7e3e4c065d0767b85786ea799a2515322d8"><code>29e1c7e</code></a> Add custom ring implementation to the BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5237">#5237</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/baeb560673c8ff82789dbdeaaad525418c70337f"><code>baeb560</code></a> sdk/log: Fix doc for LoggerProvider.ForceFlush and LoggerProvider.Shutdown (#...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/ae55e2974455463e5fa4f36d7fe700bab4207dfe"><code>ae55e29</code></a> Remove left-over TODO in otlploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5256">#5256</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fe8e3a1b42997767073598aaf6c5923b664b1254"><code>fe8e3a1</code></a> Semconv v1.25.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/bf37c5a3a44fb5b4506d2690f35bf038fc729d97"><code>bf37c5a</code></a> Revert the usage of <code>go.opentelemetry.io/proto/slim</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5253">#5253</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b34cfc47c4e0240b728f28e62f829dc25408746b"><code>b34cfc4</code></a> Default implementation for empty BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5239">#5239</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9370c5a01f957e1eaf27f631cf99768e084c4cd7"><code>9370c5a</code></a> Implement resource serialization for stdoutlog (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5213">#5213</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6e92163d6adf91ec77fa41c155c557da6e078563"><code>6e92163</code></a> otlpmetrichttp: Use go.opentelemetry.io/proto/slim/otlp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5222">#5222</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f88533381ba23b17bb33f22a762053fb35fd80e7"><code>f885333</code></a> build(deps): bump golang.org/x/vuln in /internal/tools (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5245">#5245</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.25.0...v1.26.0">compare view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` from 1.25.0 to 1.26.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc's changelog</a>.</em></p>
<blockquote>
<h2>[1.26.0/0.48.0/0.2.0-alpha] 2024-04-24</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Recorder</code> in <code>go.opentelemetry.io/otel/log/logtest</code> to facilitate testing the log bridge implementations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5134">#5134</a>)</li>
<li>Add span flags to OTLP spans and links exported by <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5194">#5194</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/sdk/log</code>.
This new module contains the Go implementation of the OpenTelemetry Logs SDK.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
This new module contains an OTLP exporter that transmits log telemetry using HTTP.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>.
This new module contains an exporter prints log records to STDOUT.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.25.0</code> package.
The package contains semantic conventions from the <code>v1.25.0</code> version of the OpenTelemetry Semantic Conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update <code>go.opentelemetry.io/proto/otlp</code> from v1.1.0 to v1.2.0. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5177">#5177</a>)</li>
<li>Improve performance of baggage member character validation in <code>go.opentelemetry.io/otel/baggage</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5214">#5214</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9656d0afa72646101e859bf8a1c6d05b73ee094d"><code>9656d0a</code></a> Release 1.26.0/0.48.0/0.2.0-alpha (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5260">#5260</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/29e1c7e3e4c065d0767b85786ea799a2515322d8"><code>29e1c7e</code></a> Add custom ring implementation to the BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5237">#5237</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/baeb560673c8ff82789dbdeaaad525418c70337f"><code>baeb560</code></a> sdk/log: Fix doc for LoggerProvider.ForceFlush and LoggerProvider.Shutdown (#...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/ae55e2974455463e5fa4f36d7fe700bab4207dfe"><code>ae55e29</code></a> Remove left-over TODO in otlploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5256">#5256</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fe8e3a1b42997767073598aaf6c5923b664b1254"><code>fe8e3a1</code></a> Semconv v1.25.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/bf37c5a3a44fb5b4506d2690f35bf038fc729d97"><code>bf37c5a</code></a> Revert the usage of <code>go.opentelemetry.io/proto/slim</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5253">#5253</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b34cfc47c4e0240b728f28e62f829dc25408746b"><code>b34cfc4</code></a> Default implementation for empty BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5239">#5239</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9370c5a01f957e1eaf27f631cf99768e084c4cd7"><code>9370c5a</code></a> Implement resource serialization for stdoutlog (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5213">#5213</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6e92163d6adf91ec77fa41c155c557da6e078563"><code>6e92163</code></a> otlpmetrichttp: Use go.opentelemetry.io/proto/slim/otlp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5222">#5222</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f88533381ba23b17bb33f22a762053fb35fd80e7"><code>f885333</code></a> build(deps): bump golang.org/x/vuln in /internal/tools (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5245">#5245</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.25.0...v1.26.0">compare view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` from 1.25.0 to 1.26.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp's changelog</a>.</em></p>
<blockquote>
<h2>[1.26.0/0.48.0/0.2.0-alpha] 2024-04-24</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Recorder</code> in <code>go.opentelemetry.io/otel/log/logtest</code> to facilitate testing the log bridge implementations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5134">#5134</a>)</li>
<li>Add span flags to OTLP spans and links exported by <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5194">#5194</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/sdk/log</code>.
This new module contains the Go implementation of the OpenTelemetry Logs SDK.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
This new module contains an OTLP exporter that transmits log telemetry using HTTP.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>.
This new module contains an exporter prints log records to STDOUT.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.25.0</code> package.
The package contains semantic conventions from the <code>v1.25.0</code> version of the OpenTelemetry Semantic Conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update <code>go.opentelemetry.io/proto/otlp</code> from v1.1.0 to v1.2.0. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5177">#5177</a>)</li>
<li>Improve performance of baggage member character validation in <code>go.opentelemetry.io/otel/baggage</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5214">#5214</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9656d0afa72646101e859bf8a1c6d05b73ee094d"><code>9656d0a</code></a> Release 1.26.0/0.48.0/0.2.0-alpha (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5260">#5260</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/29e1c7e3e4c065d0767b85786ea799a2515322d8"><code>29e1c7e</code></a> Add custom ring implementation to the BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5237">#5237</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/baeb560673c8ff82789dbdeaaad525418c70337f"><code>baeb560</code></a> sdk/log: Fix doc for LoggerProvider.ForceFlush and LoggerProvider.Shutdown (#...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/ae55e2974455463e5fa4f36d7fe700bab4207dfe"><code>ae55e29</code></a> Remove left-over TODO in otlploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5256">#5256</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fe8e3a1b42997767073598aaf6c5923b664b1254"><code>fe8e3a1</code></a> Semconv v1.25.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/bf37c5a3a44fb5b4506d2690f35bf038fc729d97"><code>bf37c5a</code></a> Revert the usage of <code>go.opentelemetry.io/proto/slim</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5253">#5253</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b34cfc47c4e0240b728f28e62f829dc25408746b"><code>b34cfc4</code></a> Default implementation for empty BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5239">#5239</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9370c5a01f957e1eaf27f631cf99768e084c4cd7"><code>9370c5a</code></a> Implement resource serialization for stdoutlog (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5213">#5213</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6e92163d6adf91ec77fa41c155c557da6e078563"><code>6e92163</code></a> otlpmetrichttp: Use go.opentelemetry.io/proto/slim/otlp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5222">#5222</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f88533381ba23b17bb33f22a762053fb35fd80e7"><code>f885333</code></a> build(deps): bump golang.org/x/vuln in /internal/tools (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5245">#5245</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.25.0...v1.26.0">compare view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.47.0 to 0.48.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/releases">go.opentelemetry.io/otel/exporters/prometheus's releases</a>.</em></p>
<blockquote>
<h2>Release v1.26.0/v0.48.0/v0.2.0-alpha</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Recorder</code> in <code>go.opentelemetry.io/otel/log/logtest</code> to facilitate testing the log bridge implementations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5134">#5134</a>)</li>
<li>Add span flags to OTLP spans and links exported by <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5194">#5194</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/sdk/log</code>.
This new module contains the Go implementation of the OpenTelemetry Logs SDK.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
This new module contains an OTLP exporter that transmits log telemetry using HTTP.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>.
This new module contains an exporter prints log records to STDOUT.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.25.0</code> package.
The package contains semantic conventions from the <code>v1.25.0</code> version of the OpenTelemetry Semantic Conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update <code>go.opentelemetry.io/proto/otlp</code> from v1.1.0 to v1.2.0. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5177">#5177</a>)</li>
<li>Improve performance of baggage member character validation in <code>go.opentelemetry.io/otel/baggage</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5214">#5214</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.25.0...v1.26.0">https://github.com/open-telemetry/opentelemetry-go/compare/v1.25.0...v1.26.0</a></p>
<h2>Release v1.25.0/v0.47.0/v0.0.8/v0.1.0-alpha</h2>
<h3>Added</h3>
<ul>
<li>Add <code>WithProxy</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/4906">#4906</a>)</li>
<li>Add <code>WithProxy</code> option in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/4906">#4906</a>)</li>
<li>Add <code>AddLink</code> method to the <code>Span</code> interface in <code>go.opentelemetry.io/otel/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5032">#5032</a>)</li>
<li>The <code>Enabled</code> method is added to the <code>Logger</code> interface in <code>go.opentelemetry.io/otel/log</code>.
This method is used to notify users if a log record will be emitted or not. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5071">#5071</a>)</li>
<li>Add <code>SeverityUndefined</code> <code>const</code> to <code>go.opentelemetry.io/otel/log</code>.
This value represents an unset severity level. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5072">#5072</a>)</li>
<li>Add <code>Empty</code> function in <code>go.opentelemetry.io/otel/log</code> to return a <code>KeyValue</code> for an empty value. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5076">#5076</a>)</li>
<li>Add <code>go.opentelemetry.io/otel/log/global</code> to manage the global <code>LoggerProvider</code>.
This package is provided with the anticipation that all functionality will be migrate to <code>go.opentelemetry.io/otel</code> when <code>go.opentelemetry.io/otel/log</code> stabilizes.
At which point, users will be required to migrage their code, and this package will be deprecated then removed. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5085">#5085</a>)</li>
<li>Add support for <code>Summary</code> metrics in the <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code> and <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code> exporters. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5100">#5100</a>)</li>
<li>Add <code>otel.scope.name</code> and <code>otel.scope.version</code> tags to spans exported by <code>go.opentelemetry.io/otel/exporters/zipkin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5108">#5108</a>)</li>
<li>Add support for <code>AddLink</code> to <code>go.opentelemetry.io/otel/bridge/opencensus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5116">#5116</a>)</li>
<li>Add <code>String</code> method to <code>Value</code> and <code>KeyValue</code> in <code>go.opentelemetry.io/otel/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5117">#5117</a>)</li>
<li>Add Exemplar support to <code>go.opentelemetry.io/otel/exporters/prometheus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5111">#5111</a>)</li>
<li>Add metric semantic conventions to <code>go.opentelemetry.io/otel/semconv/v1.24.0</code>. Future <code>semconv</code> packages will include metric semantic conventions as well. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/4528">#4528</a>)</li>
</ul>
<h3>Changed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/prometheus's changelog</a>.</em></p>
<blockquote>
<h2>[1.26.0/0.48.0/0.2.0-alpha] 2024-04-24</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Recorder</code> in <code>go.opentelemetry.io/otel/log/logtest</code> to facilitate testing the log bridge implementations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5134">#5134</a>)</li>
<li>Add span flags to OTLP spans and links exported by <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5194">#5194</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/sdk/log</code>.
This new module contains the Go implementation of the OpenTelemetry Logs SDK.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
This new module contains an OTLP exporter that transmits log telemetry using HTTP.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>.
This new module contains an exporter prints log records to STDOUT.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.25.0</code> package.
The package contains semantic conventions from the <code>v1.25.0</code> version of the OpenTelemetry Semantic Conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update <code>go.opentelemetry.io/proto/otlp</code> from v1.1.0 to v1.2.0. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5177">#5177</a>)</li>
<li>Improve performance of baggage member character validation in <code>go.opentelemetry.io/otel/baggage</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5214">#5214</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9656d0afa72646101e859bf8a1c6d05b73ee094d"><code>9656d0a</code></a> Release 1.26.0/0.48.0/0.2.0-alpha (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5260">#5260</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/29e1c7e3e4c065d0767b85786ea799a2515322d8"><code>29e1c7e</code></a> Add custom ring implementation to the BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5237">#5237</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/baeb560673c8ff82789dbdeaaad525418c70337f"><code>baeb560</code></a> sdk/log: Fix doc for LoggerProvider.ForceFlush and LoggerProvider.Shutdown (#...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/ae55e2974455463e5fa4f36d7fe700bab4207dfe"><code>ae55e29</code></a> Remove left-over TODO in otlploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5256">#5256</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fe8e3a1b42997767073598aaf6c5923b664b1254"><code>fe8e3a1</code></a> Semconv v1.25.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/bf37c5a3a44fb5b4506d2690f35bf038fc729d97"><code>bf37c5a</code></a> Revert the usage of <code>go.opentelemetry.io/proto/slim</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5253">#5253</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b34cfc47c4e0240b728f28e62f829dc25408746b"><code>b34cfc4</code></a> Default implementation for empty BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5239">#5239</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9370c5a01f957e1eaf27f631cf99768e084c4cd7"><code>9370c5a</code></a> Implement resource serialization for stdoutlog (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5213">#5213</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6e92163d6adf91ec77fa41c155c557da6e078563"><code>6e92163</code></a> otlpmetrichttp: Use go.opentelemetry.io/proto/slim/otlp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5222">#5222</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f88533381ba23b17bb33f22a762053fb35fd80e7"><code>f885333</code></a> build(deps): bump golang.org/x/vuln in /internal/tools (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5245">#5245</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/example/prometheus/v0.47.0...example/prometheus/v0.48.0">compare view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric` from 1.25.0 to 1.26.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/stdout/stdoutmetric's changelog</a>.</em></p>
<blockquote>
<h2>[1.26.0/0.48.0/0.2.0-alpha] 2024-04-24</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Recorder</code> in <code>go.opentelemetry.io/otel/log/logtest</code> to facilitate testing the log bridge implementations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5134">#5134</a>)</li>
<li>Add span flags to OTLP spans and links exported by <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5194">#5194</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/sdk/log</code>.
This new module contains the Go implementation of the OpenTelemetry Logs SDK.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
This new module contains an OTLP exporter that transmits log telemetry using HTTP.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>.
This new module contains an exporter prints log records to STDOUT.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.25.0</code> package.
The package contains semantic conventions from the <code>v1.25.0</code> version of the OpenTelemetry Semantic Conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update <code>go.opentelemetry.io/proto/otlp</code> from v1.1.0 to v1.2.0. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5177">#5177</a>)</li>
<li>Improve performance of baggage member character validation in <code>go.opentelemetry.io/otel/baggage</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5214">#5214</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9656d0afa72646101e859bf8a1c6d05b73ee094d"><code>9656d0a</code></a> Release 1.26.0/0.48.0/0.2.0-alpha (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5260">#5260</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/29e1c7e3e4c065d0767b85786ea799a2515322d8"><code>29e1c7e</code></a> Add custom ring implementation to the BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5237">#5237</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/baeb560673c8ff82789dbdeaaad525418c70337f"><code>baeb560</code></a> sdk/log: Fix doc for LoggerProvider.ForceFlush and LoggerProvider.Shutdown (#...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/ae55e2974455463e5fa4f36d7fe700bab4207dfe"><code>ae55e29</code></a> Remove left-over TODO in otlploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5256">#5256</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fe8e3a1b42997767073598aaf6c5923b664b1254"><code>fe8e3a1</code></a> Semconv v1.25.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/bf37c5a3a44fb5b4506d2690f35bf038fc729d97"><code>bf37c5a</code></a> Revert the usage of <code>go.opentelemetry.io/proto/slim</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5253">#5253</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b34cfc47c4e0240b728f28e62f829dc25408746b"><code>b34cfc4</code></a> Default implementation for empty BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5239">#5239</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9370c5a01f957e1eaf27f631cf99768e084c4cd7"><code>9370c5a</code></a> Implement resource serialization for stdoutlog (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5213">#5213</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6e92163d6adf91ec77fa41c155c557da6e078563"><code>6e92163</code></a> otlpmetrichttp: Use go.opentelemetry.io/proto/slim/otlp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5222">#5222</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f88533381ba23b17bb33f22a762053fb35fd80e7"><code>f885333</code></a> build(deps): bump golang.org/x/vuln in /internal/tools (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5245">#5245</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.25.0...v1.26.0">compare view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/metric` from 1.25.0 to 1.26.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/metric's changelog</a>.</em></p>
<blockquote>
<h2>[1.26.0/0.48.0/0.2.0-alpha] 2024-04-24</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Recorder</code> in <code>go.opentelemetry.io/otel/log/logtest</code> to facilitate testing the log bridge implementations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5134">#5134</a>)</li>
<li>Add span flags to OTLP spans and links exported by <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5194">#5194</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/sdk/log</code>.
This new module contains the Go implementation of the OpenTelemetry Logs SDK.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
This new module contains an OTLP exporter that transmits log telemetry using HTTP.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>.
This new module contains an exporter prints log records to STDOUT.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.25.0</code> package.
The package contains semantic conventions from the <code>v1.25.0</code> version of the OpenTelemetry Semantic Conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update <code>go.opentelemetry.io/proto/otlp</code> from v1.1.0 to v1.2.0. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5177">#5177</a>)</li>
<li>Improve performance of baggage member character validation in <code>go.opentelemetry.io/otel/baggage</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5214">#5214</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9656d0afa72646101e859bf8a1c6d05b73ee094d"><code>9656d0a</code></a> Release 1.26.0/0.48.0/0.2.0-alpha (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5260">#5260</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/29e1c7e3e4c065d0767b85786ea799a2515322d8"><code>29e1c7e</code></a> Add custom ring implementation to the BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5237">#5237</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/baeb560673c8ff82789dbdeaaad525418c70337f"><code>baeb560</code></a> sdk/log: Fix doc for LoggerProvider.ForceFlush and LoggerProvider.Shutdown (#...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/ae55e2974455463e5fa4f36d7fe700bab4207dfe"><code>ae55e29</code></a> Remove left-over TODO in otlploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5256">#5256</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fe8e3a1b42997767073598aaf6c5923b664b1254"><code>fe8e3a1</code></a> Semconv v1.25.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/bf37c5a3a44fb5b4506d2690f35bf038fc729d97"><code>bf37c5a</code></a> Revert the usage of <code>go.opentelemetry.io/proto/slim</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5253">#5253</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b34cfc47c4e0240b728f28e62f829dc25408746b"><code>b34cfc4</code></a> Default implementation for empty BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5239">#5239</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9370c5a01f957e1eaf27f631cf99768e084c4cd7"><code>9370c5a</code></a> Implement resource serialization for stdoutlog (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5213">#5213</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6e92163d6adf91ec77fa41c155c557da6e078563"><code>6e92163</code></a> otlpmetrichttp: Use go.opentelemetry.io/proto/slim/otlp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5222">#5222</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f88533381ba23b17bb33f22a762053fb35fd80e7"><code>f885333</code></a> build(deps): bump golang.org/x/vuln in /internal/tools (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5245">#5245</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.25.0...v1.26.0">compare view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/sdk/metric` from 1.25.0 to 1.26.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk/metric's changelog</a>.</em></p>
<blockquote>
<h2>[1.26.0/0.48.0/0.2.0-alpha] 2024-04-24</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Recorder</code> in <code>go.opentelemetry.io/otel/log/logtest</code> to facilitate testing the log bridge implementations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5134">#5134</a>)</li>
<li>Add span flags to OTLP spans and links exported by <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5194">#5194</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/sdk/log</code>.
This new module contains the Go implementation of the OpenTelemetry Logs SDK.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
This new module contains an OTLP exporter that transmits log telemetry using HTTP.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>.
This new module contains an exporter prints log records to STDOUT.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.25.0</code> package.
The package contains semantic conventions from the <code>v1.25.0</code> version of the OpenTelemetry Semantic Conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update <code>go.opentelemetry.io/proto/otlp</code> from v1.1.0 to v1.2.0. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5177">#5177</a>)</li>
<li>Improve performance of baggage member character validation in <code>go.opentelemetry.io/otel/baggage</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5214">#5214</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9656d0afa72646101e859bf8a1c6d05b73ee094d"><code>9656d0a</code></a> Release 1.26.0/0.48.0/0.2.0-alpha (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5260">#5260</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/29e1c7e3e4c065d0767b85786ea799a2515322d8"><code>29e1c7e</code></a> Add custom ring implementation to the BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5237">#5237</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/baeb560673c8ff82789dbdeaaad525418c70337f"><code>baeb560</code></a> sdk/log: Fix doc for LoggerProvider.ForceFlush and LoggerProvider.Shutdown (#...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/ae55e2974455463e5fa4f36d7fe700bab4207dfe"><code>ae55e29</code></a> Remove left-over TODO in otlploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5256">#5256</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fe8e3a1b42997767073598aaf6c5923b664b1254"><code>fe8e3a1</code></a> Semconv v1.25.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/bf37c5a3a44fb5b4506d2690f35bf038fc729d97"><code>bf37c5a</code></a> Revert the usage of <code>go.opentelemetry.io/proto/slim</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5253">#5253</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b34cfc47c4e0240b728f28e62f829dc25408746b"><code>b34cfc4</code></a> Default implementation for empty BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5239">#5239</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9370c5a01f957e1eaf27f631cf99768e084c4cd7"><code>9370c5a</code></a> Implement resource serialization for stdoutlog (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5213">#5213</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6e92163d6adf91ec77fa41c155c557da6e078563"><code>6e92163</code></a> otlpmetrichttp: Use go.opentelemetry.io/proto/slim/otlp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5222">#5222</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f88533381ba23b17bb33f22a762053fb35fd80e7"><code>f885333</code></a> build(deps): bump golang.org/x/vuln in /internal/tools (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5245">#5245</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.25.0...v1.26.0">compare view</a></li>
</ul>
</details>
<br />

Updates `go.opentelemetry.io/otel/sdk` from 1.25.0 to 1.26.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk's changelog</a>.</em></p>
<blockquote>
<h2>[1.26.0/0.48.0/0.2.0-alpha] 2024-04-24</h2>
<h3>Added</h3>
<ul>
<li>Add <code>Recorder</code> in <code>go.opentelemetry.io/otel/log/logtest</code> to facilitate testing the log bridge implementations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5134">#5134</a>)</li>
<li>Add span flags to OTLP spans and links exported by <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5194">#5194</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/sdk/log</code>.
This new module contains the Go implementation of the OpenTelemetry Logs SDK.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
This new module contains an OTLP exporter that transmits log telemetry using HTTP.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>Make the initial alpha release of <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>.
This new module contains an exporter prints log records to STDOUT.
This module is unstable and breaking changes may be introduced.
See our <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md">versioning policy</a> for more information about these stability guarantees. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5240">#5240</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.25.0</code> package.
The package contains semantic conventions from the <code>v1.25.0</code> version of the OpenTelemetry Semantic Conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update <code>go.opentelemetry.io/proto/otlp</code> from v1.1.0 to v1.2.0. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5177">#5177</a>)</li>
<li>Improve performance of baggage member character validation in <code>go.opentelemetry.io/otel/baggage</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5214">#5214</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9656d0afa72646101e859bf8a1c6d05b73ee094d"><code>9656d0a</code></a> Release 1.26.0/0.48.0/0.2.0-alpha (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5260">#5260</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/29e1c7e3e4c065d0767b85786ea799a2515322d8"><code>29e1c7e</code></a> Add custom ring implementation to the BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5237">#5237</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/baeb560673c8ff82789dbdeaaad525418c70337f"><code>baeb560</code></a> sdk/log: Fix doc for LoggerProvider.ForceFlush and LoggerProvider.Shutdown (#...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/ae55e2974455463e5fa4f36d7fe700bab4207dfe"><code>ae55e29</code></a> Remove left-over TODO in otlploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5256">#5256</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/fe8e3a1b42997767073598aaf6c5923b664b1254"><code>fe8e3a1</code></a> Semconv v1.25.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5254">#5254</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/bf37c5a3a44fb5b4506d2690f35bf038fc729d97"><code>bf37c5a</code></a> Revert the usage of <code>go.opentelemetry.io/proto/slim</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5253">#5253</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b34cfc47c4e0240b728f28e62f829dc25408746b"><code>b34cfc4</code></a> Default implementation for empty BatchProcessor (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5239">#5239</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9370c5a01f957e1eaf27f631cf99768e084c4cd7"><code>9370c5a</code></a> Implement resource serialization for stdoutlog (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5213">#5213</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/6e92163d6adf91ec77fa41c155c557da6e078563"><code>6e92163</code></a> otlpmetrichttp: Use go.opentelemetry.io/proto/slim/otlp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5222">#5222</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/f88533381ba23b17bb33f22a762053fb35fd80e7"><code>f885333</code></a> build(deps): bump golang.org/x/vuln in /internal/tools (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/5245">#5245</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.25.0...v1.26.0">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions


</details>

zirain: /retest

Patch:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 340072d79..78b0ad99e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@c7f9125735019aa87cfc361530512d50ea439c71  # v3.25.1
+      uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14  # v3.25.3
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@c7f9125735019aa87cfc361530512d50ea439c71  # v3.25.1
+      uses: github/codeql-action/autobuild@d39d31e687223d841ef683f52467bd88e9b21c14  # v3.25.3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@c7f9125735019aa87cfc361530512d50ea439c71  # v3.25.1
+      uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14  # v3.25.3
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/experimental_conformance.yaml b/.github/workflows/experimental_conformance.yaml
index 508f7b589..bebb22823 100644
--- a/.github/workflows/experimental_conformance.yaml
+++ b/.github/workflows/experimental_conformance.yaml
@@ -32,7 +32,7 @@ jobs:
       run: make experimental-conformance
 
     - name: Upload Conformance Report
-      uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba  # v4.3.2
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
       with:
         name: conformance-report-k8s-${{ matrix.version }}
         path: ./test/conformance/conformance-report-k8s-${{ matrix.version }}.yaml
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index dad78e901..20473358d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,13 +33,13 @@ jobs:
         publish_results: true
 
     - name: "Upload artifact"
-      uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba  # v4.3.2
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
       with:
         name: SARIF file
         path: results.sarif
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@c7f9125735019aa87cfc361530512d50ea439c71  # v3.25.1
+      uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14  # v3.25.3
       with:
         sarif_file: results.sarif
diff --git a/api/v1alpha1/clienttrafficpolicy_types.go b/api/v1alpha1/clienttrafficpolicy_types.go
index 882f094a0..8f85d0617 100644
--- a/api/v1alpha1/clienttrafficpolicy_types.go
+++ b/api/v1alpha1/clienttrafficpolicy_types.go
@@ -176,8 +176,7 @@ type CustomHeaderExtensionSettings struct {
 }
 
 // HTTP3Settings provides HTTP/3 configuration on the listener.
-type HTTP3Settings struct {
-}
+type HTTP3Settings struct{}
 
 // HTTP1Settings provides HTTP/1 configuration on the listener.
 type HTTP1Settings struct {
diff --git a/api/v1alpha1/compression_types.go b/api/v1alpha1/compression_types.go
index 37c0ec858..73cb0109a 100644
--- a/api/v1alpha1/compression_types.go
+++ b/api/v1alpha1/compression_types.go
@@ -13,8 +13,7 @@ type CompressorType string
 // GzipCompressor defines the config for the Gzip compressor.
 // The default values can be found here:
 // https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/compression/gzip/compressor/v3/gzip.proto#extension-envoy-compression-gzip-compressor
-type GzipCompressor struct {
-}
+type GzipCompressor struct{}
 
 // Compression defines the config of enabling compression.
 // This can help reduce the bandwidth at the expense of higher CPU.
diff --git a/api/v1alpha1/envoygateway_types.go b/api/v1alpha1/envoygateway_types.go
index ade9e056b..3ae313dc4 100644
--- a/api/v1alpha1/envoygateway_types.go
+++ b/api/v1alpha1/envoygateway_types.go
@@ -506,7 +506,6 @@ type ExtensionTLS struct {
 
 // EnvoyGatewayAdmin defines the Envoy Gateway Admin configuration.
 type EnvoyGatewayAdmin struct {
-
 	// Address defines the address of Envoy Gateway Admin Server.
 	//
 	// +optional
diff --git a/api/v1alpha1/ext_proc_types.go b/api/v1alpha1/ext_proc_types.go
index ef5e409d9..85f250c63 100644
--- a/api/v1alpha1/ext_proc_types.go
+++ b/api/v1alpha1/ext_proc_types.go
@@ -45,18 +45,15 @@ type ExtProcProcessingMode struct {
 	Response *ProcessingModeOptions `json:"response,omitempty"`
 }
 
-// +kubebuilder:validation:XValidation:rule="has(self.backendRef) ? (!has(self.backendRef.group) || self.backendRef.group == \"\") : true", message="group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) is supported"
-// +kubebuilder:validation:XValidation:rule="has(self.backendRef) ? (!has(self.backendRef.kind) || self.backendRef.kind == 'Service') : true", message="kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported"
-//
 // ExtProc defines the configuration for External Processing filter.
 type ExtProc struct {
-	// BackendRef defines the configuration of the external processing service
-	BackendRef ExtProcBackendRef `json:"backendRef"`
-
 	// BackendRefs defines the configuration of the external processing service
 	//
-	// +optional
-	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=1
+	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Service kind.",rule="self.all(f, f.kind == 'Service')"
+	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
+	BackendRefs []BackendRef `json:"backendRefs"`
 
 	// MessageTimeout is the timeout for a response to be returned from the external processor
 	// Default: 200ms
@@ -77,13 +74,3 @@ type ExtProc struct {
 	// +optional
 	ProcessingMode *ExtProcProcessingMode `json:"processingMode,omitempty"`
 }
-
-// ExtProcService defines the gRPC External Processing service using the envoy grpc client
-// The processing request and response messages are defined in
-// https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ext_proc/v3/external_processor.proto
-type ExtProcBackendRef struct {
-	// BackendObjectReference references a Kubernetes object that represents the
-	// backend server to which the processing requests will be sent.
-	// Only service Kind is supported for now.
-	gwapiv1.BackendObjectReference `json:",inline"`
-}
diff --git a/api/v1alpha1/fault_injection.go b/api/v1alpha1/fault_injection.go
index d27a5c5ee..a8b7e1f54 100644
--- a/api/v1alpha1/fault_injection.go
+++ b/api/v1alpha1/fault_injection.go
@@ -13,7 +13,6 @@ import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 //
 // +kubebuilder:validation:XValidation:rule=" has(self.delay) || has(self.abort) ",message="Delay and abort faults are set at least one."
 type FaultInjection struct {
-
 	// If specified, a delay will be injected into the request.
 	//
 	// +optional
diff --git a/api/v1alpha1/healthcheck_types.go b/api/v1alpha1/healthcheck_types.go
index 61172273e..cea83d2f5 100644
--- a/api/v1alpha1/healthcheck_types.go
+++ b/api/v1alpha1/healthcheck_types.go
@@ -22,7 +22,6 @@ type HealthCheck struct {
 // PassiveHealthCheck defines the configuration for passive health checks in the context of Envoy's Outlier Detection,
 // see https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier
 type PassiveHealthCheck struct {
-
 	// SplitExternalLocalOriginErrors enables splitting of errors between external and local origin.
 	//
 	// +kubebuilder:default=false
diff --git a/api/v1alpha1/jwt_types.go b/api/v1alpha1/jwt_types.go
index 4f844b0e9..4bc8a994f 100644
--- a/api/v1alpha1/jwt_types.go
+++ b/api/v1alpha1/jwt_types.go
@@ -7,7 +7,6 @@ package v1alpha1
 
 // JWT defines the configuration for JSON Web Token (JWT) authentication.
 type JWT struct {
-
 	// Optional determines whether a missing JWT is acceptable, defaulting to false if not specified.
 	// Note: Even if optional is set to true, JWT authentication will still fail if an invalid JWT is presented.
 	Optional *bool `json:"optional,omitempty"`
@@ -91,7 +90,6 @@ type RemoteJWKS struct {
 
 // ClaimToHeader defines a configuration to convert JWT claims into HTTP headers
 type ClaimToHeader struct {
-
 	// Header defines the name of the HTTP request header that the JWT Claim will be saved into.
 	Header string `json:"header"`
 
diff --git a/api/v1alpha1/validation/envoyproxy_validate.go b/api/v1alpha1/validation/envoyproxy_validate.go
index b885d8fad..0e4f7e222 100644
--- a/api/v1alpha1/validation/envoyproxy_validate.go
+++ b/api/v1alpha1/validation/envoyproxy_validate.go
@@ -110,14 +110,12 @@ func validateService(spec *egv1a1.EnvoyProxySpec) []error {
 				errs = append(errs, fmt.Errorf("unsupported envoy service type %v", serviceType))
 			}
 		}
-		if serviceType, serviceAllocateLoadBalancerNodePorts :=
-			spec.Provider.Kubernetes.EnvoyService.Type, spec.Provider.Kubernetes.EnvoyService.AllocateLoadBalancerNodePorts; serviceType != nil && serviceAllocateLoadBalancerNodePorts != nil {
+		if serviceType, serviceAllocateLoadBalancerNodePorts := spec.Provider.Kubernetes.EnvoyService.Type, spec.Provider.Kubernetes.EnvoyService.AllocateLoadBalancerNodePorts; serviceType != nil && serviceAllocateLoadBalancerNodePorts != nil {
 			if *serviceType != egv1a1.ServiceTypeLoadBalancer {
 				errs = append(errs, fmt.Errorf("allocateLoadBalancerNodePorts can only be set for %v type", egv1a1.ServiceTypeLoadBalancer))
 			}
 		}
-		if serviceType, serviceLoadBalancerSourceRanges :=
-			spec.Provider.Kubernetes.EnvoyService.Type, spec.Provider.Kubernetes.EnvoyService.LoadBalancerSourceRanges; serviceType != nil && serviceLoadBalancerSourceRanges != nil {
+		if serviceType, serviceLoadBalancerSourceRanges := spec.Provider.Kubernetes.EnvoyService.Type, spec.Provider.Kubernetes.EnvoyService.LoadBalancerSourceRanges; serviceType != nil && serviceLoadBalancerSourceRanges != nil {
 			if *serviceType != egv1a1.ServiceTypeLoadBalancer {
 				errs = append(errs, fmt.Errorf("loadBalancerSourceRanges can only be set for %v type", egv1a1.ServiceTypeLoadBalancer))
 			}
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 2dac33193..c3d53f443 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -1641,7 +1641,6 @@ func (in *ExtAuth) DeepCopy() *ExtAuth {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ExtProc) DeepCopyInto(out *ExtProc) {
 	*out = *in
-	in.BackendRef.DeepCopyInto(&out.BackendRef)
 	if in.BackendRefs != nil {
 		in, out := &in.BackendRefs, &out.BackendRefs
 		*out = make([]BackendRef, len(*in))
@@ -1676,22 +1675,6 @@ func (in *ExtProc) DeepCopy() *ExtProc {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ExtProcBackendRef) DeepCopyInto(out *ExtProcBackendRef) {
-	*out = *in
-	in.BackendObjectReference.DeepCopyInto(&out.BackendObjectReference)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtProcBackendRef.
-func (in *ExtProcBackendRef) DeepCopy() *ExtProcBackendRef {
-	if in == nil {
-		return nil
-	}
-	out := new(ExtProcBackendRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ExtProcProcessingMode) DeepCopyInto(out *ExtProcProcessingMode) {
 	*out = *in
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 257cc8372..f8c013541 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -54,83 +54,6 @@ spec:
                   description: ExtProc defines the configuration for External Processing
                     filter.
                   properties:
-                    backendRef:
-                      description: BackendRef defines the configuration of the external
-                        processing service
-                      properties:
-                        group:
-                          default: ""
-                          description: |-
-                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                            When unspecified or empty string, core API group is inferred.
-                          maxLength: 253
-                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                          type: string
-                        kind:
-                          default: Service
-                          description: |-
-                            Kind is the Kubernetes resource kind of the referent. For example
-                            "Service".
-
-
-                            Defaults to "Service" when not specified.
-
-
-                            ExternalName services can refer to CNAME DNS records that may live
-                            outside of the cluster and as such are difficult to reason about in
-                            terms of conformance. They also may not be safe to forward to (see
-                            CVE-2021-25740 for more information). Implementations SHOULD NOT
-                            support ExternalName Services.
-
-
-                            Support: Core (Services with a type other than ExternalName)
-
-
-                            Support: Implementation-specific (Services with type ExternalName)
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                          type: string
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
-                          description: |-
-                            Namespace is the namespace of the backend. When unspecified, the local
-                            namespace is inferred.
-
-
-                            Note that when a namespace different than the local namespace is specified,
-                            a ReferenceGrant object is required in the referent namespace to allow that
-                            namespace's owner to accept the reference. See the ReferenceGrant
-                            documentation for details.
-
-
-                            Support: Core
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                          type: string
-                        port:
-                          description: |-
-                            Port specifies the destination port number to use for this resource.
-                            Port is required when the referent is a Kubernetes Service. In this
-                            case, the port number is the service port number, not the target port.
-                            For other resources, destination port might be derived from the referent
-                            resource or this field.
-                          format: int32
-                          maximum: 65535
-                          minimum: 1
-                          type: integer
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-validations:
-                      - message: Must have port for Service reference
-                        rule: '(size(self.group) == 0 && self.kind == ''Service'')
-                          ? has(self.port) : true'
                     backendRefs:
                       description: BackendRefs defines the configuration of the external
                         processing service
@@ -211,7 +134,14 @@ spec:
                         - message: Must have port for Service reference
                           rule: '(size(self.group) == 0 && self.kind == ''Service'')
                             ? has(self.port) : true'
+                      maxItems: 1
+                      minItems: 1
                       type: array
+                      x-kubernetes-validations:
+                      - message: BackendRefs only supports Service kind.
+                        rule: self.all(f, f.kind == 'Service')
+                      - message: BackendRefs only supports Core group.
+                        rule: self.all(f, f.group == '')
                     failOpen:
                       description: |-
                         FailOpen defines if requests or responses that cannot be processed due to connectivity to the
@@ -257,18 +187,8 @@ spec:
                           type: object
                       type: object
                   required:
-                  - backendRef
+                  - backendRefs
                   type: object
-                  x-kubernetes-validations:
-                  - message: group is invalid, only the core API group (specified
-                      by omitting the group field or setting it to an empty string)
-                      is supported
-                    rule: 'has(self.backendRef) ? (!has(self.backendRef.group) ||
-                      self.backendRef.group == "") : true'
-                  - message: kind is invalid, only Service (specified by omitting
-                      the kind field or setting it to 'Service') is supported
-                    rule: 'has(self.backendRef) ? (!has(self.backendRef.kind) || self.backendRef.kind
-                      == ''Service'') : true'
                 type: array
               targetRef:
                 description: |-
diff --git a/go.mod b/go.mod
index 697c2a145..036642b64 100644
--- a/go.mod
+++ b/go.mod
@@ -27,13 +27,13 @@ require (
 	github.com/stretchr/testify v1.9.0
 	github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7
 	github.com/tsaarni/certyaml v0.9.3
-	go.opentelemetry.io/otel v1.25.0
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.25.0
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.25.0
-	go.opentelemetry.io/otel/exporters/prometheus v0.47.0
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.25.0
-	go.opentelemetry.io/otel/metric v1.25.0
-	go.opentelemetry.io/otel/sdk/metric v1.25.0
+	go.opentelemetry.io/otel v1.26.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.26.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.26.0
+	go.opentelemetry.io/otel/exporters/prometheus v0.48.0
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.26.0
+	go.opentelemetry.io/otel/metric v1.26.0
+	go.opentelemetry.io/otel/sdk/metric v1.26.0
 	go.opentelemetry.io/proto/otlp v1.2.0
 	go.uber.org/zap v1.27.0
 	golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8
@@ -166,8 +166,8 @@ require (
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/tsaarni/x500dn v1.0.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.25.0
-	go.opentelemetry.io/otel/trace v1.25.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.26.0
+	go.opentelemetry.io/otel/trace v1.26.0 // indirect
 	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/mod v0.16.0 // indirect
diff --git a/go.sum b/go.sum
index ee2b08234..e0a9392cf 100644
--- a/go.sum
+++ b/go.sum
@@ -685,24 +685,24 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 h1:x8Z78aZx8cOF0+Kkazoc7lwUNMGy0LrzEMxTm4BbTxg=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0/go.mod h1:62CPTSry9QZtOaSsE3tOzhx6LzDhHnXJ6xHeMNNiM6Q=
-go.opentelemetry.io/otel v1.25.0 h1:gldB5FfhRl7OJQbUHt/8s0a7cE8fbsPAtdpRaApKy4k=
-go.opentelemetry.io/otel v1.25.0/go.mod h1:Wa2ds5NOXEMkCmUou1WA7ZBfLTHWIsp034OVD7AO+Vg=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.25.0 h1:hDKnobznDpcdTlNzO0S/owRB8tyVr1OoeZZhDoqY+Cs=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.25.0/go.mod h1:kUDQaUs1h8iTIHbQTk+iJRiUvSfJYMMKTtMCaiVu7B0=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.25.0 h1:Wc4hZuYXhVqq+TfRXLXlmNIL/awOanGx8ssq3ciDQxc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.25.0/go.mod h1:BydOvapRqVEc0DVz27qWBX2jq45Ca5TI9mhZBDIdweY=
-go.opentelemetry.io/otel/exporters/prometheus v0.47.0 h1:OL6yk1Z/pEGdDnrBbxSsH+t4FY1zXfBRGd7bjwhlMLU=
-go.opentelemetry.io/otel/exporters/prometheus v0.47.0/go.mod h1:xF3N4OSICZDVbbYZydz9MHFro1RjmkPUKEvar2utG+Q=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.25.0 h1:d7nHbdzU84STOiszaOxQ3kw5IwkSmHsU5Muol5/vL4I=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.25.0/go.mod h1:yiPA1iZbb/EHYnODXOxvtKuB0I2hV8ehfLTEWpl7BJU=
-go.opentelemetry.io/otel/metric v1.25.0 h1:LUKbS7ArpFL/I2jJHdJcqMGxkRdxpPHE0VU/D4NuEwA=
-go.opentelemetry.io/otel/metric v1.25.0/go.mod h1:rkDLUSd2lC5lq2dFNrX9LGAbINP5B7WBkC78RXCpH5s=
-go.opentelemetry.io/otel/sdk v1.25.0 h1:PDryEJPC8YJZQSyLY5eqLeafHtG+X7FWnf3aXMtxbqo=
-go.opentelemetry.io/otel/sdk v1.25.0/go.mod h1:oFgzCM2zdsxKzz6zwpTZYLLQsFwc+K0daArPdIhuxkw=
-go.opentelemetry.io/otel/sdk/metric v1.25.0 h1:7CiHOy08LbrxMAp4vWpbiPcklunUshVpAvGBrdDRlGw=
-go.opentelemetry.io/otel/sdk/metric v1.25.0/go.mod h1:LzwoKptdbBBdYfvtGCzGwk6GWMA3aUzBOwtQpR6Nz7o=
-go.opentelemetry.io/otel/trace v1.25.0 h1:tqukZGLwQYRIFtSQM2u2+yfMVTgGVeqRLPUYx1Dq6RM=
-go.opentelemetry.io/otel/trace v1.25.0/go.mod h1:hCCs70XM/ljO+BeQkyFnbK28SBIJ/Emuha+ccrCRT7I=
+go.opentelemetry.io/otel v1.26.0 h1:LQwgL5s/1W7YiiRwxf03QGnWLb2HW4pLiAhaA5cZXBs=
+go.opentelemetry.io/otel v1.26.0/go.mod h1:UmLkJHUAidDval2EICqBMbnAd0/m2vmpf/dAM+fvFs4=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.26.0 h1:+hm+I+KigBy3M24/h1p/NHkUx/evbLH0PNcjpMyCHc4=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.26.0/go.mod h1:NjC8142mLvvNT6biDpaMjyz78kyEHIwAJlSX0N9P5KI=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.26.0 h1:HGZWGmCVRCVyAs2GQaiHQPbDHo+ObFWeUEOd+zDnp64=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.26.0/go.mod h1:SaH+v38LSCHddyk7RGlU9uZyQoRrKao6IBnJw6Kbn+c=
+go.opentelemetry.io/otel/exporters/prometheus v0.48.0 h1:sBQe3VNGUjY9IKWQC6z2lNqa5iGbDSxhs60ABwK4y0s=
+go.opentelemetry.io/otel/exporters/prometheus v0.48.0/go.mod h1:DtrbMzoZWwQHyrQmCfLam5DZbnmorsGbOtTbYHycU5o=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.26.0 h1:5fnmgteaar1VcAA69huatudPduNFz7guRtCmfZCooZI=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.26.0/go.mod h1:lsPccfZiz1cb1AhBPmicWM2E4F1VynFXEvD8SEBS4TM=
+go.opentelemetry.io/otel/metric v1.26.0 h1:7S39CLuY5Jgg9CrnA9HHiEjGMF/X2VHvoXGgSllRz30=
+go.opentelemetry.io/otel/metric v1.26.0/go.mod h1:SY+rHOI4cEawI9a7N1A4nIg/nTQXe1ccCNWYOJUrpX4=
+go.opentelemetry.io/otel/sdk v1.26.0 h1:Y7bumHf5tAiDlRYFmGqetNcLaVUZmh4iYfmGxtmz7F8=
+go.opentelemetry.io/otel/sdk v1.26.0/go.mod h1:0p8MXpqLeJ0pzcszQQN4F0S5FVjBLgypeGSngLsmirs=
+go.opentelemetry.io/otel/sdk/metric v1.26.0 h1:cWSks5tfriHPdWFnl+qpX3P681aAYqlZHcAyHw5aU9Y=
+go.opentelemetry.io/otel/sdk/metric v1.26.0/go.mod h1:ClMFFknnThJCksebJwz7KIyEDHO+nTB6gK8obLy8RyE=
+go.opentelemetry.io/otel/trace v1.26.0 h1:1ieeAUb4y0TE26jUFrCIXKpTuVK7uJGN9/Z/2LP5sQA=
+go.opentelemetry.io/otel/trace v1.26.0/go.mod h1:4iDxvGDQuUkHve82hJJ8UqrwswHYsZuWCBllGV2U2y0=
 go.opentelemetry.io/proto/otlp v1.2.0 h1:pVeZGk7nXDC9O2hncA6nHldxEjm6LByfA2aN8IOkz94=
 go.opentelemetry.io/proto/otlp v1.2.0/go.mod h1:gGpR8txAl5M03pDhMC79G6SdqNV26naRm/KDsgaHD8A=
 go.starlark.net v0.0.0-20230525235612-a134d8f9ddca h1:VdD38733bfYv5tUZwEIskMM93VanwNIi5bIKnDrJdEY=
diff --git a/internal/admin/server.go b/internal/admin/server.go
index 9c035b438..299018143 100644
--- a/internal/admin/server.go
+++ b/internal/admin/server.go
@@ -17,9 +17,7 @@ import (
 	"github.com/envoyproxy/gateway/internal/logging"
 )
 
-var (
-	adminLogger = logging.DefaultLogger(v1alpha1.LogLevelInfo).WithName("admin")
-)
+var adminLogger = logging.DefaultLogger(v1alpha1.LogLevelInfo).WithName("admin")
 
 func Init(cfg *config.Server) error {
 	if cfg.EnvoyGateway.GetEnvoyGatewayAdmin().EnableDumpConfig {
diff --git a/internal/cmd/egctl/config_ratelimit.go b/internal/cmd/egctl/config_ratelimit.go
index 376ff65cd..089a52f1f 100644
--- a/internal/cmd/egctl/config_ratelimit.go
+++ b/internal/cmd/egctl/config_ratelimit.go
@@ -32,10 +32,7 @@ var (
 )
 
 func ratelimitConfigCommand() *cobra.Command {
-
-	var (
-		namespace string
-	)
+	var namespace string
 
 	rlConfigCmd := &cobra.Command{
 		Use:     "envoy-ratelimit",
@@ -57,7 +54,6 @@ func ratelimitConfigCommand() *cobra.Command {
 }
 
 func runRateLimitConfig(c *cobra.Command, ns string) error {
-
 	cli, err := getCLIClient()
 	if err != nil {
 		return err
@@ -73,7 +69,6 @@ func runRateLimitConfig(c *cobra.Command, ns string) error {
 }
 
 func retrieveRateLimitConfig(cli kubernetes.CLIClient, ns string) ([]byte, error) {
-
 	// Before retrieving the rate limit configuration
 	// we make sure that the global rate limit feature is enabled
 	if enable, err := checkEnableGlobalRateLimit(cli); !enable {
@@ -103,7 +98,6 @@ func retrieveRateLimitConfig(cli kubernetes.CLIClient, ns string) ([]byte, error
 // fetchRunningRateLimitPods gets the rate limit Pods, based on the labelSelectors.
 // It further filters out only those rate limit Pods that are in "Running" state.
 func fetchRunningRateLimitPods(cli kubernetes.CLIClient, namespace string, labelSelector []string) ([]types.NamespacedName, error) {
-
 	// Since multiple replicas of the rate limit are configured to be equal,
 	// we do not need to use the pod name to obtain the specified pod.
 	rlPods, err := cli.PodsForSelector(namespace, labelSelector...)
@@ -134,7 +128,6 @@ func fetchRunningRateLimitPods(cli kubernetes.CLIClient, namespace string, label
 
 // checkRateLimitPodStatusReady Check that the rate limit pod is ready
 func checkRateLimitPodStatusReady(status corev1.PodStatus) bool {
-
 	if status.Phase != corev1.PodRunning {
 		return false
 	}
@@ -152,7 +145,6 @@ func checkRateLimitPodStatusReady(status corev1.PodStatus) bool {
 // extractRateLimitConfig After turning on port forwarding through PortForwarder,
 // construct a request and send it to the rate limit Pod to obtain relevant configuration information.
 func extractRateLimitConfig(fw kubernetes.PortForwarder, rlPod types.NamespacedName) ([]byte, error) {
-
 	if err := fw.Start(); err != nil {
 		return nil, fmt.Errorf("failed to start port forwarding for pod %s/%s: %w", rlPod.Namespace, rlPod.Name, err)
 	}
@@ -168,7 +160,6 @@ func extractRateLimitConfig(fw kubernetes.PortForwarder, rlPod types.NamespacedN
 
 // checkEnableGlobalRateLimit Check whether the Global Rate Limit function is enabled
 func checkEnableGlobalRateLimit(cli kubernetes.CLIClient) (bool, error) {
-
 	kubeCli := cli.Kube()
 	cm, err := kubeCli.CoreV1().
 		ConfigMaps(defaultRateLimitNamespace).
diff --git a/internal/cmd/egctl/envoy_stats.go b/internal/cmd/egctl/envoy_stats.go
index c7701da0b..c8b22c8d0 100644
--- a/internal/cmd/egctl/envoy_stats.go
+++ b/internal/cmd/egctl/envoy_stats.go
@@ -24,9 +24,7 @@ const (
 	prometheusOutput = "prom"
 )
 
-var (
-	statsType, outputFormat string
-)
+var statsType, outputFormat string
 
 func newEnvoyStatsCmd() *cobra.Command {
 	var podName, podNamespace string
diff --git a/internal/cmd/egctl/install.go b/internal/cmd/egctl/install.go
index 640dfca0b..076ecb8d2 100644
--- a/internal/cmd/egctl/install.go
+++ b/internal/cmd/egctl/install.go
@@ -13,7 +13,6 @@ import (
 )
 
 func newInstallCommand() *cobra.Command {
-
 	packageFlags := &helm.PackageOptions{}
 	pt := helm.NewPackageTool()
 
diff --git a/internal/cmd/egctl/translate.go b/internal/cmd/egctl/translate.go
index a441378f5..9d21b2010 100644
--- a/internal/cmd/egctl/translate.go
+++ b/internal/cmd/egctl/translate.go
@@ -161,12 +161,14 @@ func getValidOutputTypesStr() string {
 }
 
 func validResourceTypes() []envoyConfigType {
-	return []envoyConfigType{BootstrapEnvoyConfigType,
+	return []envoyConfigType{
+		BootstrapEnvoyConfigType,
 		EndpointEnvoyConfigType,
 		ClusterEnvoyConfigType,
 		ListenerEnvoyConfigType,
 		RouteEnvoyConfigType,
-		AllEnvoyConfigType}
+		AllEnvoyConfigType,
+	}
 }
 
 func isValidResourceType(outType envoyConfigType) bool {
diff --git a/internal/cmd/egctl/uninstall.go b/internal/cmd/egctl/uninstall.go
index 769222fe2..9241db831 100644
--- a/internal/cmd/egctl/uninstall.go
+++ b/internal/cmd/egctl/uninstall.go
@@ -13,7 +13,6 @@ import (
 )
 
 func newUnInstallCommand() *cobra.Command {
-
 	packageFlags := &helm.PackageOptions{}
 	pt := helm.NewPackageTool()
 
diff --git a/internal/cmd/envoy/shutdown_manager.go b/internal/cmd/envoy/shutdown_manager.go
index 5f517365c..257a3d323 100644
--- a/internal/cmd/envoy/shutdown_manager.go
+++ b/internal/cmd/envoy/shutdown_manager.go
@@ -23,9 +23,7 @@ import (
 	"github.com/envoyproxy/gateway/internal/xds/bootstrap"
 )
 
-var (
-	logger = logging.DefaultLogger(v1alpha1.LogLevelInfo).WithName("shutdown-manager")
-)
+var logger = logging.DefaultLogger(v1alpha1.LogLevelInfo).WithName("shutdown-manager")
 
 const (
 	// ShutdownManagerPort is the port Envoy shutdown manager will listen on.
@@ -88,7 +86,7 @@ func ShutdownManager(readyTimeout time.Duration) error {
 // container to block until ready to terminate. After the graceful drain process
 // has completed a file will be written to indicate shutdown readiness.
 func shutdownReadyHandler(w http.ResponseWriter, readyTimeout time.Duration, readyFile string) {
-	var startTime = time.Now()
+	startTime := time.Now()
 
 	logger.Info("received shutdown ready request")
 
@@ -119,8 +117,8 @@ func shutdownReadyHandler(w http.ResponseWriter, readyTimeout time.Duration, rea
 // it will initiate a graceful drain sequence on the Envoy proxy and block until
 // connections are drained or a timeout is exceeded.
 func Shutdown(drainTimeout time.Duration, minDrainDuration time.Duration, exitAtConnections int) error {
-	var startTime = time.Now()
-	var allowedToExit = false
+	startTime := time.Now()
+	allowedToExit := false
 
 	// Reconfigure logger to write to stdout of main process if running in Kubernetes
 	if _, k8s := os.LookupEnv("KUBERNETES_SERVICE_HOST"); k8s && os.Getpid() != 1 {
diff --git a/internal/cmd/server.go b/internal/cmd/server.go
index 6dc25a199..e4bf36a5a 100644
--- a/internal/cmd/server.go
+++ b/internal/cmd/server.go
@@ -23,10 +23,8 @@ import (
 	xdstranslatorrunner "github.com/envoyproxy/gateway/internal/xds/translator/runner"
 )
 
-var (
-	// cfgPath is the path to the EnvoyGateway configuration file.
-	cfgPath string
-)
+// cfgPath is the path to the EnvoyGateway configuration file.
+var cfgPath string
 
 // getServerCommand returns the server cobra command to be executed.
 func getServerCommand() *cobra.Command {
diff --git a/internal/crypto/certgen.go b/internal/crypto/certgen.go
index 6c6ef10cc..de5a65848 100644
--- a/internal/crypto/certgen.go
+++ b/internal/crypto/certgen.go
@@ -225,7 +225,6 @@ func newCert(request *certificateRequest) ([]byte, []byte, error) {
 		Bytes: newCert,
 	})
 	return newCertPEM, newKeyPEM, nil
-
 }
 
 // newCA generates a new CA, given the CA's CN and an expiry time.
diff --git a/internal/envoygateway/scheme.go b/internal/envoygateway/scheme.go
index 911ae7083..78567e920 100644
--- a/internal/envoygateway/scheme.go
+++ b/internal/envoygateway/scheme.go
@@ -16,15 +16,13 @@ import (
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 )
 
-var (
-	// scheme contains all the API types necessary for the provider's dynamic
-	// clients to work. Any new non-core types must be added here.
-	//
-	// NOTE: The discovery mechanism used by the client doesn't automatically
-	// refresh, so only add types here that are guaranteed to exist before the
-	// provider starts.
-	scheme = runtime.NewScheme()
-)
+// scheme contains all the API types necessary for the provider's dynamic
+// clients to work. Any new non-core types must be added here.
+//
+// NOTE: The discovery mechanism used by the client doesn't automatically
+// refresh, so only add types here that are guaranteed to exist before the
+// provider starts.
+var scheme = runtime.NewScheme()
 
 func init() {
 	if err := clientgoscheme.AddToScheme(scheme); err != nil {
diff --git a/internal/extension/registry/xds_hook.go b/internal/extension/registry/xds_hook.go
index a7962d62e..e53d90dcd 100644
--- a/internal/extension/registry/xds_hook.go
+++ b/internal/extension/registry/xds_hook.go
@@ -53,7 +53,6 @@ func (h *XDSHook) PostRouteModifyHook(route *route.Route, routeHostnames []strin
 				ExtensionResources: extensionResourceBytes,
 			},
 		})
-
 	if err != nil {
 		return nil, err
 	}
@@ -69,7 +68,6 @@ func (h *XDSHook) PostVirtualHostModifyHook(vh *route.VirtualHost) (*route.Virtu
 			VirtualHost:            vh,
 			PostVirtualHostContext: &extension.PostVirtualHostExtensionContext{},
 		})
-
 	if err != nil {
 		return nil, err
 	}
@@ -85,7 +83,6 @@ func (h *XDSHook) PostHTTPListenerModifyHook(l *listener.Listener) (*listener.Li
 			Listener:            l,
 			PostListenerContext: &extension.PostHTTPListenerExtensionContext{},
 		})
-
 	if err != nil {
 		return nil, err
 	}
@@ -102,7 +99,6 @@ func (h *XDSHook) PostTranslateModifyHook(clusters []*cluster.Cluster, secrets [
 			Clusters:             clusters,
 			Secrets:              secrets,
 		})
-
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/internal/gatewayapi/backendtlspolicy.go b/internal/gatewayapi/backendtlspolicy.go
index d0b21b354..3dcfc9ad2 100644
--- a/internal/gatewayapi/backendtlspolicy.go
+++ b/internal/gatewayapi/backendtlspolicy.go
@@ -21,7 +21,8 @@ func (t *Translator) processBackendTLSPolicy(
 	backendRef gwapiv1.BackendObjectReference,
 	backendNamespace string,
 	parent gwapiv1a2.ParentReference,
-	resources *Resources) *ir.TLSUpstreamConfig {
+	resources *Resources,
+) *ir.TLSUpstreamConfig {
 	tlsBundle, err := getBackendTLSBundle(resources.BackendTLSPolicies, resources.ConfigMaps, backendRef, backendNamespace)
 	if err == nil && tlsBundle == nil {
 		return nil
@@ -108,7 +109,6 @@ func (t *Translator) processBackendTLSPolicy(
 }
 
 func backendTLSTargetMatched(policy gwapiv1a2.BackendTLSPolicy, target gwapiv1a2.PolicyTargetReferenceWithSectionName) bool {
-
 	policyTarget := policy.Spec.TargetRef
 
 	if target.Group == policyTarget.Group &&
@@ -134,7 +134,6 @@ func getBackendTLSPolicy(policies []*gwapiv1a2.BackendTLSPolicy, backendRef gwap
 }
 
 func getBackendTLSBundle(policies []*gwapiv1a2.BackendTLSPolicy, configmaps []*corev1.ConfigMap, backendRef gwapiv1a2.BackendObjectReference, backendNamespace string) (*ir.TLSUpstreamConfig, error) {
-
 	backendTLSPolicy := getBackendTLSPolicy(policies, backendRef, backendNamespace)
 
 	if backendTLSPolicy == nil {
diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go
index 55f79723b..b77a551d4 100644
--- a/internal/gatewayapi/backendtrafficpolicy.go
+++ b/internal/gatewayapi/backendtrafficpolicy.go
@@ -31,7 +31,8 @@ import (
 func (t *Translator) ProcessBackendTrafficPolicies(backendTrafficPolicies []*egv1a1.BackendTrafficPolicy,
 	gateways []*GatewayContext,
 	routes []RouteContext,
-	xdsIR XdsIRMap) []*egv1a1.BackendTrafficPolicy {
+	xdsIR XdsIRMap,
+) []*egv1a1.BackendTrafficPolicy {
 	var res []*egv1a1.BackendTrafficPolicy
 
 	// Sort based on timestamp
@@ -631,7 +632,7 @@ func (t *Translator) buildLocalRateLimit(policy *egv1a1.BackendTrafficPolicy) (*
 
 	var err error
 	var irRule *ir.RateLimitRule
-	var irRules = make([]*ir.RateLimitRule, 0)
+	irRules := make([]*ir.RateLimitRule, 0)
 	for _, rule := range local.Rules {
 		// We don't process the rule without clientSelectors here because it's
 		// previously used as the default route-level limit.
diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go
index 866e98442..d4d059dc4 100644
--- a/internal/gatewayapi/clienttrafficpolicy.go
+++ b/internal/gatewayapi/clienttrafficpolicy.go
@@ -41,7 +41,8 @@ func hasSectionName(policy *egv1a1.ClientTrafficPolicy) bool {
 
 func (t *Translator) ProcessClientTrafficPolicies(resources *Resources,
 	gateways []*GatewayContext,
-	xdsIR XdsIRMap, infraIR InfraIRMap) []*egv1a1.ClientTrafficPolicy {
+	xdsIR XdsIRMap, infraIR InfraIRMap,
+) []*egv1a1.ClientTrafficPolicy {
 	var res []*egv1a1.ClientTrafficPolicy
 
 	clientTrafficPolicies := resources.ClientTrafficPolicies
@@ -362,7 +363,8 @@ func validatePortOverlapForClientTrafficPolicy(l *ListenerContext, xds *ir.Xds,
 }
 
 func (t *Translator) translateClientTrafficPolicyForListener(policy *egv1a1.ClientTrafficPolicy, l *ListenerContext,
-	xdsIR XdsIRMap, infraIR InfraIRMap, resources *Resources) error {
+	xdsIR XdsIRMap, infraIR InfraIRMap, resources *Resources,
+) error {
 	// Find IR
 	irKey := t.getIRKey(l.gateway)
 	// It must exist since we've already finished processing the gateways
@@ -632,7 +634,8 @@ func translateHTTP2Settings(http2Settings *egv1a1.HTTP2Settings, httpIR *ir.HTTP
 }
 
 func (t *Translator) translateListenerTLSParameters(policy *egv1a1.ClientTrafficPolicy,
-	httpIR *ir.HTTPListener, resources *Resources) error {
+	httpIR *ir.HTTPListener, resources *Resources,
+) error {
 	// Return if this listener isn't a TLS listener. There has to be
 	// at least one certificate defined, which would cause httpIR to
 	// have a TLS structure.
diff --git a/internal/gatewayapi/envoyextensionpolicy.go b/internal/gatewayapi/envoyextensionpolicy.go
index 3c0305db7..edb0dc385 100644
--- a/internal/gatewayapi/envoyextensionpolicy.go
+++ b/internal/gatewayapi/envoyextensionpolicy.go
@@ -10,13 +10,13 @@ import (
 	"fmt"
 	"sort"
 	"strings"
+	"time"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/utils/ptr"
 
-	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	gwv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gwv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
@@ -30,7 +30,8 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
 	gateways []*GatewayContext,
 	routes []RouteContext,
 	resources *Resources,
-	xdsIR XdsIRMap) []*egv1a1.EnvoyExtensionPolicy {
+	xdsIR XdsIRMap,
+) []*egv1a1.EnvoyExtensionPolicy {
 	var res []*egv1a1.EnvoyExtensionPolicy
 
 	// Sort based on timestamp
@@ -293,7 +294,8 @@ func resolveEEPolicyRouteTargetRef(policy *egv1a1.EnvoyExtensionPolicy, routes m
 }
 
 func (t *Translator) translateEnvoyExtensionPolicyForRoute(policy *egv1a1.EnvoyExtensionPolicy, route RouteContext,
-	xdsIR XdsIRMap, resources *Resources) error {
+	xdsIR XdsIRMap, resources *Resources,
+) error {
 	var (
 		extProcs  []ir.ExtProc
 		wasms     []ir.Wasm
@@ -343,7 +345,8 @@ func (t *Translator) buildExtProcs(policy *egv1a1.EnvoyExtensionPolicy, resource
 }
 
 func (t *Translator) translateEnvoyExtensionPolicyForGateway(policy *egv1a1.EnvoyExtensionPolicy,
-	gateway *GatewayContext, xdsIR XdsIRMap, resources *Resources) error {
+	gateway *GatewayContext, xdsIR XdsIRMap, resources *Resources,
+) error {
 	var (
 		extProcs  []ir.ExtProc
 		wasms     []ir.Wasm
@@ -398,50 +401,82 @@ func (t *Translator) buildExtProc(
 	policyNamespacedName types.NamespacedName,
 	extProc egv1a1.ExtProc,
 	extProcIdx int,
-	resources *Resources) (*ir.ExtProc, error) {
+	resources *Resources,
+) (*ir.ExtProc, error) {
 	var (
-		backendRef *gwapiv1.BackendObjectReference
-		ds         *ir.DestinationSetting
-		authority  string
-		err        error
+		ds        *ir.DestinationSetting
+		authority string
+		err       error
 	)
 
-	backendRef = &extProc.BackendRef.BackendObjectReference
+	var dsl []*ir.DestinationSetting
+	for i := range extProc.BackendRefs {
+		if err = t.validateExtServiceBackendReference(
+			&extProc.BackendRefs[i].BackendObjectReference,
+			policyNamespacedName.Namespace,
+			resources); err != nil {
+			return nil, err
+		}
 
-	if err = t.validateExtServiceBackendReference(
-		backendRef,
-		policyNamespacedName.Namespace,
-		resources); err != nil {
-		return nil, err
-	}
+		ds, err = t.processExtServiceDestination(
+			&extProc.BackendRefs[i].BackendObjectReference,
+			policyNamespacedName,
+			egv1a1.KindEnvoyExtensionPolicy,
+			ir.GRPC,
+			resources)
 
-	authority = fmt.Sprintf(
-		"%s.%s:%d",
-		backendRef.Name,
-		NamespaceDerefOr(backendRef.Namespace, policyNamespacedName.Namespace),
-		*backendRef.Port)
+		if err != nil {
+			return nil, err
+		}
 
-	if ds, err = t.processExtServiceDestination(
-		backendRef,
-		policyNamespacedName,
-		egv1a1.KindEnvoyExtensionPolicy,
-		ir.GRPC,
-		resources); err != nil {
-		return nil, err
+		dsl = append(dsl, ds)
 	}
 
 	rd := ir.RouteDestination{
-		Name: irIndexedExtServiceDestinationName(policyNamespacedName, egv1a1.KindEnvoyExtensionPolicy,
-			string(backendRef.Name), extProcIdx),
-		Settings: []*ir.DestinationSetting{ds},
+		Name:     irIndexedExtServiceDestinationName(policyNamespacedName, egv1a1.KindEnvoyExtensionPolicy, extProcIdx),
+		Settings: dsl,
 	}
 
+	authority = fmt.Sprintf(
+		"%s.%s:%d",
+		extProc.BackendRefs[0].Name,
+		NamespaceDerefOr(extProc.BackendRefs[0].Namespace, policyNamespacedName.Namespace),
+		*extProc.BackendRefs[0].Port)
+
 	extProcIR := &ir.ExtProc{
 		Name:        name,
 		Destination: rd,
 		Authority:   authority,
 	}
 
+	if extProc.MessageTimeout != nil {
+		d, err := time.ParseDuration(string(*extProc.MessageTimeout))
+		if err != nil {
+			return nil, fmt.Errorf("invalid ExtProc MessageTimeout value %v", extProc.MessageTimeout)
+		}
+		extProcIR.MessageTimeout = ptr.To(metav1.Duration{Duration: d})
+	}
+
+	if extProc.FailOpen != nil {
+		extProcIR.FailOpen = extProc.FailOpen
+	}
+
+	if extProc.ProcessingMode != nil {
+		if extProc.ProcessingMode.Request != nil {
+			extProcIR.RequestHeaderProcessing = true
+			if extProc.ProcessingMode.Request.Body != nil {
+				extProcIR.RequestBodyProcessingMode = ptr.To(ir.ExtProcBodyProcessingMode(*extProc.ProcessingMode.Request.Body))
+			}
+		}
+
+		if extProc.ProcessingMode.Response != nil {
+			extProcIR.ResponseHeaderProcessing = true
+			if extProc.ProcessingMode.Response.Body != nil {
+				extProcIR.ResponseBodyProcessingMode = ptr.To(ir.ExtProcBodyProcessingMode(*extProc.ProcessingMode.Response.Body))
+			}
+		}
+	}
+
 	return extProcIR, err
 }
 
diff --git a/internal/gatewayapi/ext_service.go b/internal/gatewayapi/ext_service.go
index a14e2b125..ec1c77063 100644
--- a/internal/gatewayapi/ext_service.go
+++ b/internal/gatewayapi/ext_service.go
@@ -26,7 +26,8 @@ func (t *Translator) processExtServiceDestination(
 	policyNamespacedName types.NamespacedName,
 	policyKind string,
 	protocol ir.AppProtocol,
-	resources *Resources) (*ir.DestinationSetting, error) {
+	resources *Resources,
+) (*ir.DestinationSetting, error) {
 	var (
 		endpoints   []*ir.DestinationEndpoint
 		addrType    *ir.DestinationAddressType
@@ -93,12 +94,11 @@ func (t *Translator) processExtServiceDestination(
 }
 
 // TODO: also refer to extension type, as WASM may also introduce destinations
-func irIndexedExtServiceDestinationName(policyNamespacedName types.NamespacedName, policyKind, service string, idx int) string {
+func irIndexedExtServiceDestinationName(policyNamespacedName types.NamespacedName, policyKind string, idx int) string {
 	return strings.ToLower(fmt.Sprintf(
-		"%s/%s/%s/%d/%s",
+		"%s/%s/%s/%d",
 		policyKind,
 		policyNamespacedName.Namespace,
 		policyNamespacedName.Name,
-		idx,
-		service))
+		idx))
 }
diff --git a/internal/gatewayapi/filters.go b/internal/gatewayapi/filters.go
index c728e1e86..1cde4541f 100644
--- a/internal/gatewayapi/filters.go
+++ b/internal/gatewayapi/filters.go
@@ -64,7 +64,8 @@ func (t *Translator) ProcessHTTPFilters(parentRef *RouteParentContext,
 	route RouteContext,
 	filters []gwapiv1.HTTPRouteFilter,
 	ruleIdx int,
-	resources *Resources) *HTTPFiltersContext {
+	resources *Resources,
+) *HTTPFiltersContext {
 	httpFiltersContext := &HTTPFiltersContext{
 		ParentRef:    parentRef,
 		Route:        route,
@@ -107,7 +108,8 @@ func (t *Translator) ProcessHTTPFilters(parentRef *RouteParentContext,
 func (t *Translator) ProcessGRPCFilters(parentRef *RouteParentContext,
 	route RouteContext,
 	filters []v1alpha2.GRPCRouteFilter,
-	resources *Resources) *HTTPFiltersContext {
+	resources *Resources,
+) *HTTPFiltersContext {
 	httpFiltersContext := &HTTPFiltersContext{
 		ParentRef: parentRef,
 		Route:     route,
@@ -144,7 +146,8 @@ func (t *Translator) ProcessGRPCFilters(parentRef *RouteParentContext,
 
 func (t *Translator) processURLRewriteFilter(
 	rewrite *gwapiv1.HTTPURLRewriteFilter,
-	filterContext *HTTPFiltersContext) {
+	filterContext *HTTPFiltersContext,
+) {
 	if filterContext.URLRewrite != nil {
 		filterContext.ParentRef.SetCondition(filterContext.Route,
 			gwapiv1.RouteConditionAccepted,
@@ -246,7 +249,8 @@ func (t *Translator) processURLRewriteFilter(
 
 func (t *Translator) processRedirectFilter(
 	redirect *gwapiv1.HTTPRequestRedirectFilter,
-	filterContext *HTTPFiltersContext) {
+	filterContext *HTTPFiltersContext,
+) {
 	// Can't have two redirects for the same route
 	if filterContext.RedirectResponse != nil {
 		filterContext.ParentRef.SetCondition(filterContext.Route,
@@ -347,7 +351,8 @@ func (t *Translator) processRedirectFilter(
 
 func (t *Translator) processRequestHeaderModifierFilter(
 	headerModifier *gwapiv1.HTTPHeaderFilter,
-	filterContext *HTTPFiltersContext) {
+	filterContext *HTTPFiltersContext,
+) {
 	// Make sure the header modifier config actually exists
 	if headerModifier == nil {
 		return
@@ -500,7 +505,8 @@ func (t *Translator) processRequestHeaderModifierFilter(
 
 func (t *Translator) processResponseHeaderModifierFilter(
 	headerModifier *gwapiv1.HTTPHeaderFilter,
-	filterContext *HTTPFiltersContext) {
+	filterContext *HTTPFiltersContext,
+) {
 	// Make sure the header modifier config actually exists
 	if headerModifier == nil {
 		return
@@ -693,8 +699,8 @@ func (t *Translator) processRequestMirrorFilter(
 	filterIdx int,
 	mirrorFilter *gwapiv1.HTTPRequestMirrorFilter,
 	filterContext *HTTPFiltersContext,
-	resources *Resources) {
-
+	resources *Resources,
+) {
 	// Make sure the config actually exists
 	if mirrorFilter == nil {
 		return
diff --git a/internal/gatewayapi/resource.go b/internal/gatewayapi/resource.go
index f930801c2..7ba85502b 100644
--- a/internal/gatewayapi/resource.go
+++ b/internal/gatewayapi/resource.go
@@ -22,8 +22,10 @@ import (
 	"github.com/envoyproxy/gateway/internal/ir"
 )
 
-type XdsIRMap map[string]*ir.Xds
-type InfraIRMap map[string]*ir.Infra
+type (
+	XdsIRMap   map[string]*ir.Xds
+	InfraIRMap map[string]*ir.Infra
+)
 
 // Resources holds the Gateway API and related
 // resources that the translators needs as inputs.
diff --git a/internal/gatewayapi/route.go b/internal/gatewayapi/route.go
index 1b0ac613b..ce2efc55b 100644
--- a/internal/gatewayapi/route.go
+++ b/internal/gatewayapi/route.go
@@ -132,7 +132,7 @@ func (t *Translator) processHTTPRouteParentRefs(httpRoute *HTTPRouteContext, res
 			continue
 		}
 
-		var hasHostnameIntersection = t.processHTTPRouteParentRefListener(httpRoute, routeRoutes, parentRef, xdsIR)
+		hasHostnameIntersection := t.processHTTPRouteParentRefListener(httpRoute, routeRoutes, parentRef, xdsIR)
 		if !hasHostnameIntersection {
 			parentRef.SetCondition(httpRoute,
 				gwapiv1.RouteConditionAccepted,
@@ -391,7 +391,6 @@ func applyHTTPFiltersContextToIRRoute(httpFiltersContext *HTTPFiltersContext, ir
 	if len(httpFiltersContext.ExtensionRefs) > 0 {
 		irRoute.ExtensionRefs = httpFiltersContext.ExtensionRefs
 	}
-
 }
 
 func (t *Translator) processGRPCRouteParentRefs(grpcRoute *GRPCRouteContext, resources *Resources, xdsIR XdsIRMap) {
@@ -424,7 +423,7 @@ func (t *Translator) processGRPCRouteParentRefs(grpcRoute *GRPCRouteContext, res
 		if parentRef.HasCondition(grpcRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
 			continue
 		}
-		var hasHostnameIntersection = t.processHTTPRouteParentRefListener(grpcRoute, routeRoutes, parentRef, xdsIR)
+		hasHostnameIntersection := t.processHTTPRouteParentRefListener(grpcRoute, routeRoutes, parentRef, xdsIR)
 		if !hasHostnameIntersection {
 			parentRef.SetCondition(grpcRoute,
 				gwapiv1.RouteConditionAccepted,
@@ -801,7 +800,8 @@ func (t *Translator) processTLSRouteParentRefs(tlsRoute *TLSRouteContext, resour
 }
 
 func (t *Translator) ProcessUDPRoutes(udpRoutes []*gwapiv1a2.UDPRoute, gateways []*GatewayContext, resources *Resources,
-	xdsIR XdsIRMap) []*UDPRouteContext {
+	xdsIR XdsIRMap,
+) []*UDPRouteContext {
 	var relevantUDPRoutes []*UDPRouteContext
 
 	for _, u := range udpRoutes {
@@ -932,7 +932,8 @@ func (t *Translator) processUDPRouteParentRefs(udpRoute *UDPRouteContext, resour
 }
 
 func (t *Translator) ProcessTCPRoutes(tcpRoutes []*gwapiv1a2.TCPRoute, gateways []*GatewayContext, resources *Resources,
-	xdsIR XdsIRMap) []*TCPRouteContext {
+	xdsIR XdsIRMap,
+) []*TCPRouteContext {
 	var relevantTCPRoutes []*TCPRouteContext
 
 	for _, tcp := range tcpRoutes {
@@ -1068,7 +1069,8 @@ func (t *Translator) processTCPRouteParentRefs(tcpRoute *TCPRouteContext, resour
 func (t *Translator) processDestination(backendRefContext BackendRefContext,
 	parentRef *RouteParentContext,
 	route RouteContext,
-	resources *Resources) (ds *ir.DestinationSetting, backendWeight uint32) {
+	resources *Resources,
+) (ds *ir.DestinationSetting, backendWeight uint32) {
 	routeType := GetRouteType(route)
 	weight := uint32(1)
 	backendRef := GetBackendRef(backendRefContext)
diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
index f03e46590..6723376c0 100644
--- a/internal/gatewayapi/securitypolicy.go
+++ b/internal/gatewayapi/securitypolicy.go
@@ -45,7 +45,8 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
 	gateways []*GatewayContext,
 	routes []RouteContext,
 	resources *Resources,
-	xdsIR XdsIRMap) []*egv1a1.SecurityPolicy {
+	xdsIR XdsIRMap,
+) []*egv1a1.SecurityPolicy {
 	var res []*egv1a1.SecurityPolicy
 
 	// Sort based on timestamp
@@ -225,7 +226,8 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
 
 func resolveSecurityPolicyGatewayTargetRef(
 	policy *egv1a1.SecurityPolicy,
-	gateways map[types.NamespacedName]*policyGatewayTargetContext) (*GatewayContext, *status.PolicyResolveError) {
+	gateways map[types.NamespacedName]*policyGatewayTargetContext,
+) (*GatewayContext, *status.PolicyResolveError) {
 	targetNs := policy.Spec.TargetRef.Namespace
 	// If empty, default to namespace of policy
 	if targetNs == nil {
@@ -278,7 +280,8 @@ func resolveSecurityPolicyGatewayTargetRef(
 
 func resolveSecurityPolicyRouteTargetRef(
 	policy *egv1a1.SecurityPolicy,
-	routes map[policyTargetRouteKey]*policyRouteTargetContext) (RouteContext, *status.PolicyResolveError) {
+	routes map[policyTargetRouteKey]*policyRouteTargetContext,
+) (RouteContext, *status.PolicyResolveError) {
 	targetNs := policy.Spec.TargetRef.Namespace
 	// If empty, default to namespace of policy
 	if targetNs == nil {
@@ -333,7 +336,8 @@ func resolveSecurityPolicyRouteTargetRef(
 
 func (t *Translator) translateSecurityPolicyForRoute(
 	policy *egv1a1.SecurityPolicy, route RouteContext,
-	resources *Resources, xdsIR XdsIRMap) error {
+	resources *Resources, xdsIR XdsIRMap,
+) error {
 	// Build IR
 	var (
 		cors      *ir.CORS
@@ -404,7 +408,8 @@ func (t *Translator) translateSecurityPolicyForRoute(
 
 func (t *Translator) translateSecurityPolicyForGateway(
 	policy *egv1a1.SecurityPolicy, gateway *GatewayContext,
-	resources *Resources, xdsIR XdsIRMap) error {
+	resources *Resources, xdsIR XdsIRMap,
+) error {
 	// Build IR
 	var (
 		cors      *ir.CORS
@@ -534,7 +539,8 @@ func (t *Translator) buildJWT(jwt *egv1a1.JWT) *ir.JWT {
 
 func (t *Translator) buildOIDC(
 	policy *egv1a1.SecurityPolicy,
-	resources *Resources) (*ir.OIDC, error) {
+	resources *Resources,
+) (*ir.OIDC, error) {
 	var (
 		oidc         = policy.Spec.OIDC
 		clientSecret *v1.Secret
@@ -726,7 +732,8 @@ func validateTokenEndpoint(tokenEndpoint string) error {
 
 func (t *Translator) buildBasicAuth(
 	policy *egv1a1.SecurityPolicy,
-	resources *Resources) (*ir.BasicAuth, error) {
+	resources *Resources,
+) (*ir.BasicAuth, error) {
 	var (
 		basicAuth   = policy.Spec.BasicAuth
 		usersSecret *v1.Secret
@@ -758,7 +765,8 @@ func (t *Translator) buildBasicAuth(
 
 func (t *Translator) buildExtAuth(
 	policy *egv1a1.SecurityPolicy,
-	resources *Resources) (*ir.ExtAuth, error) {
+	resources *Resources,
+) (*ir.ExtAuth, error) {
 	var (
 		http       = policy.Spec.ExtAuth.HTTP
 		grpc       = policy.Spec.ExtAuth.GRPC
diff --git a/internal/gatewayapi/sort.go b/internal/gatewayapi/sort.go
index 75d9ebc50..c11787a60 100644
--- a/internal/gatewayapi/sort.go
+++ b/internal/gatewayapi/sort.go
@@ -16,7 +16,6 @@ type XdsIRRoutes []*ir.HTTPRoute
 func (x XdsIRRoutes) Len() int      { return len(x) }
 func (x XdsIRRoutes) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
 func (x XdsIRRoutes) Less(i, j int) bool {
-
 	// 1. Sort based on path match type
 	// Exact > RegularExpression > PathPrefix
 	if x[i].PathMatch != nil && x[i].PathMatch.Exact != nil {
diff --git a/internal/gatewayapi/tls.go b/internal/gatewayapi/tls.go
index f37c53b95..cc01c4c56 100644
--- a/internal/gatewayapi/tls.go
+++ b/internal/gatewayapi/tls.go
@@ -57,7 +57,6 @@ func validateTLSSecretsData(secrets []*corev1.Secret, host *v1.Hostname) error {
 		if matchedFQDN, ok := pkaSecretSet[pkaSecretKey]; ok {
 			return fmt.Errorf("%s/%s public key algorithm must be unique, matched certificate FQDN %s has a conflicting algorithm [%s]",
 				secret.Namespace, secret.Name, matchedFQDN, publicKeyAlgorithm)
-
 		}
 		pkaSecretSet[pkaSecretKey] = matchedFQDN
 
diff --git a/internal/gatewayapi/translator.go b/internal/gatewayapi/translator.go
index 9dc935324..1827d962d 100644
--- a/internal/gatewayapi/translator.go
+++ b/internal/gatewayapi/translator.go
@@ -115,7 +115,8 @@ func newTranslateResult(gateways []*GatewayContext,
 	securityPolicies []*egv1a1.SecurityPolicy,
 	backendTLSPolicies []*egv1a2.BackendTLSPolicy,
 	envoyExtensionPolicies []*egv1a1.EnvoyExtensionPolicy,
-	xdsIR XdsIRMap, infraIR InfraIRMap) *TranslateResult {
+	xdsIR XdsIRMap, infraIR InfraIRMap,
+) *TranslateResult {
 	translateResult := &TranslateResult{
 		XdsIR:   xdsIR,
 		InfraIR: infraIR,
@@ -220,7 +221,6 @@ func (t *Translator) Translate(resources *Resources) *TranslateResult {
 		tcpRoutes, udpRoutes, clientTrafficPolicies, backendTrafficPolicies,
 		securityPolicies, resources.BackendTLSPolicies, envoyExtensionPolicies,
 		xdsIR, infraIR)
-
 }
 
 // GetRelevantGateways returns GatewayContexts, containing a copy of the original
diff --git a/internal/gatewayapi/validate.go b/internal/gatewayapi/validate.go
index e7ddb427a..09561698c 100644
--- a/internal/gatewayapi/validate.go
+++ b/internal/gatewayapi/validate.go
@@ -23,7 +23,8 @@ import (
 )
 
 func (t *Translator) validateBackendRef(backendRefContext BackendRefContext, parentRef *RouteParentContext, route RouteContext,
-	resources *Resources, backendNamespace string, routeKind gwapiv1.Kind) bool {
+	resources *Resources, backendNamespace string, routeKind gwapiv1.Kind,
+) bool {
 	if !t.validateBackendRefFilters(backendRefContext, parentRef, route, routeKind) {
 		return false
 	}
@@ -112,7 +113,8 @@ func (t *Translator) validateBackendRefFilters(backendRef BackendRefContext, par
 }
 
 func (t *Translator) validateBackendNamespace(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext,
-	resources *Resources, routeKind gwapiv1.Kind) bool {
+	resources *Resources, routeKind gwapiv1.Kind,
+) bool {
 	if backendRef.Namespace != nil && string(*backendRef.Namespace) != "" && string(*backendRef.Namespace) != route.GetNamespace() {
 		if !t.validateCrossNamespaceRef(
 			crossNamespaceFrom{
@@ -152,8 +154,10 @@ func (t *Translator) validateBackendPort(backendRef *gwapiv1a2.BackendRef, paren
 	}
 	return true
 }
+
 func (t *Translator) validateBackendService(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, resources *Resources,
-	serviceNamespace string, route RouteContext, protocol v1.Protocol) bool {
+	serviceNamespace string, route RouteContext, protocol v1.Protocol,
+) bool {
 	service := resources.GetService(serviceNamespace, string(backendRef.Name))
 	if service == nil {
 		parentRef.SetCondition(route,
@@ -191,7 +195,8 @@ func (t *Translator) validateBackendService(backendRef *gwapiv1a2.BackendRef, pa
 }
 
 func (t *Translator) validateBackendServiceImport(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, resources *Resources,
-	serviceImportNamespace string, route RouteContext, protocol v1.Protocol) bool {
+	serviceImportNamespace string, route RouteContext, protocol v1.Protocol,
+) bool {
 	serviceImport := resources.GetServiceImport(serviceImportNamespace, string(backendRef.Name))
 	if serviceImport == nil {
 		parentRef.SetCondition(route,
@@ -767,8 +772,8 @@ func (t *Translator) validateSecretRef(
 	allowCrossNamespace bool,
 	from crossNamespaceFrom,
 	secretObjRef gwapiv1b1.SecretObjectReference,
-	resources *Resources) (*v1.Secret, error) {
-
+	resources *Resources,
+) (*v1.Secret, error) {
 	if err := t.validateSecretObjectRef(allowCrossNamespace, from, secretObjRef, resources); err != nil {
 		return nil, err
 	}
@@ -791,8 +796,8 @@ func (t *Translator) validateConfigMapRef(
 	allowCrossNamespace bool,
 	from crossNamespaceFrom,
 	secretObjRef gwapiv1b1.SecretObjectReference,
-	resources *Resources) (*v1.ConfigMap, error) {
-
+	resources *Resources,
+) (*v1.ConfigMap, error) {
 	if err := t.validateSecretObjectRef(allowCrossNamespace, from, secretObjRef, resources); err != nil {
 		return nil, err
 	}
@@ -815,7 +820,8 @@ func (t *Translator) validateSecretObjectRef(
 	allowCrossNamespace bool,
 	from crossNamespaceFrom,
 	secretRef gwapiv1b1.SecretObjectReference,
-	resources *Resources) error {
+	resources *Resources,
+) error {
 	var kind string
 	if secretRef.Group != nil && string(*secretRef.Group) != "" {
 		return errors.New("secret ref group must be unspecified/empty")
@@ -875,8 +881,8 @@ func (t *Translator) validateSecretObjectRef(
 func (t *Translator) validateExtServiceBackendReference(
 	backendRef *gwapiv1.BackendObjectReference,
 	ownerNamespace string,
-	resources *Resources) error {
-
+	resources *Resources,
+) error {
 	// These are sanity checks, they should never happen because the API server
 	// should have caught them
 	if backendRef.Group != nil && *backendRef.Group != "" {
diff --git a/internal/infrastructure/kubernetes/proxy/resource.go b/internal/infrastructure/kubernetes/proxy/resource.go
index 323d2593d..f74481f28 100644
--- a/internal/infrastructure/kubernetes/proxy/resource.go
+++ b/internal/infrastructure/kubernetes/proxy/resource.go
@@ -102,7 +102,8 @@ func enablePrometheus(infra *ir.ProxyInfra) bool {
 // expectedProxyContainers returns expected proxy containers.
 func expectedProxyContainers(infra *ir.ProxyInfra,
 	containerSpec *egv1a1.KubernetesContainerSpec,
-	shutdownConfig *egv1a1.ShutdownConfig) ([]corev1.Container, error) {
+	shutdownConfig *egv1a1.ShutdownConfig,
+) ([]corev1.Container, error) {
 	// Define slice to hold container ports
 	var ports []corev1.ContainerPort
 
diff --git a/internal/infrastructure/kubernetes/ratelimit/resource.go b/internal/infrastructure/kubernetes/ratelimit/resource.go
index 9f6303247..6ab5b1943 100644
--- a/internal/infrastructure/kubernetes/ratelimit/resource.go
+++ b/internal/infrastructure/kubernetes/ratelimit/resource.go
@@ -115,7 +115,6 @@ func GetServiceURL(namespace string, dnsDomain string) string {
 
 // LabelSelector returns the string slice form labels used for all envoy rate limit resources.
 func LabelSelector() []string {
-
 	rlLabelMap := rateLimitLabels()
 	retLabels := make([]string, 0, len(rlLabelMap))
 
@@ -138,7 +137,8 @@ func rateLimitLabels() map[string]string {
 
 // expectedRateLimitContainers returns expected rateLimit containers.
 func expectedRateLimitContainers(rateLimit *egv1a1.RateLimit, rateLimitDeployment *egv1a1.KubernetesDeploymentSpec,
-	namespace string) []corev1.Container {
+	namespace string,
+) []corev1.Container {
 	ports := []corev1.ContainerPort{
 		{
 			Name:          "grpc",
@@ -289,7 +289,8 @@ func expectedDeploymentVolumes(rateLimit *egv1a1.RateLimit, rateLimitDeployment
 
 // expectedRateLimitContainerEnv returns expected rateLimit container envs.
 func expectedRateLimitContainerEnv(rateLimit *egv1a1.RateLimit, rateLimitDeployment *egv1a1.KubernetesDeploymentSpec,
-	namespace string) []corev1.EnvVar {
+	namespace string,
+) []corev1.EnvVar {
 	env := []corev1.EnvVar{
 		{
 			Name:  RuntimeRootEnvVar,
@@ -399,7 +400,7 @@ func expectedRateLimitContainerEnv(rateLimit *egv1a1.RateLimit, rateLimitDeploym
 	}
 
 	if enableTracing(rateLimit) {
-		var sampleRate = 1.0
+		sampleRate := 1.0
 		if rateLimit.Telemetry.Tracing.SamplingRate != nil {
 			sampleRate = float64(*rateLimit.Telemetry.Tracing.SamplingRate) / 100.0
 		}
diff --git a/internal/infrastructure/runner/runner.go b/internal/infrastructure/runner/runner.go
index 8da18e464..d9376eb84 100644
--- a/internal/infrastructure/runner/runner.go
+++ b/internal/infrastructure/runner/runner.go
@@ -44,7 +44,7 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 		return err
 	}
 
-	var initInfra = func() {
+	initInfra := func() {
 		go r.subscribeToProxyInfraIR(ctx)
 
 		// Enable global ratelimit if it has been configured.
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index e28df915e..337720f7f 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -1909,6 +1909,17 @@ type ConnectionLimit struct {
 	CloseDelay *metav1.Duration `json:"closeDelay,omitempty" yaml:"closeDelay,omitempty"`
 }
 
+type ExtProcBodyProcessingMode egv1a1.ExtProcBodyProcessingMode
+
+const (
+	// ExtProcBodyStreamed sets the streamed body processing mode
+	ExtProcBodyStreamed = ExtProcBodyProcessingMode(egv1a1.StreamedExtProcBodyProcessingMode)
+	// ExtProcBodyBuffered sets the buffered body processing mode
+	ExtProcBodyBuffered = ExtProcBodyProcessingMode(egv1a1.BufferedExtProcBodyProcessingMode)
+	// ExtProcBodyBufferedPartial sets the partial buffered body processing mode
+	ExtProcBodyBufferedPartial = ExtProcBodyProcessingMode(egv1a1.BufferedPartialExtBodyHeaderProcessingMode)
+)
+
 // ExtProc holds the information associated with the ExtProc extensions.
 // +k8s:deepcopy-gen=true
 type ExtProc struct {
@@ -1917,10 +1928,29 @@ type ExtProc struct {
 	Name string `json:"name" yaml:"name"`
 
 	// Destination defines the destination for the gRPC External Processing service.
-	Destination RouteDestination `json:"destination"`
+	Destination RouteDestination `json:"destination" yaml:"destination"`
 
 	// Authority is the hostname:port of the HTTP External Processing service.
-	Authority string `json:"authority"`
+	Authority string `json:"authority" yaml:"authority"`
+
+	// MessageTimeout is the timeout for a response to be returned from the external processor
+	MessageTimeout *metav1.Duration `json:"messageTimeout,omitempty" yaml:"messageTimeout,omitempty"`
+
+	// FailOpen defines if requests or responses that cannot be processed due to connectivity to the
+	// external processor are terminated or passed-through.
+	FailOpen *bool `json:"failOpen,omitempty" yaml:"failOpen,omitempty"`
+
+	// RequestHeaderProcessing Defines if request headers are processed
+	RequestHeaderProcessing bool `json:"requestHeaderProcessing,omitempty" yaml:"requestHeaderProcessing,omitempty"`
+
+	// RequestBodyProcessingMode Defines request body processing
+	RequestBodyProcessingMode *ExtProcBodyProcessingMode `json:"requestBodyProcessingMode,omitempty" yaml:"requestBodyProcessingMode,omitempty"`
+
+	// ResponseHeaderProcessingMode Defines if response headers are processed
+	ResponseHeaderProcessing bool `json:"responseHeaderProcessing,omitempty" yaml:"responseHeaderProcessing,omitempty"`
+
+	// ResponseBodyProcessingMode Defines response body processing
+	ResponseBodyProcessingMode *ExtProcBodyProcessingMode `json:"responseBodyProcessingMode,omitempty" yaml:"responseBodyProcessingMode,omitempty"`
 }
 
 // Wasm holds the information associated with the Wasm extensions.
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index 21f6cdf87..5430ef9ce 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -532,6 +532,26 @@ func (in *ExtAuth) DeepCopy() *ExtAuth {
 func (in *ExtProc) DeepCopyInto(out *ExtProc) {
 	*out = *in
 	in.Destination.DeepCopyInto(&out.Destination)
+	if in.MessageTimeout != nil {
+		in, out := &in.MessageTimeout, &out.MessageTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.FailOpen != nil {
+		in, out := &in.FailOpen, &out.FailOpen
+		*out = new(bool)
+		**out = **in
+	}
+	if in.RequestBodyProcessingMode != nil {
+		in, out := &in.RequestBodyProcessingMode, &out.RequestBodyProcessingMode
+		*out = new(ExtProcBodyProcessingMode)
+		**out = **in
+	}
+	if in.ResponseBodyProcessingMode != nil {
+		in, out := &in.ResponseBodyProcessingMode, &out.ResponseBodyProcessingMode
+		*out = new(ExtProcBodyProcessingMode)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtProc.
diff --git a/internal/kubernetes/port_forwarder.go b/internal/kubernetes/port_forwarder.go
index ceb439d77..176610dab 100644
--- a/internal/kubernetes/port_forwarder.go
+++ b/internal/kubernetes/port_forwarder.go
@@ -86,7 +86,6 @@ func (f *localForwarder) Start() error {
 
 			readyCh = nil
 		}
-
 	}()
 
 	select {
diff --git a/internal/logging/log.go b/internal/logging/log.go
index 0d6d36f8f..8f90a9c8e 100644
--- a/internal/logging/log.go
+++ b/internal/logging/log.go
@@ -34,7 +34,7 @@ func NewLogger(logging *v1alpha1.EnvoyGatewayLogging) Logger {
 }
 
 func FileLogger(file string, name string, level v1alpha1.LogLevel) Logger {
-	writer, err := os.OpenFile(file, os.O_WRONLY, 0666)
+	writer, err := os.OpenFile(file, os.O_WRONLY, 0o666)
 	if err != nil {
 		panic(err)
 	}
diff --git a/internal/message/watchutil.go b/internal/message/watchutil.go
index b938f276b..bd7829f3c 100644
--- a/internal/message/watchutil.go
+++ b/internal/message/watchutil.go
@@ -49,7 +49,7 @@ func HandleSubscription[K comparable, V any](
 	subscription <-chan watchable.Snapshot[K, V],
 	handle func(updateFunc Update[K, V], errChans chan error),
 ) {
-	//TODO: find a suitable value
+	// TODO: find a suitable value
 	errChans := make(chan error, 10)
 	go func() {
 		for err := range errChans {
diff --git a/internal/metrics/metadata.go b/internal/metrics/metadata.go
index f2ab84984..255619bbd 100644
--- a/internal/metrics/metadata.go
+++ b/internal/metrics/metadata.go
@@ -94,7 +94,8 @@ func (d *store) preAddOptions() []metric.Option {
 			metric.Stream{
 				Aggregation: metric.AggregationExplicitBucketHistogram{
 					Boundaries: store.Bounds,
-				}},
+				},
+			},
 		))
 		opts = append(opts, v)
 	}
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index 571a45c57..93ce3fe91 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -59,7 +59,8 @@ type gatewayAPIReconciler struct {
 
 // newGatewayAPIController
 func newGatewayAPIController(mgr manager.Manager, cfg *config.Server, su status.Updater,
-	resources *message.ProviderResources) error {
+	resources *message.ProviderResources,
+) error {
 	ctx := context.Background()
 
 	// Gather additional resources to watch from registered extensions
@@ -374,7 +375,8 @@ func (r *gatewayAPIReconciler) processBackendRefs(ctx context.Context, gwcResour
 // - Secrets for OIDC and BasicAuth
 // - BackendRefs for ExAuth
 func (r *gatewayAPIReconciler) processSecurityPolicyObjectRefs(
-	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings) {
+	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings,
+) {
 	// we don't return errors from this method, because we want to continue reconciling
 	// the rest of the SecurityPolicies despite that one reference is invalid. This
 	// allows Envoy Gateway to continue serving traffic even if some SecurityPolicies
@@ -477,7 +479,6 @@ func (r *gatewayAPIReconciler) processOIDCHMACSecret(ctx context.Context, resour
 		types.NamespacedName{Namespace: r.namespace, Name: oidcHMACSecretName},
 		&secret,
 	)
-
 	// We don't return an error here, because we want to continue reconciling
 	// despite that the OIDC HMAC secret can't be found.
 	// If the OIDC HMAC Secret is missing, the SecurityPolicy with OIDC will be
@@ -550,7 +551,8 @@ func (r *gatewayAPIReconciler) processSecretRef(
 // processCtpConfigMapRefs adds the referenced ConfigMaps in ClientTrafficPolicies
 // to the resourceTree
 func (r *gatewayAPIReconciler) processCtpConfigMapRefs(
-	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings) {
+	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings,
+) {
 	for _, policy := range resourceTree.ClientTrafficPolicies {
 		tls := policy.Spec.TLS
 
@@ -734,7 +736,6 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 							gtw.Namespace,
 							gtw.Name,
 							certRef); err != nil {
-
 							r.log.Error(err,
 								"failed to process TLS SecretRef for gateway",
 								"gateway", gtw, "secretRef", certRef)
@@ -799,7 +800,8 @@ func (r *gatewayAPIReconciler) processEnvoyPatchPolicies(ctx context.Context, re
 
 // processClientTrafficPolicies adds ClientTrafficPolicies to the resourceTree
 func (r *gatewayAPIReconciler) processClientTrafficPolicies(
-	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings) error {
+	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings,
+) error {
 	clientTrafficPolicies := egv1a1.ClientTrafficPolicyList{}
 	if err := r.client.List(ctx, &clientTrafficPolicies); err != nil {
 		return fmt.Errorf("error listing ClientTrafficPolicies: %w", err)
@@ -837,7 +839,8 @@ func (r *gatewayAPIReconciler) processBackendTrafficPolicies(ctx context.Context
 
 // processSecurityPolicies adds SecurityPolicies and their referenced resources to the resourceTree
 func (r *gatewayAPIReconciler) processSecurityPolicies(
-	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings) error {
+	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings,
+) error {
 	securityPolicies := egv1a1.SecurityPolicyList{}
 	if err := r.client.List(ctx, &securityPolicies); err != nil {
 		return fmt.Errorf("error listing SecurityPolicies: %w", err)
@@ -861,7 +864,8 @@ func (r *gatewayAPIReconciler) processSecurityPolicies(
 
 // processBackendTLSPolicies adds BackendTLSPolicies and their referenced resources to the resourceTree
 func (r *gatewayAPIReconciler) processBackendTLSPolicies(
-	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings) error {
+	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings,
+) error {
 	backendTLSPolicies := gwapiv1a2.BackendTLSPolicyList{}
 	if err := r.client.List(ctx, &backendTLSPolicies); err != nil {
 		return fmt.Errorf("error listing BackendTLSPolicies: %w", err)
@@ -1435,7 +1439,8 @@ func (r *gatewayAPIReconciler) processBackendTLSPolicyConfigMapRefs(ctx context.
 
 // processEnvoyExtensionPolicies adds EnvoyExtensionPolicies and their referenced resources to the resourceTree
 func (r *gatewayAPIReconciler) processEnvoyExtensionPolicies(
-	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings) error {
+	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings,
+) error {
 	envoyExtensionPolicies := egv1a1.EnvoyExtensionPolicyList{}
 	if err := r.client.List(ctx, &envoyExtensionPolicies); err != nil {
 		return fmt.Errorf("error listing EnvoyExtensionPolicies: %w", err)
@@ -1459,7 +1464,8 @@ func (r *gatewayAPIReconciler) processEnvoyExtensionPolicies(
 // to the resourceTree
 // - BackendRefs for ExtProcs
 func (r *gatewayAPIReconciler) processEnvoyExtensionPolicyObjectRefs(
-	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings) {
+	ctx context.Context, resourceTree *gatewayapi.Resources, resourceMap *resourceMappings,
+) {
 	// we don't return errors from this method, because we want to continue reconciling
 	// the rest of the EnvoyExtensionPolicies despite that one reference is invalid. This
 	// allows Envoy Gateway to continue serving traffic even if some EnvoyExtensionPolicies
@@ -1470,38 +1476,40 @@ func (r *gatewayAPIReconciler) processEnvoyExtensionPolicyObjectRefs(
 	for _, policy := range resourceTree.EnvoyExtensionPolicies {
 		// Add the referenced BackendRefs and ReferenceGrants in ExtAuth to Maps for later processing
 		for _, ep := range policy.Spec.ExtProc {
-			backendRef := ep.BackendRef.BackendObjectReference
-
-			backendNamespace := gatewayapi.NamespaceDerefOr(backendRef.Namespace, policy.Namespace)
-			resourceMap.allAssociatedBackendRefs[gwapiv1.BackendObjectReference{
-				Group:     backendRef.Group,
-				Kind:      backendRef.Kind,
-				Namespace: gatewayapi.NamespacePtrV1Alpha2(backendNamespace),
-				Name:      backendRef.Name,
-			}] = struct{}{}
-
-			if backendNamespace != policy.Namespace {
-				from := ObjectKindNamespacedName{
-					kind:      gatewayapi.KindHTTPRoute,
-					namespace: policy.Namespace,
-					name:      policy.Name,
-				}
-				to := ObjectKindNamespacedName{
-					kind:      gatewayapi.KindDerefOr(backendRef.Kind, gatewayapi.KindService),
-					namespace: backendNamespace,
-					name:      string(backendRef.Name),
-				}
-				refGrant, err := r.findReferenceGrant(ctx, from, to)
-				switch {
-				case err != nil:
-					r.log.Error(err, "failed to find ReferenceGrant")
-				case refGrant == nil:
-					r.log.Info("no matching ReferenceGrants found", "from", from.kind,
-						"from namespace", from.namespace, "target", to.kind, "target namespace", to.namespace)
-				default:
-					resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
-					r.log.Info("added ReferenceGrant to resource map", "namespace", refGrant.Namespace,
-						"name", refGrant.Name)
+			for _, br := range ep.BackendRefs {
+				backendRef := br.BackendObjectReference
+
+				backendNamespace := gatewayapi.NamespaceDerefOr(backendRef.Namespace, policy.Namespace)
+				resourceMap.allAssociatedBackendRefs[gwapiv1.BackendObjectReference{
+					Group:     backendRef.Group,
+					Kind:      backendRef.Kind,
+					Namespace: gatewayapi.NamespacePtrV1Alpha2(backendNamespace),
+					Name:      backendRef.Name,
+				}] = struct{}{}
+
+				if backendNamespace != policy.Namespace {
+					from := ObjectKindNamespacedName{
+						kind:      gatewayapi.KindHTTPRoute,
+						namespace: policy.Namespace,
+						name:      policy.Name,
+					}
+					to := ObjectKindNamespacedName{
+						kind:      gatewayapi.KindDerefOr(backendRef.Kind, gatewayapi.KindService),
+						namespace: backendNamespace,
+						name:      string(backendRef.Name),
+					}
+					refGrant, err := r.findReferenceGrant(ctx, from, to)
+					switch {
+					case err != nil:
+						r.log.Error(err, "failed to find ReferenceGrant")
+					case refGrant == nil:
+						r.log.Info("no matching ReferenceGrants found", "from", from.kind,
+							"from namespace", from.namespace, "target", to.kind, "target namespace", to.namespace)
+					default:
+						resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
+						r.log.Info("added ReferenceGrant to resource map", "namespace", refGrant.Namespace,
+							"name", refGrant.Name)
+					}
 				}
 			}
 		}
diff --git a/internal/provider/kubernetes/helpers.go b/internal/provider/kubernetes/helpers.go
index 00029f1cb..d3a1d972a 100644
--- a/internal/provider/kubernetes/helpers.go
+++ b/internal/provider/kubernetes/helpers.go
@@ -36,8 +36,8 @@ type ObjectKindNamespacedName struct {
 // is a Gateway.
 func validateParentRefs(ctx context.Context, client client.Client, namespace string,
 	gatewayClassController gwapiv1.GatewayController,
-	routeParentReferences []gwapiv1.ParentReference) ([]gwapiv1.Gateway, error) {
-
+	routeParentReferences []gwapiv1.ParentReference,
+) ([]gwapiv1.Gateway, error) {
 	var gateways []gwapiv1.Gateway
 	for i := range routeParentReferences {
 		ref := routeParentReferences[i]
diff --git a/internal/provider/kubernetes/indexers.go b/internal/provider/kubernetes/indexers.go
index ac1132b31..44526e1e9 100644
--- a/internal/provider/kubernetes/indexers.go
+++ b/internal/provider/kubernetes/indexers.go
@@ -38,7 +38,7 @@ const (
 	configMapCtpIndex                = "configMapCtpIndex"
 	secretCtpIndex                   = "secretCtpIndex"
 	configMapBtlsIndex               = "configMapBtlsIndex"
-	backendEnvoyExtensionPolicyIndex = "backendSecurityPolicyIndex"
+	backendEnvoyExtensionPolicyIndex = "backendEnvoyExtensionPolicyIndex"
 )
 
 func addReferenceGrantIndexers(ctx context.Context, mgr manager.Manager) error {
@@ -535,12 +535,16 @@ func backendEnvoyExtensionPolicyIndexFunc(rawObj client.Object) []string {
 	var ret []string
 
 	for _, ep := range envoyExtensionPolicy.Spec.ExtProc {
-		backendRef := ep.BackendRef.BackendObjectReference
-		ret = append(ret,
-			types.NamespacedName{
-				Namespace: gatewayapi.NamespaceDerefOr(backendRef.Namespace, envoyExtensionPolicy.Namespace),
-				Name:      string(backendRef.Name),
-			}.String())
+
+		for _, br := range ep.BackendRefs {
+			backendRef := br.BackendObjectReference
+			ret = append(ret,
+				types.NamespacedName{
+					Namespace: gatewayapi.NamespaceDerefOr(backendRef.Namespace, envoyExtensionPolicy.Namespace),
+					Name:      string(backendRef.Name),
+				}.String())
+		}
+
 	}
 
 	return ret
diff --git a/internal/provider/kubernetes/predicates.go b/internal/provider/kubernetes/predicates.go
index f25c00923..4faf3d0d5 100644
--- a/internal/provider/kubernetes/predicates.go
+++ b/internal/provider/kubernetes/predicates.go
@@ -69,7 +69,6 @@ type NamespaceGetter interface {
 
 // checkObjectNamespaceLabels checks if labels of namespace of the object is a subset of namespaceLabels
 func (r *gatewayAPIReconciler) checkObjectNamespaceLabels(obj metav1.Object) (bool, error) {
-
 	var nsString string
 	// TODO: it requires extra condition validate cluster resources or resources without namespace?
 	if nsString = obj.GetNamespace(); len(nsString) == 0 {
diff --git a/internal/provider/kubernetes/routes.go b/internal/provider/kubernetes/routes.go
index 20d690f57..b1b2524e2 100644
--- a/internal/provider/kubernetes/routes.go
+++ b/internal/provider/kubernetes/routes.go
@@ -23,7 +23,8 @@ import (
 // processTLSRoutes finds TLSRoutes corresponding to a gatewayNamespaceName, further checks for
 // the backend references and pushes the TLSRoutes to the resourceTree.
 func (r *gatewayAPIReconciler) processTLSRoutes(ctx context.Context, gatewayNamespaceName string,
-	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
+	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources,
+) error {
 	tlsRouteList := &gwapiv1a2.TLSRouteList{}
 	if err := r.client.List(ctx, tlsRouteList, &client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(gatewayTLSRouteIndex, gatewayNamespaceName),
@@ -93,7 +94,8 @@ func (r *gatewayAPIReconciler) processTLSRoutes(ctx context.Context, gatewayName
 // processGRPCRoutes finds GRPCRoutes corresponding to a gatewayNamespaceName, further checks for
 // the backend references and pushes the GRPCRoutes to the resourceTree.
 func (r *gatewayAPIReconciler) processGRPCRoutes(ctx context.Context, gatewayNamespaceName string,
-	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
+	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources,
+) error {
 	grpcRouteList := &gwapiv1a2.GRPCRouteList{}
 
 	if err := r.client.List(ctx, grpcRouteList, &client.ListOptions{
@@ -203,7 +205,8 @@ func (r *gatewayAPIReconciler) processGRPCRoutes(ctx context.Context, gatewayNam
 // processHTTPRoutes finds HTTPRoutes corresponding to a gatewayNamespaceName, further checks for
 // the backend references and pushes the HTTPRoutes to the resourceTree.
 func (r *gatewayAPIReconciler) processHTTPRoutes(ctx context.Context, gatewayNamespaceName string,
-	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
+	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources,
+) error {
 	httpRouteList := &gwapiv1.HTTPRouteList{}
 
 	extensionRefFilters, err := r.getExtensionRefFilters(ctx)
@@ -376,7 +379,8 @@ func (r *gatewayAPIReconciler) processHTTPRoutes(ctx context.Context, gatewayNam
 // processTCPRoutes finds TCPRoutes corresponding to a gatewayNamespaceName, further checks for
 // the backend references and pushes the TCPRoutes to the resourceTree.
 func (r *gatewayAPIReconciler) processTCPRoutes(ctx context.Context, gatewayNamespaceName string,
-	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
+	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources,
+) error {
 	tcpRouteList := &gwapiv1a2.TCPRouteList{}
 	if err := r.client.List(ctx, tcpRouteList, &client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(gatewayTCPRouteIndex, gatewayNamespaceName),
@@ -446,7 +450,8 @@ func (r *gatewayAPIReconciler) processTCPRoutes(ctx context.Context, gatewayName
 // processUDPRoutes finds UDPRoutes corresponding to a gatewayNamespaceName, further checks for
 // the backend references and pushes the UDPRoutes to the resourceTree.
 func (r *gatewayAPIReconciler) processUDPRoutes(ctx context.Context, gatewayNamespaceName string,
-	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
+	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources,
+) error {
 	udpRouteList := &gwapiv1a2.UDPRouteList{}
 	if err := r.client.List(ctx, udpRouteList, &client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(gatewayUDPRouteIndex, gatewayNamespaceName),
diff --git a/internal/provider/kubernetes/secrets.go b/internal/provider/kubernetes/secrets.go
index ab67f6e16..953127e78 100644
--- a/internal/provider/kubernetes/secrets.go
+++ b/internal/provider/kubernetes/secrets.go
@@ -20,9 +20,7 @@ import (
 	"github.com/envoyproxy/gateway/internal/utils"
 )
 
-var (
-	ErrSecretExists = errors.New("skipped creating secret since it already exists")
-)
+var ErrSecretExists = errors.New("skipped creating secret since it already exists")
 
 // caCertificateKey is the key name for accessing TLS CA certificate bundles
 // in Kubernetes Secrets.
diff --git a/internal/provider/kubernetes/status.go b/internal/provider/kubernetes/status.go
index 5aa8af4fa..339886750 100644
--- a/internal/provider/kubernetes/status.go
+++ b/internal/provider/kubernetes/status.go
@@ -447,7 +447,8 @@ func (r *gatewayAPIReconciler) updateStatusForGatewayClass(
 	gc *gwapiv1.GatewayClass,
 	accepted bool,
 	reason,
-	msg string) error {
+	msg string,
+) error {
 	if r.statusUpdater != nil {
 		r.statusUpdater.Send(status.Update{
 			NamespacedName: types.NamespacedName{Name: gc.Name},
diff --git a/internal/status/conditions.go b/internal/status/conditions.go
index 092513184..955dc26a7 100644
--- a/internal/status/conditions.go
+++ b/internal/status/conditions.go
@@ -34,7 +34,8 @@ const (
 // computeGatewayClassAcceptedCondition computes the GatewayClass Accepted status condition.
 func computeGatewayClassAcceptedCondition(gatewayClass *gwapiv1.GatewayClass,
 	accepted bool,
-	reason, msg string) metav1.Condition {
+	reason, msg string,
+) metav1.Condition {
 	switch accepted {
 	case true:
 		return metav1.Condition{
diff --git a/internal/status/policy.go b/internal/status/policy.go
index e60b52d40..a5c7a21a9 100644
--- a/internal/status/policy.go
+++ b/internal/status/policy.go
@@ -59,15 +59,16 @@ func setAcceptedForPolicyAncestor(policyStatus *gwv1a2.PolicyStatus, ancestorRef
 }
 
 func SetConditionForPolicyAncestors(policyStatus *gwv1a2.PolicyStatus, ancestorRefs []gwv1a2.ParentReference, controllerName string,
-	conditionType gwv1a2.PolicyConditionType, status metav1.ConditionStatus, reason gwv1a2.PolicyConditionReason, message string, generation int64) {
+	conditionType gwv1a2.PolicyConditionType, status metav1.ConditionStatus, reason gwv1a2.PolicyConditionReason, message string, generation int64,
+) {
 	for _, ancestorRef := range ancestorRefs {
 		SetConditionForPolicyAncestor(policyStatus, ancestorRef, controllerName, conditionType, status, reason, message, generation)
 	}
 }
 
 func SetConditionForPolicyAncestor(policyStatus *gwv1a2.PolicyStatus, ancestorRef gwv1a2.ParentReference, controllerName string,
-	conditionType gwv1a2.PolicyConditionType, status metav1.ConditionStatus, reason gwv1a2.PolicyConditionReason, message string, generation int64) {
-
+	conditionType gwv1a2.PolicyConditionType, status metav1.ConditionStatus, reason gwv1a2.PolicyConditionReason, message string, generation int64,
+) {
 	if policyStatus.Ancestors == nil {
 		policyStatus.Ancestors = []gwv1a2.PolicyAncestorStatus{}
 	}
diff --git a/internal/utils/file/file.go b/internal/utils/file/file.go
index 369920b0f..51a025714 100644
--- a/internal/utils/file/file.go
+++ b/internal/utils/file/file.go
@@ -11,7 +11,7 @@ import (
 )
 
 func Write(data string, filepath string) error {
-	file, err := os.OpenFile(filepath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	file, err := os.OpenFile(filepath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o644)
 	if err != nil {
 		return err
 	}
diff --git a/internal/utils/helm/package.go b/internal/utils/helm/package.go
index f057b0744..4cbf81eff 100644
--- a/internal/utils/helm/package.go
+++ b/internal/utils/helm/package.go
@@ -77,7 +77,6 @@ func NewPackageTool() *PackageTool {
 
 // Setup Configuration required to initialize helm action.
 func (pt *PackageTool) Setup() error {
-
 	// Since envoy-gateway uses docker's oci to store charts,
 	// we need to create a registry client to make sure we can retrieve envoy-gateway chart
 	registryCli, err := registry.NewClient()
@@ -112,7 +111,6 @@ func (pt *PackageTool) Setup() error {
 
 // SetInstallEnvSettings set the installation flags we are interested in
 func (pt *PackageTool) SetInstallEnvSettings(installCmd *cobra.Command, opts *PackageOptions) {
-
 	// add helm flags
 	// we use a temporary flag to be set by helm env flags,
 	// from which we can retrieve the flags we are interested
@@ -139,12 +137,10 @@ func (pt *PackageTool) SetInstallEnvSettings(installCmd *cobra.Command, opts *Pa
 
 	installCmd.Flags().StringSliceVarP(&pt.valuesOpts.ValueFiles, "values", "f", []string{}, "Specify values in a YAML file or a URL (can specify multiple)")
 	installCmd.Flags().StringArrayVar(&pt.valuesOpts.Values, "set", []string{}, "Set values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)")
-
 }
 
 // SetUninstallEnvSetting set the uninstallation flags we are interested in
 func (pt *PackageTool) SetUninstallEnvSetting(uninstallCmd *cobra.Command, opts *PackageOptions) {
-
 	uninstallCmd.Flags().DurationVar(&opts.Timeout, "timeout", helmOperateTimeout, "time to wait for any individual Kubernetes operation")
 	uninstallCmd.Flags().StringVar(&opts.ReleaseName, "name", egReleaseName, "name of the envoy-gateway release to uninstall")
 	uninstallCmd.Flags().StringVarP(&opts.ReleaseNamespace, "namespace", "n", "", "if set, specify the namespace where envoy gateway is uninstalled")
@@ -152,12 +148,10 @@ func (pt *PackageTool) SetUninstallEnvSetting(uninstallCmd *cobra.Command, opts
 	uninstallCmd.Flags().BoolVar(&opts.DryRun, "dry-run", false, "console output only, make no changes")
 	uninstallCmd.Flags().BoolVar(&opts.WithCRD, "with-crds", false, "if set, the CRDs will also be removed")
 	uninstallCmd.Flags().Bool("debug", false, "if set, the will output detailed execution logs")
-
 }
 
 // loadChart Load the chart instance according to the chart name and version
 func (pt *PackageTool) loadChart(opts *PackageOptions) (*chart.Chart, error) {
-
 	pt.actionInstall.Version = opts.Version
 	chartName, err := pt.actionInstall.LocateChart(pt.chartName, pt.envSettings)
 	if err != nil {
@@ -182,7 +176,6 @@ func (pt *PackageTool) loadChart(opts *PackageOptions) (*chart.Chart, error) {
 
 // extractCRDs Extract the CRDs part of the chart
 func (pt *PackageTool) extractCRDs(ch *chart.Chart) ([]*resource.Info, error) {
-
 	crdResInfo := make([]*resource.Info, 0, len(ch.CRDObjects()))
 
 	for _, crd := range ch.CRDObjects() {
@@ -204,7 +197,6 @@ func (pt *PackageTool) extractCRDs(ch *chart.Chart) ([]*resource.Info, error) {
 // This is done to avoid garbage collection on CRs in the cluster during uninstallation,
 // preventing the potential loss of crucial CR instances.
 func (pt *PackageTool) RunInstall(opts *PackageOptions) error {
-
 	if opts.Version == "v0.0.0-latest" {
 		warningMarker := color.New(color.FgYellow).Add(color.Bold).Sprintf("WARNING")
 		pt.logger.Println(fmt.Sprintf("%s: Currently using the latest version of envoy gateway chart, it is recommended to use the fixed version",
@@ -270,7 +262,7 @@ func (pt *PackageTool) RunInstall(opts *PackageOptions) error {
 		var outputErr error
 		var outputFile *os.File
 
-		if outputFile, outputErr = os.OpenFile(opts.Output, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0666); outputErr == nil {
+		if outputFile, outputErr = os.OpenFile(opts.Output, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0o666); outputErr == nil {
 			_, outputErr = fmt.Fprint(outputFile, release.Manifest)
 		}
 		if outputErr != nil {
@@ -290,7 +282,6 @@ func (pt *PackageTool) RunInstall(opts *PackageOptions) error {
 
 // RunUninstall By default, we only uninstall instances of the Envoy Gateway resources.
 func (pt *PackageTool) RunUninstall(opts *PackageOptions) error {
-
 	pt.setUninstallOptions(opts)
 
 	resp, err := pt.actionUninstall.Run(opts.ReleaseName)
@@ -304,7 +295,6 @@ func (pt *PackageTool) RunUninstall(opts *PackageOptions) error {
 	}
 
 	if opts.WithCRD {
-
 		if crdInfo, err := pt.extractCRDs(resp.Release.Chart); err != nil {
 			return err
 		} else if len(crdInfo) == 0 {
@@ -312,7 +302,6 @@ func (pt *PackageTool) RunUninstall(opts *PackageOptions) error {
 		} else if _, errors := pt.actionConfig.KubeClient.Delete(crdInfo); len(errors) != 0 {
 			return fmt.Errorf("failed to delete CRDs error: %s", util.MultipleErrors("", errors))
 		}
-
 	}
 
 	successMarker := color.New(color.FgGreen).Add(color.Bold).Sprintf("SUCCESS")
@@ -330,7 +319,6 @@ func (pt *PackageTool) setCommonValue() {
 
 // setInstallOptions Sets the options required before install
 func (pt *PackageTool) setInstallOptions(opts *PackageOptions) {
-
 	if opts.DryRun {
 		// When dry-run is set up, we do not need to connect to k8s-api server.
 		// Since the kubernetes version needs to be higher than the value in the Helm library
@@ -375,7 +363,6 @@ func (pt *PackageTool) setUninstallOptions(opts *PackageOptions) {
 func (pt *PackageTool) SetPreRun(cmd *cobra.Command) {
 	existPreRunE := cmd.PreRunE
 	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
-
 		pt.setPrinter(cmd)
 		pt.setNamespace(cmd)
 
@@ -426,7 +413,6 @@ func createDummyK8sVersion() *chartutil.KubeVersion {
 
 // detectExistCRDs Check if envoy-gateway and gateway-api CRDs already exist in the cluster
 func detectExistCRDs(crdResInfo []*resource.Info) (*bool, error) {
-
 	exist := false
 	existObj := make([]runtime.Object, 0, len(crdResInfo))
 
@@ -455,7 +441,6 @@ func detectExistCRDs(crdResInfo []*resource.Info) (*bool, error) {
 
 // installCRDs Install CRDs to the cluster
 func installCRDs(crds []*resource.Info, actionConfig *action.Configuration) error {
-
 	// Create all CRDs in the envoy gateway chart
 	result, err := actionConfig.KubeClient.Create(crds)
 	if err != nil {
diff --git a/internal/utils/protocov/protocov.go b/internal/utils/protocov/protocov.go
index 52bb95226..6533f84c5 100644
--- a/internal/utils/protocov/protocov.go
+++ b/internal/utils/protocov/protocov.go
@@ -16,9 +16,7 @@ const (
 	APIPrefix = "type.googleapis.com/"
 )
 
-var (
-	marshalOpts = proto.MarshalOptions{}
-)
+var marshalOpts = proto.MarshalOptions{}
 
 func ToAnyWithError(msg proto.Message) (*anypb.Any, error) {
 	if msg == nil {
diff --git a/internal/xds/translator/accesslog.go b/internal/xds/translator/accesslog.go
index 63e6d46c9..9f1f17a09 100644
--- a/internal/xds/translator/accesslog.go
+++ b/internal/xds/translator/accesslog.go
@@ -48,14 +48,12 @@ const (
 	otelAccessLog = "envoy.access_loggers.open_telemetry"
 )
 
-var (
-	// for the case when a route does not exist to upstream, hcm logs will not be present
-	listenerAccessLogFilter = &accesslog.AccessLogFilter{
-		FilterSpecifier: &accesslog.AccessLogFilter_ResponseFlagFilter{
-			ResponseFlagFilter: &accesslog.ResponseFlagFilter{Flags: []string{"NR"}},
-		},
-	}
-)
+// for the case when a route does not exist to upstream, hcm logs will not be present
+var listenerAccessLogFilter = &accesslog.AccessLogFilter{
+	FilterSpecifier: &accesslog.AccessLogFilter_ResponseFlagFilter{
+		ResponseFlagFilter: &accesslog.ResponseFlagFilter{Flags: []string{"NR"}},
+	},
+}
 
 func buildXdsAccessLog(al *ir.AccessLog, forListener bool) []*accesslog.AccessLog {
 	if al == nil {
diff --git a/internal/xds/translator/basicauth.go b/internal/xds/translator/basicauth.go
index 5733cc342..e22febfca 100644
--- a/internal/xds/translator/basicauth.go
+++ b/internal/xds/translator/basicauth.go
@@ -27,8 +27,7 @@ func init() {
 	registerHTTPFilter(&basicAuth{})
 }
 
-type basicAuth struct {
-}
+type basicAuth struct{}
 
 var _ httpFilter = &basicAuth{}
 
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
index 8587aca73..bb18a7e02 100644
--- a/internal/xds/translator/cluster.go
+++ b/internal/xds/translator/cluster.go
@@ -82,7 +82,9 @@ func buildXdsCluster(args *xdsClusterArgs) *clusterv3.Cluster {
 		DnsLookupFamily: clusterv3.Cluster_V4_ONLY,
 		CommonLbConfig: &clusterv3.Cluster_CommonLbConfig{
 			LocalityConfigSpecifier: &clusterv3.Cluster_CommonLbConfig_LocalityWeightedLbConfig_{
-				LocalityWeightedLbConfig: &clusterv3.Cluster_CommonLbConfig_LocalityWeightedLbConfig{}}},
+				LocalityWeightedLbConfig: &clusterv3.Cluster_CommonLbConfig_LocalityWeightedLbConfig{},
+			},
+		},
 		OutlierDetection:              &clusterv3.OutlierDetection{},
 		PerConnectionBufferLimitBytes: wrapperspb.UInt32(tcpClusterPerConnectionBufferLimitBytes),
 	}
@@ -191,7 +193,6 @@ func buildXdsCluster(args *xdsClusterArgs) *clusterv3.Cluster {
 
 	if args.healthCheck != nil && args.healthCheck.Passive != nil {
 		cluster.OutlierDetection = buildXdsOutlierDetection(args.healthCheck.Passive)
-
 	}
 
 	cluster.CircuitBreakers = buildXdsClusterCircuitBreaker(args.circuitBreaker)
@@ -459,13 +460,11 @@ func buildTypedExtensionProtocolOptions(args *xdsClusterArgs) map[string]*anypb.
 
 		if args.timeout != nil && args.timeout.HTTP != nil {
 			if args.timeout.HTTP.ConnectionIdleTimeout != nil {
-				protocolOptions.CommonHttpProtocolOptions.IdleTimeout =
-					durationpb.New(args.timeout.HTTP.ConnectionIdleTimeout.Duration)
+				protocolOptions.CommonHttpProtocolOptions.IdleTimeout = durationpb.New(args.timeout.HTTP.ConnectionIdleTimeout.Duration)
 			}
 
 			if args.timeout.HTTP.MaxConnectionDuration != nil {
-				protocolOptions.CommonHttpProtocolOptions.MaxConnectionDuration =
-					durationpb.New(args.timeout.HTTP.MaxConnectionDuration.Duration)
+				protocolOptions.CommonHttpProtocolOptions.MaxConnectionDuration = durationpb.New(args.timeout.HTTP.MaxConnectionDuration.Duration)
 			}
 		}
 
@@ -626,5 +625,4 @@ func buildXdsClusterUpstreamOptions(tcpkeepalive *ir.TCPKeepalive) *clusterv3.Up
 	}
 
 	return ka
-
 }
diff --git a/internal/xds/translator/cors.go b/internal/xds/translator/cors.go
index cd46b6f41..6090bc216 100644
--- a/internal/xds/translator/cors.go
+++ b/internal/xds/translator/cors.go
@@ -27,8 +27,7 @@ func init() {
 	registerHTTPFilter(&cors{})
 }
 
-type cors struct {
-}
+type cors struct{}
 
 var _ httpFilter = &cors{}
 
@@ -36,7 +35,8 @@ var _ httpFilter = &cors{}
 // applicable.
 func (*cors) patchHCM(
 	mgr *hcmv3.HttpConnectionManager,
-	irListener *ir.HTTPListener) error {
+	irListener *ir.HTTPListener,
+) error {
 	if mgr == nil {
 		return errors.New("hcm is nil")
 	}
diff --git a/internal/xds/translator/extauth.go b/internal/xds/translator/extauth.go
index 43712564e..ead7ceccd 100644
--- a/internal/xds/translator/extauth.go
+++ b/internal/xds/translator/extauth.go
@@ -29,8 +29,7 @@ func init() {
 	registerHTTPFilter(&extAuth{})
 }
 
-type extAuth struct {
-}
+type extAuth struct{}
 
 var _ httpFilter = &extAuth{}
 
@@ -212,7 +211,8 @@ func routeContainsExtAuth(irRoute *ir.HTTPRoute) bool {
 
 // patchResources patches the cluster resources for the external auth services.
 func (*extAuth) patchResources(tCtx *types.ResourceVersionTable,
-	routes []*ir.HTTPRoute) error {
+	routes []*ir.HTTPRoute,
+) error {
 	if tCtx == nil || tCtx.XdsResources == nil {
 		return errors.New("xds resource table is nil")
 	}
diff --git a/internal/xds/translator/extproc.go b/internal/xds/translator/extproc.go
index ac03a49d0..c31185211 100644
--- a/internal/xds/translator/extproc.go
+++ b/internal/xds/translator/extproc.go
@@ -12,11 +12,13 @@ import (
 	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	extprocv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_proc/v3"
 	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
-	"github.com/golang/protobuf/ptypes/duration"
-	"google.golang.org/protobuf/types/known/anypb"
 
 	"github.com/envoyproxy/gateway/internal/ir"
 	"github.com/envoyproxy/gateway/internal/xds/types"
+
+	"github.com/golang/protobuf/ptypes/duration"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
 )
 
 const (
@@ -27,8 +29,7 @@ func init() {
 	registerHTTPFilter(&extProc{})
 }
 
-type extProc struct {
-}
+type extProc struct{}
 
 var _ httpFilter = &extProc{}
 
@@ -107,6 +108,38 @@ func extProcConfig(extProc ir.ExtProc) *extprocv3.ExternalProcessor {
 				Seconds: defaultExtServiceRequestTimeout,
 			},
 		},
+		ProcessingMode: &extprocv3.ProcessingMode{
+			RequestHeaderMode:   extprocv3.ProcessingMode_SKIP,
+			ResponseHeaderMode:  extprocv3.ProcessingMode_SKIP,
+			RequestBodyMode:     extprocv3.ProcessingMode_NONE,
+			ResponseBodyMode:    extprocv3.ProcessingMode_NONE,
+			RequestTrailerMode:  extprocv3.ProcessingMode_SKIP,
+			ResponseTrailerMode: extprocv3.ProcessingMode_SKIP,
+		},
+	}
+
+	if extProc.FailOpen != nil {
+		config.FailureModeAllow = *extProc.FailOpen
+	}
+
+	if extProc.MessageTimeout != nil {
+		config.MessageTimeout = durationpb.New(extProc.MessageTimeout.Duration)
+	}
+
+	if extProc.RequestBodyProcessingMode != nil {
+		config.ProcessingMode.RequestBodyMode = buildExtProcBodyProcessingMode(extProc.RequestBodyProcessingMode)
+	}
+
+	if extProc.RequestHeaderProcessing {
+		config.ProcessingMode.RequestHeaderMode = extprocv3.ProcessingMode_SEND
+	}
+
+	if extProc.ResponseBodyProcessingMode != nil {
+		config.ProcessingMode.ResponseBodyMode = buildExtProcBodyProcessingMode(extProc.ResponseBodyProcessingMode)
+	}
+
+	if extProc.ResponseHeaderProcessing {
+		config.ProcessingMode.ResponseHeaderMode = extprocv3.ProcessingMode_SEND
 	}
 
 	return config
@@ -130,7 +163,8 @@ func routeContainsExtProc(irRoute *ir.HTTPRoute) bool {
 
 // patchResources patches the cluster resources for the external services.
 func (*extProc) patchResources(tCtx *types.ResourceVersionTable,
-	routes []*ir.HTTPRoute) error {
+	routes []*ir.HTTPRoute,
+) error {
 	if tCtx == nil || tCtx.XdsResources == nil {
 		return errors.New("xds resource table is nil")
 	}
@@ -173,3 +207,15 @@ func (*extProc) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	}
 	return nil
 }
+
+func buildExtProcBodyProcessingMode(mode *ir.ExtProcBodyProcessingMode) extprocv3.ProcessingMode_BodySendMode {
+	lookup := map[ir.ExtProcBodyProcessingMode]extprocv3.ProcessingMode_BodySendMode{
+		ir.ExtProcBodyBuffered:        extprocv3.ProcessingMode_BUFFERED,
+		ir.ExtProcBodyBufferedPartial: extprocv3.ProcessingMode_BUFFERED_PARTIAL,
+		ir.ExtProcBodyStreamed:        extprocv3.ProcessingMode_STREAMED,
+	}
+	if r, found := lookup[*mode]; found {
+		return r
+	}
+	return extprocv3.ProcessingMode_NONE
+}
diff --git a/internal/xds/translator/fault.go b/internal/xds/translator/fault.go
index ae01b566c..46642934c 100644
--- a/internal/xds/translator/fault.go
+++ b/internal/xds/translator/fault.go
@@ -30,8 +30,7 @@ func init() {
 	registerHTTPFilter(&fault{})
 }
 
-type fault struct {
-}
+type fault struct{}
 
 var _ httpFilter = &fault{}
 
@@ -39,7 +38,6 @@ var _ httpFilter = &fault{}
 // if applicable, and it does not already exist.
 // Note: this method creates an fault filter for each route that contains an Fault config.
 func (*fault) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error {
-
 	if mgr == nil {
 		return errors.New("hcm is nil")
 	}
@@ -179,7 +177,6 @@ func (*fault) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	route.TypedPerFilterConfig[wellknown.Fault] = routeCfgAny
 
 	return nil
-
 }
 
 // translatePercentToFractionalPercent translates an v1alpha3 Percent instance
diff --git a/internal/xds/translator/httpfilters.go b/internal/xds/translator/httpfilters.go
index 143c8d773..0b8f6dbef 100644
--- a/internal/xds/translator/httpfilters.go
+++ b/internal/xds/translator/httpfilters.go
@@ -159,7 +159,8 @@ func sortHTTPFilters(filters []*hcmv3.HttpFilter) []*hcmv3.HttpFilter {
 // newOrderedHTTPFilter method.
 func (t *Translator) patchHCMWithFilters(
 	mgr *hcmv3.HttpConnectionManager,
-	irListener *ir.HTTPListener) error {
+	irListener *ir.HTTPListener,
+) error {
 	// The order of filter patching is not relevant here.
 	// All the filters will be sorted in correct order after the patching is done.
 	//
@@ -197,8 +198,8 @@ func (t *Translator) patchHCMWithFilters(
 // provided route.
 func patchRouteWithPerRouteConfig(
 	route *routev3.Route,
-	irRoute *ir.HTTPRoute) error {
-
+	irRoute *ir.HTTPRoute,
+) error {
 	for _, filter := range httpFilters {
 		if err := filter.patchRoute(route, irRoute); err != nil {
 			return err
@@ -207,8 +208,7 @@ func patchRouteWithPerRouteConfig(
 
 	// RateLimit filter is handled separately because it relies on the global
 	// rate limit server configuration.
-	if err :=
-		patchRouteWithRateLimit(route.GetRoute(), irRoute); err != nil {
+	if err := patchRouteWithRateLimit(route.GetRoute(), irRoute); err != nil {
 		return nil
 	}
 
diff --git a/internal/xds/translator/jwt.go b/internal/xds/translator/jwt.go
index b6bf2275e..27697043a 100644
--- a/internal/xds/translator/jwt.go
+++ b/internal/xds/translator/jwt.go
@@ -34,8 +34,7 @@ func init() {
 	registerHTTPFilter(&jwt{})
 }
 
-type jwt struct {
-}
+type jwt struct{}
 
 var _ httpFilter = &jwt{}
 
@@ -134,7 +133,8 @@ func buildJWTAuthn(irListener *ir.HTTPListener) (*jwtauthnv3.JwtAuthentication,
 			for _, claimToHeader := range irProvider.ClaimToHeaders {
 				claimToHeader := &jwtauthnv3.JwtClaimToHeader{
 					HeaderName: claimToHeader.Header,
-					ClaimName:  claimToHeader.Claim}
+					ClaimName:  claimToHeader.Claim,
+				}
 				claimToHeaders = append(claimToHeaders, claimToHeader)
 			}
 			jwtProvider := &jwtauthnv3.JwtProvider{
@@ -242,7 +242,8 @@ func (*jwt) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 		}
 
 		routeCfgProto := &jwtauthnv3.PerRouteConfig{
-			RequirementSpecifier: &jwtauthnv3.PerRouteConfig_RequirementName{RequirementName: irRoute.Name}}
+			RequirementSpecifier: &jwtauthnv3.PerRouteConfig_RequirementName{RequirementName: irRoute.Name},
+		}
 
 		routeCfgAny, err := anypb.New(routeCfgProto)
 		if err != nil {
diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go
index 55b29d168..af81f20aa 100644
--- a/internal/xds/translator/listener.go
+++ b/internal/xds/translator/listener.go
@@ -209,7 +209,8 @@ func buildXdsQuicListener(name, address string, port uint32, accesslog *ir.Acces
 //     The newly created TCP filter chain is configured with a filter chain match to
 //     match the server names(SNI) based on the listener's hostnames.
 func (t *Translator) addHCMToXDSListener(xdsListener *listenerv3.Listener, irListener *ir.HTTPListener,
-	accesslog *ir.AccessLog, tracing *ir.Tracing, http3Listener bool, connection *ir.Connection) error {
+	accesslog *ir.AccessLog, tracing *ir.Tracing, http3Listener bool, connection *ir.Connection,
+) error {
 	al := buildXdsAccessLog(accesslog, false)
 
 	hcmTracing, err := buildHCMTracing(tracing)
@@ -226,8 +227,8 @@ func (t *Translator) addHCMToXDSListener(xdsListener *listenerv3.Listener, irLis
 	}
 
 	// Client IP detection
-	var useRemoteAddress = true
-	var originalIPDetectionExtensions = originalIPDetectionExtensions(irListener.ClientIPDetection)
+	useRemoteAddress := true
+	originalIPDetectionExtensions := originalIPDetectionExtensions(irListener.ClientIPDetection)
 	if originalIPDetectionExtensions != nil {
 		useRemoteAddress = false
 	}
@@ -720,7 +721,6 @@ func makeConfigSource() *corev3.ConfigSource {
 }
 
 func translateEscapePath(in ir.PathEscapedSlashAction) hcmv3.HttpConnectionManager_PathWithEscapedSlashesAction {
-
 	lookup := map[ir.PathEscapedSlashAction]hcmv3.HttpConnectionManager_PathWithEscapedSlashesAction{
 		ir.KeepUnchangedAction: hcmv3.HttpConnectionManager_KEEP_UNCHANGED,
 		ir.RejectRequestAction: hcmv3.HttpConnectionManager_REJECT_REQUEST,
diff --git a/internal/xds/translator/local_ratelimit.go b/internal/xds/translator/local_ratelimit.go
index a3110cbf9..adbcca6e7 100644
--- a/internal/xds/translator/local_ratelimit.go
+++ b/internal/xds/translator/local_ratelimit.go
@@ -35,8 +35,7 @@ func init() {
 	registerHTTPFilter(&localRateLimit{})
 }
 
-type localRateLimit struct {
-}
+type localRateLimit struct{}
 
 var _ httpFilter = &localRateLimit{}
 
@@ -106,7 +105,8 @@ func routeContainsLocalRateLimit(irRoute *ir.HTTPRoute) bool {
 }
 
 func (*localRateLimit) patchResources(*types.ResourceVersionTable,
-	[]*ir.HTTPRoute) error {
+	[]*ir.HTTPRoute,
+) error {
 	return nil
 }
 
@@ -188,7 +188,8 @@ func (*localRateLimit) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) e
 }
 
 func buildRouteLocalRateLimits(local *ir.LocalRateLimit) (
-	[]*routev3.RateLimit, []*rlv3.LocalRateLimitDescriptor, error) {
+	[]*routev3.RateLimit, []*rlv3.LocalRateLimitDescriptor, error,
+) {
 	var rateLimits []*routev3.RateLimit
 	var descriptors []*rlv3.LocalRateLimitDescriptor
 
diff --git a/internal/xds/translator/oidc.go b/internal/xds/translator/oidc.go
index f7202a7f4..d005f4b49 100644
--- a/internal/xds/translator/oidc.go
+++ b/internal/xds/translator/oidc.go
@@ -31,8 +31,7 @@ func init() {
 	registerHTTPFilter(&oidc{})
 }
 
-type oidc struct {
-}
+type oidc struct{}
 
 var _ httpFilter = &oidc{}
 
@@ -187,7 +186,8 @@ func routeContainsOIDC(irRoute *ir.HTTPRoute) bool {
 }
 
 func (*oidc) patchResources(tCtx *types.ResourceVersionTable,
-	routes []*ir.HTTPRoute) error {
+	routes []*ir.HTTPRoute,
+) error {
 	if err := createOAuth2TokenEndpointClusters(tCtx, routes); err != nil {
 		return err
 	}
@@ -200,7 +200,8 @@ func (*oidc) patchResources(tCtx *types.ResourceVersionTable,
 // createOAuth2TokenEndpointClusters creates token endpoint clusters from the
 // provided routes, if needed.
 func createOAuth2TokenEndpointClusters(tCtx *types.ResourceVersionTable,
-	routes []*ir.HTTPRoute) error {
+	routes []*ir.HTTPRoute,
+) error {
 	if tCtx == nil || tCtx.XdsResources == nil {
 		return errors.New("xds resource table is nil")
 	}
@@ -236,9 +237,10 @@ func createOAuth2TokenEndpointClusters(tCtx *types.ResourceVersionTable,
 
 		ds = &ir.DestinationSetting{
 			Weight: ptr.To[uint32](1),
-			Endpoints: []*ir.DestinationEndpoint{ir.NewDestEndpoint(
-				cluster.hostname,
-				cluster.port),
+			Endpoints: []*ir.DestinationEndpoint{
+				ir.NewDestEndpoint(
+					cluster.hostname,
+					cluster.port),
 			},
 		}
 
diff --git a/internal/xds/translator/tcpkeepalive.go b/internal/xds/translator/tcpkeepalive.go
index 9d4c71d6d..fcdd2a469 100644
--- a/internal/xds/translator/tcpkeepalive.go
+++ b/internal/xds/translator/tcpkeepalive.go
@@ -62,5 +62,4 @@ func buildTCPSocketOptions(keepAlive *ir.TCPKeepalive) []*corev3.SocketOption {
 	}
 
 	return socketOptions
-
 }
diff --git a/internal/xds/translator/translator.go b/internal/xds/translator/translator.go
index cd517a4d5..eaef03e97 100644
--- a/internal/xds/translator/translator.go
+++ b/internal/xds/translator/translator.go
@@ -301,7 +301,8 @@ func (t *Translator) addRouteToRouteConfig(
 	xdsRouteCfg *routev3.RouteConfiguration,
 	httpListener *ir.HTTPListener,
 	metrics *ir.Metrics,
-	http3Enabled bool) error {
+	http3Enabled bool,
+) error {
 	var (
 		vHosts    = map[string]*routev3.VirtualHost{} // store virtual hosts by domain
 		vHostList []*routev3.VirtualHost              // keep track of order by using a list as well as the map
@@ -555,7 +556,8 @@ func processUDPListenerXdsTranslation(tCtx *types.ResourceVersionTable, udpListe
 
 // findXdsListenerByHostPort finds a xds listener with the same address, port and protocol, and returns nil if there is no match.
 func findXdsListenerByHostPort(tCtx *types.ResourceVersionTable, address string, port uint32,
-	protocol corev3.SocketAddress_Protocol) *listenerv3.Listener {
+	protocol corev3.SocketAddress_Protocol,
+) *listenerv3.Listener {
 	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.ListenerType] == nil {
 		return nil
 	}
@@ -659,29 +661,6 @@ func processXdsCluster(tCtx *types.ResourceVersionTable, httpRoute *ir.HTTPRoute
 	return nil
 }
 
-// processTLSSocket generates a xDS TransportSocket for a given TLS config.
-// It also adds the necessary secrets to the resource version table.
-func processTLSSocket(tlsConfig *ir.TLSUpstreamConfig, tCtx *types.ResourceVersionTable) (*corev3.TransportSocket, error) {
-	if tlsConfig == nil {
-		return nil, nil
-	}
-	// Create a secret for the CA certificate only if it's not using the system trust store
-	if !tlsConfig.UseSystemTrustStore {
-		CaSecret := buildXdsUpstreamTLSCASecret(tlsConfig)
-		if err := tCtx.AddXdsResource(resourcev3.SecretType, CaSecret); err != nil {
-			return nil, err
-		}
-	}
-
-	// for upstreamTLS , a fixed sni can be used. use auto_sni otherwise
-	// https://www.envoyproxy.io/docs/envoy/latest/faq/configuration/sni#faq-how-to-setup-sni:~:text=For%20clusters%2C%20a,for%20trust%20anchor.
-	tlsSocket, err := buildXdsUpstreamTLSSocketWthCert(tlsConfig)
-	if err != nil {
-		return nil, err
-	}
-	return tlsSocket, nil
-}
-
 // findXdsSecret finds a xds secret with the same name, and returns nil if there is no match.
 func findXdsSecret(tCtx *types.ResourceVersionTable, name string) *tlsv3.Secret {
 	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.SecretType] == nil {
diff --git a/internal/xds/translator/utils.go b/internal/xds/translator/utils.go
index dbcb005ef..b4f60b1ae 100644
--- a/internal/xds/translator/utils.go
+++ b/internal/xds/translator/utils.go
@@ -144,13 +144,6 @@ func createExtServiceXDSCluster(rd *ir.RouteDestination, tCtx *types.ResourceVer
 		endpointType = EndpointTypeStatic
 	}
 
-	if rd.Settings[0].TLS != nil {
-		tSocket, err = processTLSSocket(rd.Settings[0].TLS, tCtx)
-		if err != nil {
-			return err
-		}
-	}
-
 	if err = addXdsCluster(tCtx, &xdsClusterArgs{
 		name:         rd.Name,
 		settings:     rd.Settings,
diff --git a/internal/xds/translator/wasm.go b/internal/xds/translator/wasm.go
index 1c8c03951..4d358d707 100644
--- a/internal/xds/translator/wasm.go
+++ b/internal/xds/translator/wasm.go
@@ -30,8 +30,7 @@ func init() {
 	registerHTTPFilter(&wasm{})
 }
 
-type wasm struct {
-}
+type wasm struct{}
 
 var _ httpFilter = &wasm{}
 
@@ -172,7 +171,8 @@ func routeContainsWasm(irRoute *ir.HTTPRoute) bool {
 
 // patchResources patches the cluster resources for the http wasm code source.
 func (*wasm) patchResources(tCtx *types.ResourceVersionTable,
-	routes []*ir.HTTPRoute) error {
+	routes []*ir.HTTPRoute,
+) error {
 	if tCtx == nil || tCtx.XdsResources == nil {
 		return errors.New("xds resource table is nil")
 	}
diff --git a/internal/xds/types/resourceversiontable.go b/internal/xds/types/resourceversiontable.go
index 672096e6a..2f7a7926b 100644
--- a/internal/xds/types/resourceversiontable.go
+++ b/internal/xds/types/resourceversiontable.go
@@ -46,7 +46,7 @@ func (t *ResourceVersionTable) DeepCopyInto(out *ResourceVersionTable) {
 				(*out)[key] = nil
 			} else {
 				// Snippet was generated by controller-gen
-				//G601: Implicit memory aliasing in for loop.
+				// G601: Implicit memory aliasing in for loop.
 				in, out := &val, &outVal //nolint:gosec,scopelint
 				*out = make([]types.Resource, len(*in))
 				for i := range *in {
diff --git a/site/content/en/v1.0.1/tasks/security/oidc.md b/site/content/en/v1.0.1/tasks/security/oidc.md
index 81bdaa882..c11a52bbf 100644
--- a/site/content/en/v1.0.1/tasks/security/oidc.md
+++ b/site/content/en/v1.0.1/tasks/security/oidc.md
@@ -2,9 +2,9 @@
 title: "OIDC Authentication"
 ---
 
-This guide provides instructions for configuring [OpenID Connect (OIDC)][oidc] authentication.
+This task provides instructions for configuring [OpenID Connect (OIDC)][oidc] authentication.
 OpenID Connect (OIDC) is an authentication standard built on top of OAuth 2.0.
-It enables client applications to rely on authentication that is performed by an OpenID Connect Provider (OP)
+It enables EG to rely on authentication that is performed by an OpenID Connect Provider (OP)
 to verify the identity of a user.
 
 Envoy Gateway introduces a new CRD called [SecurityPolicy][SecurityPolicy] that allows the user to configure OIDC
@@ -13,22 +13,23 @@ This instantiated resource can be linked to a [Gateway][Gateway] and [HTTPRoute]
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) guide to install Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
 Before proceeding, you should be able to query the example backend using HTTP.
 
+EG OIDC authentication requires the redirect URL to be HTTPS. Follow the [Secure Gateways](../secure-gateways) guide
+to generate the TLS certificates and update the Gateway configuration to add an HTTPS listener.
+
 Verify the Gateway status:
 
 ```shell
 kubectl get gateway/eg -o yaml
 ```
 
-OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
-the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations. 
-
-This guide demonstrates the configuration of OIDC at the HTTPRoute level.
-
 Let's create an HTTPRoute that represents an application protected by OIDC.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -50,22 +51,54 @@ spec:
 EOF
 ```
 
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: myapp
+spec:
+  parentRefs:
+  - name: eg
+  hostnames: ["www.example.com"]
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /myapp
+    backendRefs:
+    - name: backend
+      port: 3000
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
+
 Verify the HTTPRoute status:
 
 ```shell
 kubectl get httproute/myapp -o yaml
 ```
 
-## Configuration
+## OIDC Authentication for a HTTPRoute
 
-This guide uses Google as the OIDC provider to demonstrate the configuration of OIDC. However, EG works with any OIDC
-providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc.
+OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
+the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations.
+
+This section demonstrates how to configure OIDC authentication for a specific HTTPRoute.
 
 ### Register an OIDC application
 
+This task uses Google as the OIDC provider to demonstrate the configuration of OIDC. However, EG works with any OIDC
+providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc.
+
 Follow the steps in the [Google OIDC documentation][google-oidc] to register an OIDC application. Please make sure the
 redirect URL is set to the one you configured in the SecurityPolicy that you will create in the step below. In this example,
-the redirect URL is `http://www.example.com:8080/myapp/oauth2/callback`.
+the redirect URL is `http://www.example.com:8443/myapp/oauth2/callback`.
 
 After registering the application, you should have the following information:
 * Client ID: The client ID of the OIDC application.
@@ -79,20 +112,22 @@ and the Client Secret must be stored in the key "client-secret".
 Note: please replace the ${CLIENT_SECRET} with the actual Client Secret that you got from the previous step.
 
 ```shell
-$ kubectl create secret generic my-app-client-secret --from-literal=client-secret=${CLIENT_SECRET}
-secret "my-app-client-secret" created
+kubectl create secret generic my-app-client-secret --from-literal=client-secret=${CLIENT_SECRET}
 ```
 
 ### Create a SecurityPolicy
 
-Please notice that the `redirectURL` and `logoutPath` must match the target HTTPRoute. In this example, the target
-HTTPRoute is configured to match the host `www.example.com` and the path `/myapp`, so the `redirectURL` must be prefixed 
-with `http://www.example.com:8080/myapp`, and `logoutPath` must be prefixed with`/myapp`, otherwise the OIDC authentication 
-will fail because the redirect and logout requests will not match the target HTTPRoute and therefore can't be processed 
+**Please notice that the `redirectURL` and `logoutPath` must match the target HTTPRoute.** In this example, the target
+HTTPRoute is configured to match the host `www.example.com` and the path `/myapp`, so the `redirectURL` must be prefixed
+with `https://www.example.com:8443/myapp`, and `logoutPath` must be prefixed with`/myapp`, otherwise the OIDC authentication
+will fail because the redirect and logout requests will not match the target HTTPRoute and therefore can't be processed
 by the OAuth2 filter on that HTTPRoute.
 
 Note: please replace the ${CLIENT_ID} in the below yaml snippet with the actual Client ID that you got from the OIDC provider.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -110,25 +145,53 @@ spec:
     clientID: "${CLIENT_ID}"
     clientSecret:
       name: "my-app-client-secret"
-    redirectURL: "http://www.example.com:8080/myapp/oauth2/callback"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
     logoutPath: "/myapp/logout"
 EOF
 ```
 
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: myapp
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
+
 Verify the SecurityPolicy configuration:
 
 ```shell
 kubectl get securitypolicy/oidc-example -o yaml
 ```
 
-## Testing
+### Testing
 
 Port forward gateway port to localhost:
 
 ```shell
 export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
 
-kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8080:80
+kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8443:443
 ```
 
 Put www.example.com in the /etc/hosts file in your test machine, so we can use this host name to access the gateway from a browser:
@@ -138,12 +201,107 @@ Put www.example.com in the /etc/hosts file in your test machine, so we can use t
 127.0.0.1 www.example.com
 ```
 
-Open a browser and navigate to the `http://www.example.com:8080/myapp` address. You should be redirected to the Google 
+Open a browser and navigate to the `https://www.example.com:8443/myapp` address. You should be redirected to the Google
 login page. After you successfully login, you should see the response from the backend service.
 
+Clean the cookies in the browser and try to access `https://www.example.com:8443/foo` address. You should be able to see
+this page since the path `/foo` is not protected by the OIDC policy.
+
+## OIDC Authentication for a Gateway
+
+OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
+the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations.
+
+This section demonstrates how to configure OIDC authentication for a Gateway.
+
+### Register an OIDC application
+
+If you haven't registered an OIDC application, follow the steps in the previous section to register an OIDC application.
+
+### Create a kubernetes secret
+
+If you haven't created a kubernetes secret, follow the steps in the previous section to create a kubernetes secret.
+
+### Create a SecurityPolicy
+
+Create or update the SecurityPolicy to target the Gateway instead of the HTTPRoute. **Please notice that the `redirectURL`
+and `logoutPath` must match one of the HTTPRoutes associated with the Gateway.** In this example, the target Gateway has
+two HTTPRoutes associated with it, one with the host `www.example.com` and the path `/myapp`, and the other with the host
+`www.example.com` and the path `/`. Either one of the HTTPRoutes can be used to match the `redirectURL` and `logoutPath`.
+
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+EOF
+```
+
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
+
+Verify the SecurityPolicy configuration:
+
+```shell
+kubectl get securitypolicy/oidc-example -o yaml
+```
+
+### Testing
+
+If you haven't done so, follow the steps in the previous section to port forward gateway port to localhost and put
+www.example.com in the /etc/hosts file in your test machine.
+
+Open a browser and navigate to the `https://www.example.com:8443/foo` address. You should be redirected to the Google
+login page. After you successfully login, you should see the response from the backend service.
+
+You can also try to access `https://www.example.com:8443/myapp` address. You should be able to see this page since the
+path `/myapp` is protected by the same OIDC policy.
+
 ## Clean-Up
 
-Follow the steps from the [Quickstart](../../quickstart) guide to uninstall Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../../quickstart) to uninstall Envoy Gateway and the example manifest.
 
 Delete the SecurityPolicy, the secret and the HTTPRoute:
 
@@ -155,10 +313,10 @@ kubectl delete httproute/myapp
 
 ## Next Steps
 
-Checkout the [Developer Guide](../../../contributions/develop) to get involved in the project.
+Checkout the [Developer Guide](../../../../contributions/develop) to get involved in the project.
 
 [oidc]: https://openid.net/connect/
 [google-oidc]: https://developers.google.com/identity/protocols/oauth2/openid-connect
-[SecurityPolicy]: ../../../contributions/design/security-policy
+[SecurityPolicy]: ../../../../contributions/design/security-policy
 [Gateway]: https://gateway-api.sigs.k8s.io/api-types/gateway
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute
diff --git a/site/content/en/v1.0.1/tasks/security/secure-gateways.md b/site/content/en/v1.0.1/tasks/security/secure-gateways.md
index e56a496e0..52bf8c9cb 100644
--- a/site/content/en/v1.0.1/tasks/security/secure-gateways.md
+++ b/site/content/en/v1.0.1/tasks/security/secure-gateways.md
@@ -236,7 +236,7 @@ Lastly, test connectivity using the above [Testing section](#testing).
 
 ## Clean-Up
 
-Follow the steps from the [Quickstart](../../quickstart) to uninstall Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../quickstart) to uninstall Envoy Gateway and the example manifest.
 
 Delete the Secrets:
 
@@ -362,7 +362,7 @@ This sections gives a walkthrough to generate multiple certificates correspondin
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway and the example manifest.
 Before proceeding, you should be able to query the example backend using HTTP.
 
 Follow the steps in the [TLS Certificates](#tls-certificates) section to generate self-signed RSA derived Server certificate and private key, and configure those in the Gateway listener configuration to terminate HTTPS traffic.
diff --git a/tools/linter/golangci-lint/.golangci.yml b/tools/linter/golangci-lint/.golangci.yml
index 36ed0cb1f..267fbc46c 100644
--- a/tools/linter/golangci-lint/.golangci.yml
+++ b/tools/linter/golangci-lint/.golangci.yml
@@ -8,6 +8,7 @@ linters:
     - errorlint
     - exportloopref
     - gofmt
+    - gofumpt
     - goimports
     - goheader
     - gocritic


Test patch:
diff --git a/.github/workflows/build_and_test.yaml b/.github/workflows/build_and_test.yaml
index f6030a453..94d081ed4 100644
--- a/.github/workflows/build_and_test.yaml
+++ b/.github/workflows/build_and_test.yaml
@@ -70,7 +70,7 @@ jobs:
       run: make build-multiarch PLATFORMS="linux_amd64 linux_arm64"
 
     - name: Upload EG Binaries
-      uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba  # v4.3.2
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
       with:
         name: envoy-gateway
         path: bin/
@@ -86,7 +86,7 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
-      uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d  # v4.1.5
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e  # v4.1.7
       with:
         name: envoy-gateway
         path: bin/
@@ -114,7 +114,7 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
-      uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d  # v4.1.5
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e  # v4.1.7
       with:
         name: envoy-gateway
         path: bin/
@@ -139,7 +139,7 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
-      uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d  # v4.1.5
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e  # v4.1.7
       with:
         name: envoy-gateway
         path: bin/
diff --git a/api/v1alpha1/validation/envoygateway_validate_test.go b/api/v1alpha1/validation/envoygateway_validate_test.go
index 6978a52e3..aa76a90ec 100644
--- a/api/v1alpha1/validation/envoygateway_validate_test.go
+++ b/api/v1alpha1/validation/envoygateway_validate_test.go
@@ -660,7 +660,8 @@ func TestEnvoyGatewayProvider(t *testing.T) {
 			Replicas:  nil,
 			Pod:       nil,
 			Container: nil,
-		}}
+		},
+	}
 	assert.Nil(t, envoyGatewayProvider.Kubernetes.RateLimitDeployment.Replicas)
 	assert.Nil(t, envoyGatewayProvider.Kubernetes.RateLimitDeployment.Pod)
 	assert.Nil(t, envoyGatewayProvider.Kubernetes.RateLimitDeployment.Container)
@@ -674,7 +675,8 @@ func TestEnvoyGatewayProvider(t *testing.T) {
 				SecurityContext: nil,
 				Image:           nil,
 			},
-		}}
+		},
+	}
 	assert.Nil(t, envoyGatewayProvider.Kubernetes.RateLimitDeployment.Container.Resources)
 	envoyGatewayProvider.GetEnvoyGatewayKubeProvider()
 
diff --git a/api/v1alpha1/validation/envoyproxy_validate_test.go b/api/v1alpha1/validation/envoyproxy_validate_test.go
index 27ab08f30..6619888bd 100644
--- a/api/v1alpha1/validation/envoyproxy_validate_test.go
+++ b/api/v1alpha1/validation/envoyproxy_validate_test.go
@@ -447,7 +447,8 @@ func TestValidateEnvoyProxy(t *testing.T) {
 				},
 			},
 			expected: false,
-		}, {
+		},
+		{
 			name: "should invalid when metrics type is OpenTelemetry, but `OpenTelemetry` field being empty",
 			proxy: &egv1a1.EnvoyProxy{
 				ObjectMeta: metav1.ObjectMeta{
@@ -467,7 +468,8 @@ func TestValidateEnvoyProxy(t *testing.T) {
 				},
 			},
 			expected: false,
-		}, {
+		},
+		{
 			name: "should valid when metrics type is OpenTelemetry and `OpenTelemetry` field being not empty",
 			proxy: &egv1a1.EnvoyProxy{
 				ObjectMeta: metav1.ObjectMeta{
@@ -491,7 +493,8 @@ func TestValidateEnvoyProxy(t *testing.T) {
 				},
 			},
 			expected: true,
-		}, {
+		},
+		{
 			name: "should be invalid when service patch type is empty",
 			proxy: &egv1a1.EnvoyProxy{
 				ObjectMeta: metav1.ObjectMeta{
@@ -514,7 +517,8 @@ func TestValidateEnvoyProxy(t *testing.T) {
 				},
 			},
 			expected: true,
-		}, {
+		},
+		{
 			name: "should be invalid when deployment patch type is empty",
 			proxy: &egv1a1.EnvoyProxy{
 				ObjectMeta: metav1.ObjectMeta{
@@ -537,7 +541,8 @@ func TestValidateEnvoyProxy(t *testing.T) {
 				},
 			},
 			expected: true,
-		}, {
+		},
+		{
 			name: "should invalid when patch object is empty",
 			proxy: &egv1a1.EnvoyProxy{
 				ObjectMeta: metav1.ObjectMeta{
@@ -558,7 +563,8 @@ func TestValidateEnvoyProxy(t *testing.T) {
 				},
 			},
 			expected: false,
-		}, {
+		},
+		{
 			name: "should valid when patch type and object are both not empty",
 			proxy: &egv1a1.EnvoyProxy{
 				ObjectMeta: metav1.ObjectMeta{
@@ -582,7 +588,8 @@ func TestValidateEnvoyProxy(t *testing.T) {
 				},
 			},
 			expected: true,
-		}, {
+		},
+		{
 			name: "should valid when patch type is empty and object is not empty",
 			proxy: &egv1a1.EnvoyProxy{
 				ObjectMeta: metav1.ObjectMeta{
diff --git a/internal/cmd/egctl/config_test.go b/internal/cmd/egctl/config_test.go
index ff1ad2f8a..8d1eb45b9 100644
--- a/internal/cmd/egctl/config_test.go
+++ b/internal/cmd/egctl/config_test.go
@@ -156,7 +156,8 @@ func TestExtractSubResourcesConfigDump(t *testing.T) {
 			output:       "yaml",
 			resourceType: BootstrapEnvoyConfigType,
 			expected:     "out.bootstrap.yaml",
-		}, {
+		},
+		{
 			output:       "json",
 			resourceType: ClusterEnvoyConfigType,
 			expected:     "out.cluster.json",
@@ -165,7 +166,8 @@ func TestExtractSubResourcesConfigDump(t *testing.T) {
 			output:       "yaml",
 			resourceType: ClusterEnvoyConfigType,
 			expected:     "out.cluster.yaml",
-		}, {
+		},
+		{
 			output:       "json",
 			resourceType: ListenerEnvoyConfigType,
 			expected:     "out.listener.json",
@@ -174,7 +176,8 @@ func TestExtractSubResourcesConfigDump(t *testing.T) {
 			output:       "yaml",
 			resourceType: ListenerEnvoyConfigType,
 			expected:     "out.listener.yaml",
-		}, {
+		},
+		{
 			output:       "json",
 			resourceType: RouteEnvoyConfigType,
 			expected:     "out.route.json",
@@ -303,7 +306,6 @@ func (f *fakeCLIClient) Kube() kubernetes.Interface {
 }
 
 func TestFetchRunningRateLimitPods(t *testing.T) {
-
 	cases := []struct {
 		caseName      string
 		rlPods        []corev1.Pod
@@ -363,23 +365,18 @@ func TestFetchRunningRateLimitPods(t *testing.T) {
 	}
 
 	for _, tc := range cases {
-
 		t.Run(tc.caseName, func(t *testing.T) {
-
 			fakeCli := &fakeCLIClient{
 				pods: tc.rlPods,
 			}
 
 			_, err := fetchRunningRateLimitPods(fakeCli, tc.namespace, tc.labelSelector)
 			require.Equal(t, tc.expectErr, err)
-
 		})
-
 	}
 }
 
 func TestCheckEnableGlobalRateLimit(t *testing.T) {
-
 	cases := []struct {
 		caseName    string
 		egConfigMap *corev1.ConfigMap
@@ -433,9 +430,7 @@ gateway:
 	}
 
 	for _, tc := range cases {
-
 		t.Run(tc.caseName, func(t *testing.T) {
-
 			fakeCli := &fakeCLIClient{
 				cm: tc.egConfigMap,
 			}
@@ -443,14 +438,11 @@ gateway:
 			actual, err := checkEnableGlobalRateLimit(fakeCli)
 			require.Equal(t, tc.expect, actual)
 			require.NoError(t, err)
-
 		})
-
 	}
 }
 
 func TestExtractRateLimitConfig(t *testing.T) {
-
 	cases := []struct {
 		caseName     string
 		responseBody []byte
@@ -467,23 +459,18 @@ func TestExtractRateLimitConfig(t *testing.T) {
 	}
 
 	for _, tc := range cases {
-
 		t.Run(tc.caseName, func(t *testing.T) {
-
 			fw, err := newFakePortForwarder(tc.responseBody)
 			require.NoError(t, err)
 
 			out, err := extractRateLimitConfig(fw, tc.rlPod)
 			require.NoError(t, err)
 			require.NotEmpty(t, out)
-
 		})
-
 	}
 }
 
 func TestCheckRateLimitPodStatusReady(t *testing.T) {
-
 	cases := []struct {
 		caseName string
 		status   corev1.PodStatus
@@ -538,5 +525,4 @@ func TestCheckRateLimitPodStatusReady(t *testing.T) {
 			require.Equal(t, tc.expect, actual)
 		})
 	}
-
 }
diff --git a/internal/cmd/egctl/translate_test.go b/internal/cmd/egctl/translate_test.go
index 6159b832b..96707159a 100644
--- a/internal/cmd/egctl/translate_test.go
+++ b/internal/cmd/egctl/translate_test.go
@@ -26,9 +26,7 @@ import (
 	"github.com/envoyproxy/gateway/internal/utils/file"
 )
 
-var (
-	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
-)
+var overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
 
 func TestTranslate(t *testing.T) {
 	testCases := []struct {
@@ -353,7 +351,6 @@ func TestTranslate(t *testing.T) {
 			mustUnmarshal(t, requireTestDataOutFile(t, fn), want)
 			opts := cmpopts.IgnoreFields(metav1.Condition{}, "LastTransitionTime")
 			require.Empty(t, cmp.Diff(want, got, opts))
-
 		})
 	}
 }
diff --git a/internal/cmd/server_test.go b/internal/cmd/server_test.go
index b6608445e..dffe10670 100644
--- a/internal/cmd/server_test.go
+++ b/internal/cmd/server_test.go
@@ -71,5 +71,4 @@ func TestGetConfigValidate(t *testing.T) {
 			}
 		})
 	}
-
 }
diff --git a/internal/crypto/certgen_test.go b/internal/crypto/certgen_test.go
index eb09d6d2c..429fea518 100644
--- a/internal/crypto/certgen_test.go
+++ b/internal/crypto/certgen_test.go
@@ -129,7 +129,6 @@ func TestGeneratedValidKubeCerts(t *testing.T) {
 			require.NoErrorf(t, err, "Validating %s failed", tc.name)
 		})
 	}
-
 }
 
 func verifyCert(certPEM []byte, roots *x509.CertPool, dnsname string, currentTime time.Time) error {
diff --git a/internal/envoygateway/config/decoder_test.go b/internal/envoygateway/config/decoder_test.go
index d8c8e36a2..28ce394cb 100644
--- a/internal/envoygateway/config/decoder_test.go
+++ b/internal/envoygateway/config/decoder_test.go
@@ -18,9 +18,7 @@ import (
 	"github.com/envoyproxy/gateway/api/v1alpha1"
 )
 
-var (
-	inPath = "./testdata/decoder/in/"
-)
+var inPath = "./testdata/decoder/in/"
 
 func TestDecode(t *testing.T) {
 	testCases := []struct {
diff --git a/internal/extension/testutils/hooks.go b/internal/extension/testutils/hooks.go
index f6b699b34..b7b38c166 100644
--- a/internal/extension/testutils/hooks.go
+++ b/internal/extension/testutils/hooks.go
@@ -103,7 +103,6 @@ func (c *XDSHookClient) PostVirtualHostModifyHook(vh *routeV3.VirtualHost) (*rou
 // A more useful use-case for an extension would be looping through the FilterChains to find the
 // HTTPConnectionManager(s) and inject a custom HTTPFilter, but that for testing purposes we don't need to make a complex change
 func (c *XDSHookClient) PostHTTPListenerModifyHook(l *listenerV3.Listener) (*listenerV3.Listener, error) {
-
 	// Only make the change when the listener's name matches the expected testdata
 	// This prevents us from having to update every single testfile.out
 	if l.Name == "extension-post-xdslistener-hook-error" {
@@ -120,7 +119,6 @@ func (c *XDSHookClient) PostHTTPListenerModifyHook(l *listenerV3.Listener) (*lis
 
 // PostTranslateModifyHook inserts and overrides some clusters/secrets
 func (c *XDSHookClient) PostTranslateModifyHook(clusters []*clusterV3.Cluster, secrets []*tlsV3.Secret) ([]*clusterV3.Cluster, []*tlsV3.Secret, error) {
-
 	extensionSvcEndpoint := &endpointV3.LbEndpoint_Endpoint{
 		Endpoint: &endpointV3.Endpoint{
 			Address: &coreV3.Address{
diff --git a/internal/gatewayapi/runner/runner_test.go b/internal/gatewayapi/runner/runner_test.go
index 772f0372a..a48188ccc 100644
--- a/internal/gatewayapi/runner/runner_test.go
+++ b/internal/gatewayapi/runner/runner_test.go
@@ -59,7 +59,6 @@ func TestRunner(t *testing.T) {
 		// Ensure ir is empty
 		return (reflect.DeepEqual(xdsIR.LoadAll(), map[string]*ir.Xds{})) && (reflect.DeepEqual(infraIR.LoadAll(), map[string]*ir.Infra{}))
 	}, time.Second*1, time.Millisecond*20)
-
 }
 
 func TestGetIRKeysToDelete(t *testing.T) {
@@ -75,7 +74,8 @@ func TestGetIRKeysToDelete(t *testing.T) {
 			newKeys: []string{},
 			delKeys: []string{},
 		},
-		{name: "no new keys",
+		{
+			name:    "no new keys",
 			curKeys: []string{"one", "two"},
 			newKeys: []string{},
 			delKeys: []string{"one", "two"},
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.in.yaml
index 0f6d26cf6..6f4ed53ab 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.in.yaml
@@ -26,6 +26,6 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: envoy-gateway
     extProc:
-    - backendRef:
-        name: grpc-backend-4
+    - backendRefs:
+      - name: grpc-backend-4
         port: 4000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
index 1deb8ca6b..a545e5862 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend-4
+    - backendRefs:
+      - name: grpc-backend-4
         port: 4000
     targetRef:
       group: gateway.networking.k8s.io
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml
index ce4ecde37..1d4c61cc7 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml
@@ -86,8 +86,8 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: envoy-gateway
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         port: 9000
 - apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: EnvoyExtensionPolicy
@@ -101,6 +101,6 @@ envoyExtensionPolicies:
       name: httproute-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend-2
+    - backendRefs:
+      - name: grpc-backend-2
         port: 8000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
index 0fd8d36b3..cc9921a6b 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend-2
+    - backendRefs:
+      - name: grpc-backend-2
         port: 8000
     targetRef:
       group: gateway.networking.k8s.io
@@ -38,8 +38,8 @@ envoyExtensionPolicies:
     namespace: envoy-gateway
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         port: 9000
     targetRef:
       group: gateway.networking.k8s.io
@@ -231,7 +231,7 @@ xdsIR:
         extProc:
         - authority: grpc-backend-2.default:8000
           destination:
-            name: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+            name: envoyextensionpolicy/default/policy-for-route-1/0
             settings:
             - protocol: GRPC
               weight: 1
@@ -258,7 +258,7 @@ xdsIR:
         extProc:
         - authority: grpc-backend.envoy-gateway:9000
           destination:
-            name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+            name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
             settings:
             - protocol: GRPC
               weight: 1
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.in.yaml
index 789891273..982d7da84 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.in.yaml
@@ -55,6 +55,6 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         port: 4000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
index 55e0b6618..740230fbf 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         port: 4000
     targetRef:
       group: gateway.networking.k8s.io
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.in.yaml
index b2420abfa..abb0bf365 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.in.yaml
@@ -55,5 +55,5 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
index 05db4b443..50c1a7371 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.in.yaml
index 6d3ec1fdd..71f453ec9 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.in.yaml
@@ -55,7 +55,7 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 9000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
index c4ad278a6..f62b31daa 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 9000
     targetRef:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.in.yaml
index eff5a17ef..b58eeee09 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.in.yaml
@@ -46,7 +46,7 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 9000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
index 7155bfe72..3ea2c40f4 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 9000
     targetRef:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml
index 21c6fab45..fb3d3cab1 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml
@@ -201,10 +201,17 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        Name: grpc-backend
+    - backendRefs:
+      - Name: grpc-backend
         Namespace: envoy-gateway
         Port: 8000
+      processingMode:
+        request:
+          body: Buffered
+        response:
+          body: Streamed
+      messageTimeout: 5s
+      failOpen: true
 - apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: EnvoyExtensionPolicy
   metadata:
@@ -217,6 +224,9 @@ envoyExtensionPolicies:
       name: httproute-1
       namespace: default
     extProc:
-    - backendRef:
-        Name: grpc-backend-2
+    - backendRefs:
+      - Name: grpc-backend-2
         Port: 9000
+      processingMode:
+        request: {}
+        response: {}
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
index c8eb952e5..e33b83f0e 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
@@ -73,9 +73,12 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend-2
+    - backendRefs:
+      - name: grpc-backend-2
         port: 9000
+      processingMode:
+        request: {}
+        response: {}
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
@@ -104,10 +107,17 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 8000
+      failOpen: true
+      messageTimeout: 5s
+      processingMode:
+        request:
+          body: Buffered
+        response:
+          body: Streamed
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
@@ -298,7 +308,7 @@ xdsIR:
         extProc:
         - authority: grpc-backend-2.default:9000
           destination:
-            name: envoyextensionpolicy/default/policy-for-http-route/0/grpc-backend-2
+            name: envoyextensionpolicy/default/policy-for-http-route/0
             settings:
             - addressType: IP
               endpoints:
@@ -312,6 +322,8 @@ xdsIR:
                 sni: grpc-backend-2
               weight: 1
           name: envoyextensionpolicy/default/policy-for-http-route/0
+          requestHeaderProcessing: true
+          responseHeaderProcessing: true
         hostname: www.foo.com
         isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
@@ -334,7 +346,7 @@ xdsIR:
         extProc:
         - authority: grpc-backend.envoy-gateway:8000
           destination:
-            name: envoyextensionpolicy/default/policy-for-gateway/0/grpc-backend
+            name: envoyextensionpolicy/default/policy-for-gateway/0
             settings:
             - addressType: IP
               protocol: GRPC
@@ -344,7 +356,13 @@ xdsIR:
                   name: policy-btls-grpc/default-ca
                 sni: grpc-backend
               weight: 1
+          failOpen: true
+          messageTimeout: 5s
           name: envoyextensionpolicy/default/policy-for-gateway/0
+          requestBodyProcessingMode: Buffered
+          requestHeaderProcessing: true
+          responseBodyProcessingMode: Streamed
+          responseHeaderProcessing: true
         hostname: www.bar.com
         isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml
new file mode 100644
index 000000000..a278b45a9
--- /dev/null
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml
@@ -0,0 +1,192 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: /foo
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: /bar
+      backendRefs:
+      - name: service-1
+        port: 8080
+services:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: envoy-gateway
+    name: grpc-backend
+  spec:
+    ports:
+    - port: 8000
+      name: grpc
+      protocol: TCP
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: default
+    name: grpc-backend-2
+  spec:
+    ports:
+    - port: 9000
+      name: grpc
+      protocol: TCP
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: grpc-backend
+  addressType: IPv4
+  ports:
+  - name: http
+    protocol: TCP
+    port: 8000
+  endpoints:
+  - addresses:
+    - 7.7.7.7
+    conditions:
+      ready: true
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend-2
+    namespace: default
+    labels:
+      kubernetes.io/service-name: grpc-backend-2
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 9000
+  endpoints:
+  - addresses:
+    - 8.8.8.8
+    conditions:
+      ready: true
+referenceGrants:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: ReferenceGrant
+  metadata:
+    namespace: envoy-gateway
+    name: referencegrant-1
+  spec:
+    from:
+    - group: gateway.envoyproxy.io
+      kind: SecurityPolicy
+      namespace: default
+    - group: gateway.networking.k8s.io
+      kind: BackendTLSPolicy
+      namespace: default
+    to:
+    - group: ''
+      kind: Service
+configMaps:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: ca-cmap
+    namespace: default
+  data:
+    ca.crt: |
+      -----BEGIN CERTIFICATE-----
+      MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+      BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+      MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+      A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+      1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+      yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+      kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+      Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+      ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+      bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+      6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+      BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+      2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+      i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+      A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+      d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+      3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+      -----END CERTIFICATE-----
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    name: policy-btls-grpc
+    namespace: default
+  spec:
+    targetRef:
+      group: ''
+      kind: Service
+      name: grpc-backend
+      namespace: envoy-gateway
+      sectionName: "8000"
+    tls:
+      caCertRefs:
+      - name: ca-cmap
+        group: ''
+        kind: ConfigMap
+      hostname: grpc-backend
+envoyExtensionPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    extProc:
+    - backendRefs:
+      - Name: grpc-backend
+        Namespace: envoy-gateway
+        Port: 8000
+      - Name: grpc-backend-2
+        Port: 9000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
new file mode 100755
index 000000000..a26a321d6
--- /dev/null
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
@@ -0,0 +1,277 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls-grpc
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: grpc-backend
+      namespace: envoy-gateway
+      sectionName: "8000"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: grpc-backend
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.envoyproxy.io
+        kind: EnvoyExtensionPolicy
+        name: policy-for-http-route
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+envoyExtensionPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    extProc:
+    - backendRefs:
+      - name: grpc-backend
+        namespace: envoy-gateway
+        port: 8000
+      - name: grpc-backend-2
+        port: 9000
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: default
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extProc:
+        - authority: grpc-backend.envoy-gateway:8000
+          destination:
+            name: envoyextensionpolicy/default/policy-for-http-route/0
+            settings:
+            - addressType: IP
+              protocol: GRPC
+              tls:
+                caCertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls-grpc/default-ca
+                sni: grpc-backend
+              weight: 1
+            - addressType: IP
+              endpoints:
+              - host: 8.8.8.8
+                port: 9000
+              protocol: GRPC
+              weight: 1
+          name: envoyextensionpolicy/default/policy-for-http-route/0
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/internal/gatewayapi/translator_test.go b/internal/gatewayapi/translator_test.go
index a22b69b53..23ade13da 100644
--- a/internal/gatewayapi/translator_test.go
+++ b/internal/gatewayapi/translator_test.go
@@ -34,9 +34,7 @@ import (
 	"github.com/envoyproxy/gateway/internal/utils/file"
 )
 
-var (
-	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
-)
+var overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
 
 func mustUnmarshal(t *testing.T, val []byte, out interface{}) {
 	require.NoError(t, yaml.UnmarshalStrict(val, out, yaml.DisallowUnknownFields))
@@ -444,7 +442,7 @@ func TestTranslateWithExtensionKinds(t *testing.T) {
 
 func overrideOutputConfig(t *testing.T, data string, filepath string) {
 	t.Helper()
-	file, err := os.OpenFile(filepath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0755)
+	file, err := os.OpenFile(filepath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o755)
 	require.NoError(t, err)
 	defer file.Close()
 	write := bufio.NewWriter(file)
diff --git a/internal/infrastructure/kubernetes/proxy/resource_provider_test.go b/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
index 6a9548817..0d4a59993 100644
--- a/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
+++ b/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
@@ -30,9 +30,7 @@ import (
 	"github.com/envoyproxy/gateway/internal/ir"
 )
 
-var (
-	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
-)
+var overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
 
 const (
 	// envoyHTTPPort is the container port number of Envoy's HTTP endpoint.
@@ -565,7 +563,7 @@ func TestDeployment(t *testing.T) {
 				deploymentYAML, err := yaml.Marshal(dp)
 				require.NoError(t, err)
 				// nolint: gosec
-				err = os.WriteFile(fmt.Sprintf("testdata/deployments/%s.yaml", tc.caseName), deploymentYAML, 0644)
+				err = os.WriteFile(fmt.Sprintf("testdata/deployments/%s.yaml", tc.caseName), deploymentYAML, 0o644)
 				require.NoError(t, err)
 				return
 			}
@@ -986,7 +984,7 @@ func TestDaemonSet(t *testing.T) {
 				deploymentYAML, err := yaml.Marshal(ds)
 				require.NoError(t, err)
 				// nolint: gosec
-				err = os.WriteFile(fmt.Sprintf("testdata/daemonsets/%s.yaml", tc.caseName), deploymentYAML, 0644)
+				err = os.WriteFile(fmt.Sprintf("testdata/daemonsets/%s.yaml", tc.caseName), deploymentYAML, 0o644)
 				require.NoError(t, err)
 				return
 			}
@@ -1150,7 +1148,6 @@ func loadConfigmap(tc string) (*corev1.ConfigMap, error) {
 }
 
 func TestServiceAccount(t *testing.T) {
-
 	cfg, err := config.New()
 	require.NoError(t, err)
 	cases := []struct {
@@ -1276,7 +1273,6 @@ func loadHPA(caseName string) (*autoscalingv2.HorizontalPodAutoscaler, error) {
 }
 
 func TestOwningGatewayLabelsAbsent(t *testing.T) {
-
 	cases := []struct {
 		caseName string
 		labels   map[string]string
@@ -1324,5 +1320,4 @@ func TestOwningGatewayLabelsAbsent(t *testing.T) {
 			require.Equal(t, tc.expect, actual)
 		})
 	}
-
 }
diff --git a/internal/infrastructure/kubernetes/proxy_infra_test.go b/internal/infrastructure/kubernetes/proxy_infra_test.go
index d39f80597..5c8a8d346 100644
--- a/internal/infrastructure/kubernetes/proxy_infra_test.go
+++ b/internal/infrastructure/kubernetes/proxy_infra_test.go
@@ -192,7 +192,6 @@ func TestCreateProxyInfra(t *testing.T) {
 }
 
 func TestDeleteProxyInfra(t *testing.T) {
-
 	testCases := []struct {
 		name   string
 		in     *ir.Infra
diff --git a/internal/infrastructure/kubernetes/ratelimit/resource_provider_test.go b/internal/infrastructure/kubernetes/ratelimit/resource_provider_test.go
index 03d794d0e..6345aebdc 100644
--- a/internal/infrastructure/kubernetes/ratelimit/resource_provider_test.go
+++ b/internal/infrastructure/kubernetes/ratelimit/resource_provider_test.go
@@ -27,9 +27,7 @@ import (
 	"github.com/envoyproxy/gateway/internal/envoygateway/config"
 )
 
-var (
-	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
-)
+var overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
 
 const (
 	// RedisAuthEnvVar is the redis auth.
@@ -43,7 +41,6 @@ var ownerReferenceUID = map[string]types.UID{
 }
 
 func TestRateLimitLabelSelector(t *testing.T) {
-
 	cases := []struct {
 		name     string
 		expected []string
@@ -65,7 +62,6 @@ func TestRateLimitLabelSelector(t *testing.T) {
 			require.ElementsMatch(t, tc.expected, got)
 		})
 	}
-
 }
 
 func TestRateLimitLabels(t *testing.T) {
@@ -126,7 +122,6 @@ func loadServiceAccount() (*corev1.ServiceAccount, error) {
 }
 
 func TestService(t *testing.T) {
-
 	cfg, err := config.New()
 	require.NoError(t, err)
 
@@ -209,7 +204,7 @@ func TestConfigmap(t *testing.T) {
 		cmYAML, err := yaml.Marshal(cm)
 		require.NoError(t, err)
 		// nolint:gosec
-		err = os.WriteFile("testdata/envoy-ratelimit-configmap.yaml", cmYAML, 0644)
+		err = os.WriteFile("testdata/envoy-ratelimit-configmap.yaml", cmYAML, 0o644)
 		require.NoError(t, err)
 		return
 	}
@@ -694,7 +689,8 @@ func TestDeployment(t *testing.T) {
 				Type: egv1a1.ProviderTypeKubernetes,
 				Kubernetes: &egv1a1.EnvoyGatewayKubernetesProvider{
 					RateLimitDeployment: tc.deploy,
-				}}
+				},
+			}
 			r := NewResourceRender(cfg.Namespace, cfg.EnvoyGateway, ownerReferenceUID)
 			dp, err := r.Deployment()
 			require.NoError(t, err)
@@ -703,7 +699,7 @@ func TestDeployment(t *testing.T) {
 				deploymentYAML, err := yaml.Marshal(dp)
 				require.NoError(t, err)
 				// nolint:gosec
-				err = os.WriteFile(fmt.Sprintf("testdata/deployments/%s.yaml", tc.caseName), deploymentYAML, 0644)
+				err = os.WriteFile(fmt.Sprintf("testdata/deployments/%s.yaml", tc.caseName), deploymentYAML, 0o644)
 				require.NoError(t, err)
 				return
 			}
diff --git a/internal/infrastructure/kubernetes/ratelimit/resource_test.go b/internal/infrastructure/kubernetes/ratelimit/resource_test.go
index 71179c8c7..61d24eac8 100644
--- a/internal/infrastructure/kubernetes/ratelimit/resource_test.go
+++ b/internal/infrastructure/kubernetes/ratelimit/resource_test.go
@@ -12,7 +12,6 @@ import (
 )
 
 func TestCheckTraceEndpointScheme(t *testing.T) {
-
 	cases := []struct {
 		caseName    string
 		actualURL   string
@@ -36,5 +35,4 @@ func TestCheckTraceEndpointScheme(t *testing.T) {
 			require.Equal(t, tc.expectedURL, actual)
 		})
 	}
-
 }
diff --git a/internal/infrastructure/kubernetes/resource/resource_test.go b/internal/infrastructure/kubernetes/resource/resource_test.go
index 14df266e1..b65549911 100644
--- a/internal/infrastructure/kubernetes/resource/resource_test.go
+++ b/internal/infrastructure/kubernetes/resource/resource_test.go
@@ -213,7 +213,8 @@ func TestCompareSvc(t *testing.T) {
 					Type: "NodePort",
 				},
 			},
-		}, {
+		},
+		{
 			// Only Spec.Ports[*].Port is different
 			ExpectRet: false,
 			NewSvc: &corev1.Service{
@@ -298,7 +299,8 @@ func TestCompareSvc(t *testing.T) {
 					Type: "ClusterIP",
 				},
 			},
-		}, {
+		},
+		{
 			// Finalizers field differs
 			ExpectRet: true,
 			NewSvc: &corev1.Service{
diff --git a/internal/ir/xds_test.go b/internal/ir/xds_test.go
index 8b16cf6e9..30c07a700 100644
--- a/internal/ir/xds_test.go
+++ b/internal/ir/xds_test.go
@@ -35,11 +35,11 @@ var (
 		Hostnames: []string{"example.com"},
 		TLS: &TLSConfig{
 			Certificates: []TLSCertificate{{
-
 				Name:              "happy",
 				ServerCertificate: []byte{1, 2, 3},
 				PrivateKey:        []byte{1, 2, 3},
-			}}},
+			}},
+		},
 		Routes: []*HTTPRoute{&happyHTTPRoute},
 	}
 	redactedHappyHTTPSListener = HTTPListener{
@@ -49,11 +49,11 @@ var (
 		Hostnames: []string{"example.com"},
 		TLS: &TLSConfig{
 			Certificates: []TLSCertificate{{
-
 				Name:              "happy",
 				ServerCertificate: []byte{1, 2, 3},
 				PrivateKey:        redacted,
-			}}},
+			}},
+		},
 		Routes: []*HTTPRoute{&happyHTTPRoute},
 	}
 	invalidAddrHTTPListener = HTTPListener{
@@ -96,7 +96,8 @@ var (
 				Name:              "happy",
 				ServerCertificate: []byte("server-cert"),
 				PrivateKey:        []byte("priv-key"),
-			}}}},
+			}},
+		}},
 		Destination: &happyRouteDestination,
 	}
 
@@ -658,7 +659,8 @@ func TestValidateTLSListenerConfig(t *testing.T) {
 				Certificates: []TLSCertificate{{
 					ServerCertificate: []byte("server-cert"),
 					PrivateKey:        []byte("priv-key"),
-				}}},
+				}},
+			},
 			want: nil,
 		},
 		{
@@ -666,7 +668,8 @@ func TestValidateTLSListenerConfig(t *testing.T) {
 			input: TLSConfig{
 				Certificates: []TLSCertificate{{
 					PrivateKey: []byte("priv-key"),
-				}}},
+				}},
+			},
 			want: ErrTLSServerCertEmpty,
 		},
 		{
@@ -674,7 +677,8 @@ func TestValidateTLSListenerConfig(t *testing.T) {
 			input: TLSConfig{
 				Certificates: []TLSCertificate{{
 					ServerCertificate: []byte("server-cert"),
-				}}},
+				}},
+			},
 			want: ErrTLSPrivateKey,
 		},
 	}
@@ -1253,231 +1257,244 @@ func TestValidateHealthCheck(t *testing.T) {
 	}{
 		{
 			name: "invalid timeout",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Duration(0)},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To[uint32](3),
-				HealthyThreshold:   ptr.To[uint32](3),
-				HTTP: &HTTPHealthChecker{
-					Host:             "*",
-					Path:             "/healthz",
-					ExpectedStatuses: []HTTPStatus{200, 400},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Duration(0)},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To[uint32](3),
+					HealthyThreshold:   ptr.To[uint32](3),
+					HTTP: &HTTPHealthChecker{
+						Host:             "*",
+						Path:             "/healthz",
+						ExpectedStatuses: []HTTPStatus{200, 400},
+					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHealthCheckTimeoutInvalid,
 		},
 		{
 			name: "invalid interval",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Duration(0)},
-				UnhealthyThreshold: ptr.To[uint32](3),
-				HealthyThreshold:   ptr.To[uint32](3),
-				HTTP: &HTTPHealthChecker{
-					Host:             "*",
-					Path:             "/healthz",
-					Method:           ptr.To(http.MethodGet),
-					ExpectedStatuses: []HTTPStatus{200, 400},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Duration(0)},
+					UnhealthyThreshold: ptr.To[uint32](3),
+					HealthyThreshold:   ptr.To[uint32](3),
+					HTTP: &HTTPHealthChecker{
+						Host:             "*",
+						Path:             "/healthz",
+						Method:           ptr.To(http.MethodGet),
+						ExpectedStatuses: []HTTPStatus{200, 400},
+					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHealthCheckIntervalInvalid,
 		},
 		{
 			name: "invalid unhealthy threshold",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To[uint32](0),
-				HealthyThreshold:   ptr.To[uint32](3),
-				HTTP: &HTTPHealthChecker{
-					Host:             "*",
-					Path:             "/healthz",
-					Method:           ptr.To(http.MethodPatch),
-					ExpectedStatuses: []HTTPStatus{200, 400},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To[uint32](0),
+					HealthyThreshold:   ptr.To[uint32](3),
+					HTTP: &HTTPHealthChecker{
+						Host:             "*",
+						Path:             "/healthz",
+						Method:           ptr.To(http.MethodPatch),
+						ExpectedStatuses: []HTTPStatus{200, 400},
+					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHealthCheckUnhealthyThresholdInvalid,
 		},
 		{
 			name: "invalid healthy threshold",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To[uint32](3),
-				HealthyThreshold:   ptr.To[uint32](0),
-				HTTP: &HTTPHealthChecker{
-					Host:             "*",
-					Path:             "/healthz",
-					Method:           ptr.To(http.MethodPost),
-					ExpectedStatuses: []HTTPStatus{200, 400},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To[uint32](3),
+					HealthyThreshold:   ptr.To[uint32](0),
+					HTTP: &HTTPHealthChecker{
+						Host:             "*",
+						Path:             "/healthz",
+						Method:           ptr.To(http.MethodPost),
+						ExpectedStatuses: []HTTPStatus{200, 400},
+					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHealthCheckHealthyThresholdInvalid,
 		},
 		{
 			name: "http-health-check: invalid host",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To[uint32](3),
-				HealthyThreshold:   ptr.To[uint32](3),
-				HTTP: &HTTPHealthChecker{
-					Path:             "/healthz",
-					Method:           ptr.To(http.MethodPut),
-					ExpectedStatuses: []HTTPStatus{200, 400},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To[uint32](3),
+					HealthyThreshold:   ptr.To[uint32](3),
+					HTTP: &HTTPHealthChecker{
+						Path:             "/healthz",
+						Method:           ptr.To(http.MethodPut),
+						ExpectedStatuses: []HTTPStatus{200, 400},
+					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHCHTTPHostInvalid,
 		},
 		{
 			name: "http-health-check: invalid path",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To[uint32](3),
-				HealthyThreshold:   ptr.To[uint32](3),
-				HTTP: &HTTPHealthChecker{
-					Host:             "*",
-					Path:             "",
-					Method:           ptr.To(http.MethodPut),
-					ExpectedStatuses: []HTTPStatus{200, 400},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To[uint32](3),
+					HealthyThreshold:   ptr.To[uint32](3),
+					HTTP: &HTTPHealthChecker{
+						Host:             "*",
+						Path:             "",
+						Method:           ptr.To(http.MethodPut),
+						ExpectedStatuses: []HTTPStatus{200, 400},
+					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHCHTTPPathInvalid,
 		},
 		{
 			name: "http-health-check: invalid method",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To(uint32(3)),
-				HealthyThreshold:   ptr.To(uint32(3)),
-				HTTP: &HTTPHealthChecker{
-					Host:             "*",
-					Path:             "/healthz",
-					Method:           ptr.To(http.MethodConnect),
-					ExpectedStatuses: []HTTPStatus{200, 400},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To(uint32(3)),
+					HealthyThreshold:   ptr.To(uint32(3)),
+					HTTP: &HTTPHealthChecker{
+						Host:             "*",
+						Path:             "/healthz",
+						Method:           ptr.To(http.MethodConnect),
+						ExpectedStatuses: []HTTPStatus{200, 400},
+					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHCHTTPMethodInvalid,
 		},
 		{
 			name: "http-health-check: invalid expected-statuses",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To(uint32(3)),
-				HealthyThreshold:   ptr.To(uint32(3)),
-				HTTP: &HTTPHealthChecker{
-					Host:             "*",
-					Path:             "/healthz",
-					Method:           ptr.To(http.MethodDelete),
-					ExpectedStatuses: []HTTPStatus{},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To(uint32(3)),
+					HealthyThreshold:   ptr.To(uint32(3)),
+					HTTP: &HTTPHealthChecker{
+						Host:             "*",
+						Path:             "/healthz",
+						Method:           ptr.To(http.MethodDelete),
+						ExpectedStatuses: []HTTPStatus{},
+					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHCHTTPExpectedStatusesInvalid,
 		},
 		{
 			name: "http-health-check: invalid range",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To(uint32(3)),
-				HealthyThreshold:   ptr.To(uint32(3)),
-				HTTP: &HTTPHealthChecker{
-					Host:             "*",
-					Path:             "/healthz",
-					Method:           ptr.To(http.MethodHead),
-					ExpectedStatuses: []HTTPStatus{100, 600},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To(uint32(3)),
+					HealthyThreshold:   ptr.To(uint32(3)),
+					HTTP: &HTTPHealthChecker{
+						Host:             "*",
+						Path:             "/healthz",
+						Method:           ptr.To(http.MethodHead),
+						ExpectedStatuses: []HTTPStatus{100, 600},
+					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHTTPStatusInvalid,
 		},
 		{
 			name: "http-health-check: invalid expected-responses",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To(uint32(3)),
-				HealthyThreshold:   ptr.To(uint32(3)),
-				HTTP: &HTTPHealthChecker{
-					Host:             "*",
-					Path:             "/healthz",
-					Method:           ptr.To(http.MethodOptions),
-					ExpectedStatuses: []HTTPStatus{200, 300},
-					ExpectedResponse: &HealthCheckPayload{
-						Text:   ptr.To("foo"),
-						Binary: []byte{'f', 'o', 'o'},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To(uint32(3)),
+					HealthyThreshold:   ptr.To(uint32(3)),
+					HTTP: &HTTPHealthChecker{
+						Host:             "*",
+						Path:             "/healthz",
+						Method:           ptr.To(http.MethodOptions),
+						ExpectedStatuses: []HTTPStatus{200, 300},
+						ExpectedResponse: &HealthCheckPayload{
+							Text:   ptr.To("foo"),
+							Binary: []byte{'f', 'o', 'o'},
+						},
 					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHealthCheckPayloadInvalid,
 		},
 		{
 			name: "tcp-health-check: invalid send payload",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To(uint32(3)),
-				HealthyThreshold:   ptr.To(uint32(3)),
-				TCP: &TCPHealthChecker{
-					Send: &HealthCheckPayload{
-						Text:   ptr.To("foo"),
-						Binary: []byte{'f', 'o', 'o'},
-					},
-					Receive: &HealthCheckPayload{
-						Text: ptr.To("foo"),
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To(uint32(3)),
+					HealthyThreshold:   ptr.To(uint32(3)),
+					TCP: &TCPHealthChecker{
+						Send: &HealthCheckPayload{
+							Text:   ptr.To("foo"),
+							Binary: []byte{'f', 'o', 'o'},
+						},
+						Receive: &HealthCheckPayload{
+							Text: ptr.To("foo"),
+						},
 					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHealthCheckPayloadInvalid,
 		},
 		{
 			name: "tcp-health-check: invalid receive payload",
-			input: HealthCheck{&ActiveHealthCheck{
-				Timeout:            &metav1.Duration{Duration: time.Second},
-				Interval:           &metav1.Duration{Duration: time.Second},
-				UnhealthyThreshold: ptr.To(uint32(3)),
-				HealthyThreshold:   ptr.To(uint32(3)),
-				TCP: &TCPHealthChecker{
-					Send: &HealthCheckPayload{
-						Text: ptr.To("foo"),
-					},
-					Receive: &HealthCheckPayload{
-						Text:   ptr.To("foo"),
-						Binary: []byte{'f', 'o', 'o'},
+			input: HealthCheck{
+				&ActiveHealthCheck{
+					Timeout:            &metav1.Duration{Duration: time.Second},
+					Interval:           &metav1.Duration{Duration: time.Second},
+					UnhealthyThreshold: ptr.To(uint32(3)),
+					HealthyThreshold:   ptr.To(uint32(3)),
+					TCP: &TCPHealthChecker{
+						Send: &HealthCheckPayload{
+							Text: ptr.To("foo"),
+						},
+						Receive: &HealthCheckPayload{
+							Text:   ptr.To("foo"),
+							Binary: []byte{'f', 'o', 'o'},
+						},
 					},
 				},
-			},
 				&OutlierDetection{},
 			},
 			want: ErrHealthCheckPayloadInvalid,
 		},
 		{
 			name: "OutlierDetection invalid interval",
-			input: HealthCheck{&ActiveHealthCheck{},
+			input: HealthCheck{
+				&ActiveHealthCheck{},
 				&OutlierDetection{
 					Interval:         &metav1.Duration{Duration: time.Duration(0)},
 					BaseEjectionTime: &metav1.Duration{Duration: time.Second},
@@ -1487,7 +1504,8 @@ func TestValidateHealthCheck(t *testing.T) {
 		},
 		{
 			name: "OutlierDetection invalid BaseEjectionTime",
-			input: HealthCheck{&ActiveHealthCheck{},
+			input: HealthCheck{
+				&ActiveHealthCheck{},
 				&OutlierDetection{
 					Interval:         &metav1.Duration{Duration: time.Second},
 					BaseEjectionTime: &metav1.Duration{Duration: time.Duration(0)},
diff --git a/internal/metrics/metrics_test.go b/internal/metrics/metrics_test.go
index 560141c62..9b1aafcd5 100644
--- a/internal/metrics/metrics_test.go
+++ b/internal/metrics/metrics_test.go
@@ -29,12 +29,9 @@ import (
 	semconv "go.opentelemetry.io/otel/semconv/v1.17.0"
 )
 
-var (
-	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
-)
+var overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
 
 func TestCounter(t *testing.T) {
-
 	name := "counter_metric"
 
 	var writer io.ReadWriter = bytes.NewBuffer(nil)
@@ -87,7 +84,6 @@ func TestCounter(t *testing.T) {
 }
 
 func TestGauge(t *testing.T) {
-
 	name := "gauge_metric"
 
 	var writer io.ReadWriter = bytes.NewBuffer(nil)
@@ -130,7 +126,6 @@ func TestGauge(t *testing.T) {
 }
 
 func TestHistogram(t *testing.T) {
-
 	name := "histogram_metric"
 
 	var writer io.ReadWriter = bytes.NewBuffer(nil)
@@ -219,7 +214,7 @@ func exporterWriter(name string, origin io.ReadWriter) (io.ReadWriter, error) {
 		fname := fmt.Sprintf("testdata/%s.json", name)
 
 		// nolint:gosec
-		f, err := os.OpenFile(fname, os.O_CREATE|os.O_RDWR, 0644)
+		f, err := os.OpenFile(fname, os.O_CREATE|os.O_RDWR, 0o644)
 		if err != nil {
 			return nil, err
 		}
diff --git a/internal/provider/kubernetes/kubernetes_test.go b/internal/provider/kubernetes/kubernetes_test.go
index 2187e5b5d..c0ca5d094 100644
--- a/internal/provider/kubernetes/kubernetes_test.go
+++ b/internal/provider/kubernetes/kubernetes_test.go
@@ -442,7 +442,7 @@ func testHTTPRoute(ctx context.Context, t *testing.T, provider *Provider, resour
 
 	rewriteHostname := gwapiv1.PreciseHostname("rewrite.hostname.local")
 
-	var testCases = []struct {
+	testCases := []struct {
 		name  string
 		route gwapiv1.HTTPRoute
 	}{
@@ -986,7 +986,7 @@ func testTLSRoute(ctx context.Context, t *testing.T, provider *Provider, resourc
 		require.NoError(t, cli.Delete(ctx, svc))
 	}()
 
-	var testCases = []struct {
+	testCases := []struct {
 		name  string
 		route gwapiv1a2.TLSRoute
 	}{
@@ -1149,13 +1149,17 @@ func testServiceCleanupForMultipleRoutes(ctx context.Context, t *testing.T, prov
 				}},
 			},
 			Hostnames: []gwapiv1a2.Hostname{"test-tls.hostname.local"},
-			Rules: []gwapiv1a2.TLSRouteRule{{
-				BackendRefs: []gwapiv1a2.BackendRef{{
-					BackendObjectReference: gwapiv1a2.BackendObjectReference{
-						Name: "test-common-svc",
-						Port: ptr.To(gwapiv1.PortNumber(90)),
-					}},
-				}},
+			Rules: []gwapiv1a2.TLSRouteRule{
+				{
+					BackendRefs: []gwapiv1a2.BackendRef{
+						{
+							BackendObjectReference: gwapiv1a2.BackendObjectReference{
+								Name: "test-common-svc",
+								Port: ptr.To(gwapiv1.PortNumber(90)),
+							},
+						},
+					},
+				},
 			},
 		},
 	}
@@ -1585,7 +1589,6 @@ func TestNamespaceSelectorProvider(t *testing.T) {
 		}
 		return res != nil && len(res.GRPCRoutes) == 1
 	}, defaultWait, defaultTick)
-
 }
 
 func waitUntilGatewayClassResourcesAreReady(resources *message.ProviderResources, gatewayClassName string) (*gatewayapi.Resources, bool) {
diff --git a/internal/provider/kubernetes/predicates_test.go b/internal/provider/kubernetes/predicates_test.go
index e9f24d6e5..b23ebb41d 100644
--- a/internal/provider/kubernetes/predicates_test.go
+++ b/internal/provider/kubernetes/predicates_test.go
@@ -530,9 +530,11 @@ func TestValidateServiceForReconcile(t *testing.T) {
 						},
 						ExtProc: []v1alpha1.ExtProc{
 							{
-								BackendRef: v1alpha1.ExtProcBackendRef{
-									BackendObjectReference: gwapiv1.BackendObjectReference{
-										Name: "ext-proc-service",
+								BackendRefs: []v1alpha1.BackendRef{
+									{
+										BackendObjectReference: gwapiv1.BackendObjectReference{
+											Name: "ext-proc-service",
+										},
 									},
 								},
 							},
@@ -559,9 +561,11 @@ func TestValidateServiceForReconcile(t *testing.T) {
 						},
 						ExtProc: []v1alpha1.ExtProc{
 							{
-								BackendRef: v1alpha1.ExtProcBackendRef{
-									BackendObjectReference: gwapiv1.BackendObjectReference{
-										Name: "ext-proc-service",
+								BackendRefs: []v1alpha1.BackendRef{
+									{
+										BackendObjectReference: gwapiv1.BackendObjectReference{
+											Name: "ext-proc-service",
+										},
 									},
 								},
 							},
diff --git a/internal/utils/field/field_test.go b/internal/utils/field/field_test.go
index fe8460973..8e8322d9a 100644
--- a/internal/utils/field/field_test.go
+++ b/internal/utils/field/field_test.go
@@ -19,22 +19,25 @@ func TestSetValue(t *testing.T) {
 		fieldValue  any
 		expect      any
 		expectedErr bool
-	}{{
-		name:        "field name cannot be empty",
-		input:       "",
-		expectedErr: true,
-	},
+	}{
+		{
+			name:        "field name cannot be empty",
+			input:       "",
+			expectedErr: true,
+		},
 		{
 			name:        "input cannot be a string",
 			input:       "",
 			fieldName:   "K",
 			expectedErr: true,
-		}, {
+		},
+		{
 			name:        "input cannot be a struct",
 			input:       struct{}{},
 			fieldName:   "K",
 			expectedErr: true,
-		}, {
+		},
+		{
 			name: "field cannot be unexported",
 			input: &struct {
 				name string
@@ -45,7 +48,8 @@ func TestSetValue(t *testing.T) {
 			expectedErr: true,
 			fieldName:   "name",
 			fieldValue:  "test1",
-		}, {
+		},
+		{
 			name: "simple struct set value",
 			input: &struct {
 				Name string
@@ -56,7 +60,8 @@ func TestSetValue(t *testing.T) {
 			expectedErr: false,
 			fieldName:   "Name",
 			fieldValue:  "test1",
-		}, {
+		},
+		{
 			name: "simple recursive struct set value",
 			input: &struct {
 				Name  string
@@ -77,7 +82,8 @@ func TestSetValue(t *testing.T) {
 			expectedErr: false,
 			fieldName:   "Name",
 			fieldValue:  "test1",
-		}, {
+		},
+		{
 			name: "simple recursive child struct in slice set value",
 			input: &struct {
 				Name  string
@@ -100,7 +106,8 @@ func TestSetValue(t *testing.T) {
 			expectedErr: false,
 			fieldName:   "Name",
 			fieldValue:  "test1",
-		}, {
+		},
+		{
 			name: "simple recursive child struct in map set value",
 			input: &struct {
 				Name  string
diff --git a/internal/xds/bootstrap/bootstrap_test.go b/internal/xds/bootstrap/bootstrap_test.go
index a913fbb08..54ee52f3d 100644
--- a/internal/xds/bootstrap/bootstrap_test.go
+++ b/internal/xds/bootstrap/bootstrap_test.go
@@ -145,7 +145,7 @@ func TestGetRenderedBootstrapConfig(t *testing.T) {
 
 			if *overrideTestData {
 				// nolint:gosec
-				err = os.WriteFile(path.Join("testdata", "render", fmt.Sprintf("%s.yaml", tc.name)), []byte(got), 0644)
+				err = os.WriteFile(path.Join("testdata", "render", fmt.Sprintf("%s.yaml", tc.name)), []byte(got), 0o644)
 				require.NoError(t, err)
 				return
 			}
diff --git a/internal/xds/bootstrap/util_test.go b/internal/xds/bootstrap/util_test.go
index b0d274600..5591d0e4f 100644
--- a/internal/xds/bootstrap/util_test.go
+++ b/internal/xds/bootstrap/util_test.go
@@ -18,9 +18,7 @@ import (
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 )
 
-var (
-	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
-)
+var overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
 
 func TestApplyBootstrapConfig(t *testing.T) {
 	str, _ := readTestData("enable-prometheus")
@@ -56,7 +54,7 @@ func TestApplyBootstrapConfig(t *testing.T) {
 
 			if *overrideTestData {
 				// nolint:gosec
-				err = os.WriteFile(path.Join("testdata", "merge", fmt.Sprintf("%s.out.yaml", tc.name)), []byte(data), 0644)
+				err = os.WriteFile(path.Join("testdata", "merge", fmt.Sprintf("%s.out.yaml", tc.name)), []byte(data), 0o644)
 				require.NoError(t, err)
 				return
 			}
diff --git a/internal/xds/translator/runner/runner_test.go b/internal/xds/translator/runner/runner_test.go
index 9f3d7035b..a7be53236 100644
--- a/internal/xds/translator/runner/runner_test.go
+++ b/internal/xds/translator/runner/runner_test.go
@@ -98,7 +98,6 @@ func TestRunner(t *testing.T) {
 		// Ensure that xds has no key, value pairs
 		return len(out) == 0
 	}, time.Second*5, time.Millisecond*50)
-
 }
 
 func TestRunner_withExtensionManager(t *testing.T) {
diff --git a/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml b/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml
index 170f1a3f2..90fd06748 100644
--- a/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml
@@ -21,22 +21,30 @@ http:
                   port: 8080
               protocol: HTTP
               weight: 1
-        envoyExtensionFeatures:
-          extProc:
-            - name: envoyextensionpolicy/default/policy-for-route-2/0
-              authority: grpc-backend-4.default:4000
-              destination:
-                name: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
-                settings:
-                  - protocol: GRPC
-                    weight: 1
-            - name: envoyextensionpolicy/default/policy-for-route-1/0
-              authority: grpc-backend-2.default:8000
-              destination:
-                name: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
-                settings:
-                  - protocol: GRPC
-                    weight: 1
+        extProc:
+          - name: envoyextensionpolicy/default/policy-for-route-2/0
+            failOpen: true
+            messageTimeout: 5s
+            requestHeaderProcessing: true
+            requestBodyProcessingMode: Buffered
+            responseBodyProcessingMode: Streamed
+            authority: grpc-backend-4.default:4000
+            destination:
+              name: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+              settings:
+                - protocol: GRPC
+                  weight: 1
+          - name: envoyextensionpolicy/default/policy-for-route-1/0
+            failOpen: true
+            messageTimeout: 5s
+            responseHeaderProcessing: true
+            requestBodyProcessingMode: BufferedPartial
+            authority: grpc-backend-2.default:8000
+            destination:
+              name: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+              settings:
+                - protocol: GRPC
+                  weight: 1
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
@@ -56,22 +64,23 @@ http:
                   port: 8080
               protocol: HTTP
               weight: 1
-        envoyExtensionFeatures:
-          extProc:
-            - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0
-              authority: grpc-backend-3.envoy-gateway:3000
-              destination:
-                name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
-                settings:
-                  - protocol: GRPC
-                    weight: 1
-            - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
-              authority: grpc-backend.envoy-gateway:9000
-              destination:
-                name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
-                settings:
-                  - protocol: GRPC
-                    weight: 1
+        extProc:
+          - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0
+            authority: grpc-backend-3.envoy-gateway:3000
+            destination:
+              name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+              settings:
+                - protocol: GRPC
+                  weight: 1
+          - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
+            failOpen: false
+            messageTimeout: 15s
+            authority: grpc-backend.envoy-gateway:9000
+            destination:
+              name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+              settings:
+                - protocol: GRPC
+                  weight: 1
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.clusters.yaml
index 6a277bb94..08b38495e 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.clusters.yaml
@@ -32,3 +32,91 @@
   outlierDetection: {}
   perConnectionBufferLimitBytes: 32768
   type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+  lbPolicy: LEAST_REQUEST
+  name: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+  lbPolicy: LEAST_REQUEST
+  name: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+  lbPolicy: LEAST_REQUEST
+  name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+  lbPolicy: LEAST_REQUEST
+  name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.endpoints.yaml
index 05442a9a1..4ec680ce7 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.endpoints.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.endpoints.yaml
@@ -22,3 +22,23 @@
     loadBalancingWeight: 1
     locality:
       region: httproute/default/httproute-2/rule/0/backend/0
+- clusterName: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+  endpoints:
+  - loadBalancingWeight: 1
+    locality:
+      region: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4/backend/0
+- clusterName: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+  endpoints:
+  - loadBalancingWeight: 1
+    locality:
+      region: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2/backend/0
+- clusterName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+  endpoints:
+  - loadBalancingWeight: 1
+    locality:
+      region: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3/backend/0
+- clusterName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+  endpoints:
+  - loadBalancingWeight: 1
+    locality:
+      region: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend/backend/0
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml
index a593a50af..f82244796 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml
@@ -14,6 +14,70 @@
           initialStreamWindowSize: 65536
           maxConcurrentStreams: 100
         httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-2/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            failureModeAllow: true
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend-4.default:4000
+                clusterName: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+              timeout: 10s
+            messageTimeout: 5s
+            processingMode:
+              requestBodyMode: BUFFERED
+              requestHeaderMode: SEND
+              requestTrailerMode: SKIP
+              responseBodyMode: STREAMED
+              responseHeaderMode: SKIP
+              responseTrailerMode: SKIP
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-1/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            failureModeAllow: true
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend-2.default:8000
+                clusterName: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+              timeout: 10s
+            messageTimeout: 5s
+            processingMode:
+              requestBodyMode: BUFFERED_PARTIAL
+              requestHeaderMode: SKIP
+              requestTrailerMode: SKIP
+              responseHeaderMode: SEND
+              responseTrailerMode: SKIP
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend-3.envoy-gateway:3000
+                clusterName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+              timeout: 10s
+            processingMode:
+              requestHeaderMode: SKIP
+              requestTrailerMode: SKIP
+              responseHeaderMode: SKIP
+              responseTrailerMode: SKIP
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend.envoy-gateway:9000
+                clusterName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+              timeout: 10s
+            messageTimeout: 15s
+            processingMode:
+              requestHeaderMode: SKIP
+              requestTrailerMode: SKIP
+              responseHeaderMode: SKIP
+              responseTrailerMode: SKIP
         - name: envoy.filters.http.router
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml
index a7002b63f..0daf1919c 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml
@@ -12,6 +12,13 @@
         cluster: httproute/default/httproute-1/rule/0
         upgradeConfigs:
         - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-1/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-2/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
     - match:
         pathSeparatedPrefix: /bar
       name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
@@ -19,3 +26,10 @@
         cluster: httproute/default/httproute-2/rule/0
         upgradeConfigs:
         - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+        envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 72dbebba4..d485100ea 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -1210,33 +1210,12 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[ExtProcBackendRef](#extprocbackendref)_ |  true  | BackendRef defines the configuration of the external processing service |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs defines the configuration of the external processing service |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  true  | BackendRefs defines the configuration of the external processing service |
 | `messageTimeout` | _[Duration](#duration)_ |  false  | MessageTimeout is the timeout for a response to be returned from the external processor<br />Default: 200ms |
 | `failOpen` | _boolean_ |  false  | FailOpen defines if requests or responses that cannot be processed due to connectivity to the<br />external processor are terminated or passed-through.<br />Default: false |
 | `processingMode` | _[ExtProcProcessingMode](#extprocprocessingmode)_ |  false  | ProcessingMode defines how request and response body is processed<br />Default: header and body are not sent to the external processor |
 
 
-#### ExtProcBackendRef
-
-
-
-ExtProcService defines the gRPC External Processing service using the envoy grpc client
-The processing request and response messages are defined in
-https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ext_proc/v3/external_processor.proto
-
-_Appears in:_
-- [ExtProc](#extproc)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `group` | _[Group](#group)_ |  false  | Group is the group of the referent. For example, "gateway.networking.k8s.io".<br />When unspecified or empty string, core API group is inferred. |
-| `kind` | _[Kind](#kind)_ |  false  | Kind is the Kubernetes resource kind of the referent. For example<br />"Service".<br /><br />Defaults to "Service" when not specified.<br /><br />ExternalName services can refer to CNAME DNS records that may live<br />outside of the cluster and as such are difficult to reason about in<br />terms of conformance. They also may not be safe to forward to (see<br />CVE-2021-25740 for more information). Implementations SHOULD NOT<br />support ExternalName Services.<br /><br />Support: Core (Services with a type other than ExternalName)<br /><br />Support: Implementation-specific (Services with type ExternalName) |
-| `name` | _[ObjectName](#objectname)_ |  true  | Name is the name of the referent. |
-| `namespace` | _[Namespace](#namespace)_ |  false  | Namespace is the namespace of the backend. When unspecified, the local<br />namespace is inferred.<br /><br />Note that when a namespace different than the local namespace is specified,<br />a ReferenceGrant object is required in the referent namespace to allow that<br />namespace's owner to accept the reference. See the ReferenceGrant<br />documentation for details.<br /><br />Support: Core |
-| `port` | _[PortNumber](#portnumber)_ |  false  | Port specifies the destination port number to use for this resource.<br />Port is required when the referent is a Kubernetes Service. In this<br />case, the port number is the service port number, not the target port.<br />For other resources, destination port might be derived from the referent<br />resource or this field. |
-
-
 #### ExtProcBodyProcessingMode
 
 _Underlying type:_ _string_
diff --git a/site/content/en/latest/tasks/security/oidc.md b/site/content/en/latest/tasks/security/oidc.md
index 0360ccd49..ac7d6d60b 100644
--- a/site/content/en/latest/tasks/security/oidc.md
+++ b/site/content/en/latest/tasks/security/oidc.md
@@ -4,7 +4,7 @@ title: "OIDC Authentication"
 
 This task provides instructions for configuring [OpenID Connect (OIDC)][oidc] authentication.
 OpenID Connect (OIDC) is an authentication standard built on top of OAuth 2.0.
-It enables client applications to rely on authentication that is performed by an OpenID Connect Provider (OP)
+It enables EG to rely on authentication that is performed by an OpenID Connect Provider (OP)
 to verify the identity of a user.
 
 Envoy Gateway introduces a new CRD called [SecurityPolicy][SecurityPolicy] that allows the user to configure OIDC
@@ -16,17 +16,15 @@ This instantiated resource can be linked to a [Gateway][Gateway] and [HTTPRoute]
 Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
 Before proceeding, you should be able to query the example backend using HTTP.
 
+EG OIDC authentication requires the redirect URL to be HTTPS. Follow the [Secure Gateways](../secure-gateways) guide
+to generate the TLS certificates and update the Gateway configuration to add an HTTPS listener.
+
 Verify the Gateway status:
 
 ```shell
 kubectl get gateway/eg -o yaml
 ```
 
-OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
-the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations. 
-
-This task demonstrates the configuration of OIDC at the HTTPRoute level.
-
 Let's create an HTTPRoute that represents an application protected by OIDC.
 
 {{< tabpane text=true >}}
@@ -86,16 +84,21 @@ Verify the HTTPRoute status:
 kubectl get httproute/myapp -o yaml
 ```
 
-## Configuration
+## OIDC Authentication for a HTTPRoute
 
-This task uses Google as the OIDC provider to demonstrate the configuration of OIDC. However, EG works with any OIDC
-providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc.
+OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with 
+the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations.
+
+This section demonstrates how to configure OIDC authentication for a specific HTTPRoute.
 
 ### Register an OIDC application
 
+This task uses Google as the OIDC provider to demonstrate the configuration of OIDC. However, EG works with any OIDC
+providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc.
+
 Follow the steps in the [Google OIDC documentation][google-oidc] to register an OIDC application. Please make sure the
 redirect URL is set to the one you configured in the SecurityPolicy that you will create in the step below. In this example,
-the redirect URL is `http://www.example.com:8080/myapp/oauth2/callback`.
+the redirect URL is `http://www.example.com:8443/myapp/oauth2/callback`.
 
 After registering the application, you should have the following information:
 * Client ID: The client ID of the OIDC application.
@@ -109,15 +112,14 @@ and the Client Secret must be stored in the key "client-secret".
 Note: please replace the ${CLIENT_SECRET} with the actual Client Secret that you got from the previous step.
 
 ```shell
-$ kubectl create secret generic my-app-client-secret --from-literal=client-secret=${CLIENT_SECRET}
-secret "my-app-client-secret" created
+kubectl create secret generic my-app-client-secret --from-literal=client-secret=${CLIENT_SECRET}
 ```
 
 ### Create a SecurityPolicy
 
-Please notice that the `redirectURL` and `logoutPath` must match the target HTTPRoute. In this example, the target
+**Please notice that the `redirectURL` and `logoutPath` must match the target HTTPRoute.** In this example, the target
 HTTPRoute is configured to match the host `www.example.com` and the path `/myapp`, so the `redirectURL` must be prefixed 
-with `http://www.example.com:8080/myapp`, and `logoutPath` must be prefixed with`/myapp`, otherwise the OIDC authentication 
+with `https://www.example.com:8443/myapp`, and `logoutPath` must be prefixed with`/myapp`, otherwise the OIDC authentication 
 will fail because the redirect and logout requests will not match the target HTTPRoute and therefore can't be processed 
 by the OAuth2 filter on that HTTPRoute.
 
@@ -143,7 +145,7 @@ spec:
     clientID: "${CLIENT_ID}"
     clientSecret:
       name: "my-app-client-secret"
-    redirectURL: "http://www.example.com:8080/myapp/oauth2/callback"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
     logoutPath: "/myapp/logout"
 EOF
 ```
@@ -169,7 +171,7 @@ spec:
     clientID: "${CLIENT_ID}"
     clientSecret:
       name: "my-app-client-secret"
-    redirectURL: "http://www.example.com:8080/myapp/oauth2/callback"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
     logoutPath: "/myapp/logout"
 ```
 
@@ -182,14 +184,14 @@ Verify the SecurityPolicy configuration:
 kubectl get securitypolicy/oidc-example -o yaml
 ```
 
-## Testing
+### Testing
 
 Port forward gateway port to localhost:
 
 ```shell
 export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
 
-kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8080:80
+kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8443:443
 ```
 
 Put www.example.com in the /etc/hosts file in your test machine, so we can use this host name to access the gateway from a browser:
@@ -199,9 +201,104 @@ Put www.example.com in the /etc/hosts file in your test machine, so we can use t
 127.0.0.1 www.example.com
 ```
 
-Open a browser and navigate to the `http://www.example.com:8080/myapp` address. You should be redirected to the Google 
+Open a browser and navigate to the `https://www.example.com:8443/myapp` address. You should be redirected to the Google 
+login page. After you successfully login, you should see the response from the backend service. 
+
+Clean the cookies in the browser and try to access `https://www.example.com:8443/foo` address. You should be able to see
+this page since the path `/foo` is not protected by the OIDC policy.
+
+## OIDC Authentication for a Gateway
+
+OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
+the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations.
+
+This section demonstrates how to configure OIDC authentication for a Gateway.
+
+### Register an OIDC application
+
+If you haven't registered an OIDC application, follow the steps in the previous section to register an OIDC application.
+
+### Create a kubernetes secret
+
+If you haven't created a kubernetes secret, follow the steps in the previous section to create a kubernetes secret.
+
+### Create a SecurityPolicy
+
+Create or update the SecurityPolicy to target the Gateway instead of the HTTPRoute. **Please notice that the `redirectURL` 
+and `logoutPath` must match one of the HTTPRoutes associated with the Gateway.** In this example, the target Gateway has 
+two HTTPRoutes associated with it, one with the host `www.example.com` and the path `/myapp`, and the other with the host
+`www.example.com` and the path `/`. Either one of the HTTPRoutes can be used to match the `redirectURL` and `logoutPath`.
+
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+EOF
+```
+
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
+
+Verify the SecurityPolicy configuration:
+
+```shell
+kubectl get securitypolicy/oidc-example -o yaml
+```
+
+### Testing
+
+If you haven't done so, follow the steps in the previous section to port forward gateway port to localhost and put
+www.example.com in the /etc/hosts file in your test machine.
+
+Open a browser and navigate to the `https://www.example.com:8443/foo` address. You should be redirected to the Google
 login page. After you successfully login, you should see the response from the backend service.
 
+You can also try to access `https://www.example.com:8443/myapp` address. You should be able to see this page since the
+path `/myapp` is protected by the same OIDC policy.
+
 ## Clean-Up
 
 Follow the steps from the [Quickstart](../../quickstart) to uninstall Envoy Gateway and the example manifest.
@@ -216,10 +313,10 @@ kubectl delete httproute/myapp
 
 ## Next Steps
 
-Checkout the [Developer Guide](../../../contributions/develop) to get involved in the project.
+Checkout the [Developer Guide](../../../../contributions/develop) to get involved in the project.
 
 [oidc]: https://openid.net/connect/
 [google-oidc]: https://developers.google.com/identity/protocols/oauth2/openid-connect
-[SecurityPolicy]: ../../../contributions/design/security-policy
+[SecurityPolicy]: ../../../../contributions/design/security-policy
 [Gateway]: https://gateway-api.sigs.k8s.io/api-types/gateway
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute
diff --git a/site/content/en/latest/tasks/security/secure-gateways.md b/site/content/en/latest/tasks/security/secure-gateways.md
index e57b12363..92f685705 100644
--- a/site/content/en/latest/tasks/security/secure-gateways.md
+++ b/site/content/en/latest/tasks/security/secure-gateways.md
@@ -297,7 +297,7 @@ Lastly, test connectivity using the above [Testing section](#testing).
 
 ## Clean-Up
 
-Follow the steps from the [Quickstart](../../quickstart) to uninstall Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../quickstart) to uninstall Envoy Gateway and the example manifest.
 
 Delete the Secrets:
 
@@ -423,7 +423,7 @@ This sections gives a walkthrough to generate multiple certificates correspondin
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway and the example manifest.
 Before proceeding, you should be able to query the example backend using HTTP.
 
 Follow the steps in the [TLS Certificates](#tls-certificates) section to generate self-signed RSA derived Server certificate and private key, and configure those in the Gateway listener configuration to terminate HTTPS traffic.
diff --git a/test/cel-validation/backendtrafficpolicy_test.go b/test/cel-validation/backendtrafficpolicy_test.go
index 64968c9e0..2cefef85e 100644
--- a/test/cel-validation/backendtrafficpolicy_test.go
+++ b/test/cel-validation/backendtrafficpolicy_test.go
@@ -810,7 +810,6 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 		{
 			desc: "valid count of Global rate limit rules items",
 			mutate: func(btp *egv1a1.BackendTrafficPolicy) {
-
 				rules := make([]egv1a1.RateLimitRule, 64)
 				rule := egv1a1.RateLimitRule{
 					Limit: egv1a1.RateLimitValue{
@@ -843,7 +842,6 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 		{
 			desc: "invalid count of Global rate limit rules items",
 			mutate: func(btp *egv1a1.BackendTrafficPolicy) {
-
 				rules := make([]egv1a1.RateLimitRule, 65)
 				rule := egv1a1.RateLimitRule{
 					Limit: egv1a1.RateLimitValue{
diff --git a/test/cel-validation/envoyextensionpolicy_test.go b/test/cel-validation/envoyextensionpolicy_test.go
index 67200306a..efad71d74 100644
--- a/test/cel-validation/envoyextensionpolicy_test.go
+++ b/test/cel-validation/envoyextensionpolicy_test.go
@@ -162,10 +162,12 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
 					ExtProc: []egv1a1.ExtProc{
 						{
-							BackendRef: egv1a1.ExtProcBackendRef{
-								BackendObjectReference: gwapiv1.BackendObjectReference{
-									Name: "grpc-proc-service",
-									Port: ptr.To(gwapiv1.PortNumber(80)),
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Name: "grpc-proc-service",
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
 								},
 							},
 						},
@@ -187,11 +189,13 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
 					ExtProc: []egv1a1.ExtProc{
 						{
-							BackendRef: egv1a1.ExtProcBackendRef{
-								BackendObjectReference: gwapiv1.BackendObjectReference{
-									Group: ptr.To(gwapiv1.Group("unsupported")),
-									Name:  "grpc-proc-service",
-									Port:  ptr.To(gwapiv1.PortNumber(80)),
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Group: ptr.To(gwapiv1.Group("unsupported")),
+										Name:  "grpc-proc-service",
+										Port:  ptr.To(gwapiv1.PortNumber(80)),
+									},
 								},
 							},
 						},
@@ -205,7 +209,7 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"spec.extProc[0]: Invalid value: \"object\": group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) is supported"},
+			wantErrors: []string{" spec.extProc[0].backendRefs: Invalid value: \"array\": BackendRefs only supports Core group."},
 		},
 		{
 			desc: "ExtProc with invalid BackendRef Kind",
@@ -213,11 +217,13 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
 					ExtProc: []egv1a1.ExtProc{
 						{
-							BackendRef: egv1a1.ExtProcBackendRef{
-								BackendObjectReference: gwapiv1.BackendObjectReference{
-									Kind: ptr.To(gwapiv1.Kind("unsupported")),
-									Name: "grpc-proc-service",
-									Port: ptr.To(gwapiv1.PortNumber(80)),
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Kind: ptr.To(gwapiv1.Kind("unsupported")),
+										Name: "grpc-proc-service",
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
 								},
 							},
 						},
@@ -231,7 +237,7 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"spec.extProc[0]: Invalid value: \"object\": kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported"},
+			wantErrors: []string{"spec.extProc[0].backendRefs: Invalid value: \"array\": BackendRefs only supports Service kind."},
 		},
 		{
 			desc: "ExtProc with invalid fields",
@@ -239,10 +245,12 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
 					ExtProc: []egv1a1.ExtProc{
 						{
-							BackendRef: egv1a1.ExtProcBackendRef{
-								BackendObjectReference: gwapiv1.BackendObjectReference{
-									Name: "grpc-proc-service",
-									Port: ptr.To(gwapiv1.PortNumber(80)),
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Name: "grpc-proc-service",
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
 								},
 							},
 							ProcessingMode: &egv1a1.ExtProcProcessingMode{
diff --git a/test/conformance/conformance_test.go b/test/conformance/conformance_test.go
index 149909e2c..7eca6ea9d 100644
--- a/test/conformance/conformance_test.go
+++ b/test/conformance/conformance_test.go
@@ -54,5 +54,4 @@ func TestGatewayAPIConformance(t *testing.T) {
 	})
 	cSuite.Setup(t)
 	cSuite.Run(t, tests.ConformanceTests)
-
 }
diff --git a/test/conformance/experimental_conformance_test.go b/test/conformance/experimental_conformance_test.go
index b6d6b19e9..fa3598be1 100644
--- a/test/conformance/experimental_conformance_test.go
+++ b/test/conformance/experimental_conformance_test.go
@@ -129,7 +129,7 @@ func experimentalConformanceReport(logf func(string, ...any), report confv1a1.Co
 	}
 
 	if output != "" {
-		if err = os.WriteFile(output, rawReport, 0600); err != nil {
+		if err = os.WriteFile(output, rawReport, 0o600); err != nil {
 			return err
 		}
 	}
diff --git a/test/e2e/e2e_test.go b/test/e2e/e2e_test.go
index 46e0fb30b..3159f0bd2 100644
--- a/test/e2e/e2e_test.go
+++ b/test/e2e/e2e_test.go
@@ -51,6 +51,9 @@ func TestE2E(t *testing.T) {
 		CleanupBaseResources: *flags.CleanupBaseResources,
 		FS:                   &Manifests,
 		RunTest:              *flags.RunTest,
+		SkipTests: []string{
+			tests.ClientTimeoutTest.ShortName, // https://github.com/envoyproxy/gateway/issues/2720
+		},
 	})
 
 	cSuite.Setup(t)
diff --git a/test/e2e/merge_gateways/merge_gateways_test.go b/test/e2e/merge_gateways/merge_gateways_test.go
index 30e82aa6c..9c056875c 100644
--- a/test/e2e/merge_gateways/merge_gateways_test.go
+++ b/test/e2e/merge_gateways/merge_gateways_test.go
@@ -52,14 +52,16 @@ func TestMergeGateways(t *testing.T) {
 		Debug:                *flags.ShowDebug,
 		CleanupBaseResources: *flags.CleanupBaseResources,
 		RunTest:              *flags.RunTest,
+		SkipTests: []string{
+			tests.MergeGatewaysTest.ShortName, // https://github.com/envoyproxy/gateway/issues/3290
+		},
 	})
 
 	// Setting up the necessary arguments for the suite instead of calling Suite.Setup method again,
 	// since this test suite reuse the base resources of previous test suite.
 	cSuite.Applier.FS = e2e.Manifests
 	cSuite.Applier.GatewayClass = *flags.GatewayClassName
-	cSuite.ControllerName = kubernetes.GWCMustHaveAcceptedConditionTrue(t,
-		cSuite.Client, cSuite.TimeoutConfig, cSuite.GatewayClassName)
+	cSuite.ControllerName = kubernetes.GWCMustHaveAcceptedConditionTrue(t, cSuite.Client, cSuite.TimeoutConfig, cSuite.GatewayClassName)
 
 	t.Logf("Running %d MergeGateways tests", len(tests.MergeGatewaysTests))
 	cSuite.Run(t, tests.MergeGatewaysTests)
diff --git a/test/e2e/testdata/ext-proc-envoyextensionpolicy.yaml b/test/e2e/testdata/ext-proc-envoyextensionpolicy.yaml
index 5119ac22c..e88657fee 100644
--- a/test/e2e/testdata/ext-proc-envoyextensionpolicy.yaml
+++ b/test/e2e/testdata/ext-proc-envoyextensionpolicy.yaml
@@ -20,7 +20,7 @@ spec:
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: http-without-ext-proc
+  name: http-without-procmode
   namespace: gateway-conformance-infra
 spec:
   parentRefs:
@@ -46,8 +46,27 @@ spec:
     kind: HTTPRoute
     name: http-with-ext-proc
   extProc:
-  - backendRef:
-      name: grpc-ext-proc
+  - backendRefs:
+    - name: grpc-ext-proc
+      namespace: gateway-conformance-infra
+      port: 9002
+    processingMode:
+      request: {}
+      response: {}
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyExtensionPolicy
+metadata:
+  name: ext-proc-no-procmode-test
+  namespace: gateway-conformance-infra
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: http-without-procmode
+  extProc:
+  - backendRefs:
+    - name: grpc-ext-proc
       namespace: gateway-conformance-infra
       port: 9002
 ---
diff --git a/test/e2e/testdata/ext-proc-service.yaml b/test/e2e/testdata/ext-proc-service.yaml
index 594cf14ed..665779e96 100644
--- a/test/e2e/testdata/ext-proc-service.yaml
+++ b/test/e2e/testdata/ext-proc-service.yaml
@@ -8,74 +8,73 @@ data:
   go.mod: |
     module github.com/envoyproxy/gateway
 
-    go 1.21
+    go 1.22
 
     require (
-    	github.com/envoyproxy/go-control-plane v0.12.0
+    	github.com/envoyproxy/go-control-plane v0.12.1-0.20240322155512-db0b36a50fa8
     	google.golang.org/grpc v1.62.1
     )
 
     require (
-    	github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa // indirect
-    	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
-    	github.com/golang/protobuf v1.5.3 // indirect
-    	golang.org/x/net v0.20.0 // indirect
-    	golang.org/x/sys v0.16.0 // indirect
-    	golang.org/x/text v0.14.0 // indirect
-    	google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 // indirect
-    	google.golang.org/protobuf v1.32.0 // indirect
+        github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa // indirect
+        github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
+        github.com/golang/protobuf v1.5.4 // indirect
+        github.com/planetscale/vtprotobuf v0.5.1-0.20231212170721-e7d721933795 // indirect
+        golang.org/x/net v0.20.0 // indirect
+        golang.org/x/sys v0.16.0 // indirect
+        golang.org/x/text v0.14.0 // indirect
+        google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 // indirect
+        google.golang.org/protobuf v1.33.0 // indirect
     )
   go.sum: |
     github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=
     github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
-    github.com/envoyproxy/go-control-plane v0.12.0 h1:4X+VP1GHd1Mhj6IB5mMeGbLCleqxjletLK6K0rbxyZI=
-    github.com/envoyproxy/go-control-plane v0.12.0/go.mod h1:ZBTaoJ23lqITozF0M6G4/IragXCQKCnYbmlmtHvwRG0=
+    github.com/envoyproxy/go-control-plane v0.12.1-0.20240322155512-db0b36a50fa8 h1:Zghtu+wdlGvrmutCyhU9Ew5ozU18PVpxP+zGSgyUpFs=
+    github.com/envoyproxy/go-control-plane v0.12.1-0.20240322155512-db0b36a50fa8/go.mod h1:YtsM9q/kVkKyvmemY+BF/ZK7I93OWsx4uk4Do2Mr/OA=
     github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
     github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
-    github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-    github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-    github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-    github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+    github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+    github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
     github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
     github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+    github.com/planetscale/vtprotobuf v0.5.1-0.20231212170721-e7d721933795 h1:pH+U6pJP0BhxqQ4njBUjOg0++WMMvv3eByWzB+oATBY=
+    github.com/planetscale/vtprotobuf v0.5.1-0.20231212170721-e7d721933795/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
     golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
     golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
     golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
     golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
     golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
     golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-    golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
     google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 h1:AjyfHzEPEFp/NpvfN5g+KDla3EMojjhRVZc1i7cj+oM=
     google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
     google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=
     google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
-    google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-    google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-    google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
-    google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+    google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+    google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
   main.go: |
     package main
 
     import (
-        "context"
-        "crypto/tls"
-        "crypto/x509"
-        "flag"
-        "fmt"
-        "google.golang.org/grpc/credentials"
-        "io"
-        "log"
-        "net"
-        "net/http"
-        "os"
-        "strings"
-
-        envoy_api_v3_core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
-        envoy_service_proc_v3 "github.com/envoyproxy/go-control-plane/envoy/service/ext_proc/v3"
-
-        "google.golang.org/grpc"
-        "google.golang.org/grpc/codes"
-        "google.golang.org/grpc/status"
+    	"context"
+    	"crypto/tls"
+    	"crypto/x509"
+    	"flag"
+    	"fmt"
+    	"io"
+    	"log"
+    	"net"
+    	"net/http"
+    	"os"
+    	"strings"
+
+    	"google.golang.org/grpc/credentials"
+
+    	envoy_api_v3_core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+    	envoy_service_proc_v3 "github.com/envoyproxy/go-control-plane/envoy/service/ext_proc/v3"
+
+    	"google.golang.org/grpc"
+    	"google.golang.org/grpc/codes"
+    	"google.golang.org/grpc/status"
     )
 
     type extProcServer struct{}
@@ -103,7 +102,6 @@ data:
 
     	envoy_service_proc_v3.RegisterExternalProcessorServer(gs, &extProcServer{})
 
-
     	go func() {
     		err = gs.Serve(lis)
     		if err != nil {
@@ -227,13 +225,23 @@ data:
     		resp := &envoy_service_proc_v3.ProcessingResponse{}
     		switch v := req.Request.(type) {
     		case *envoy_service_proc_v3.ProcessingRequest_RequestHeaders:
+    			xrch := ""
+    			if v.RequestHeaders != nil {
+    				hdrs := v.RequestHeaders.Headers.GetHeaders()
+    				for _, hdr := range hdrs {
+    					if hdr.Key == "x-request-client-header" {
+    						xrch = string(hdr.RawValue)
+    					}
+    				}
+    			}
+
     			rhq := &envoy_service_proc_v3.HeadersResponse{
     				Response: &envoy_service_proc_v3.CommonResponse{
     					HeaderMutation: &envoy_service_proc_v3.HeaderMutation{
     						SetHeaders: []*envoy_api_v3_core.HeaderValueOption{
     							{
     								Header: &envoy_api_v3_core.HeaderValue{
-    									Key: "x-request-ext-processed",
+    									Key:      "x-request-ext-processed",
     									RawValue: []byte("true"),
     								},
     							},
@@ -242,6 +250,23 @@ data:
     				},
     			}
 
+    			if xrch != "" {
+    				rhq.Response.HeaderMutation.SetHeaders = append(rhq.Response.HeaderMutation.SetHeaders,
+    					&envoy_api_v3_core.HeaderValueOption{
+    						Header: &envoy_api_v3_core.HeaderValue{
+    							Key:      "x-request-client-header",
+    							RawValue: []byte("mutated"),
+    						},
+    					})
+    				rhq.Response.HeaderMutation.SetHeaders = append(rhq.Response.HeaderMutation.SetHeaders,
+    					&envoy_api_v3_core.HeaderValueOption{
+    						Header: &envoy_api_v3_core.HeaderValue{
+    							Key:      "x-request-client-header-received",
+    							RawValue: []byte(xrch),
+    						},
+    					})
+    			}
+
     			resp = &envoy_service_proc_v3.ProcessingResponse{
     				Response: &envoy_service_proc_v3.ProcessingResponse_RequestHeaders{
     					RequestHeaders: rhq,
@@ -255,7 +280,7 @@ data:
     						SetHeaders: []*envoy_api_v3_core.HeaderValueOption{
     							{
     								Header: &envoy_api_v3_core.HeaderValue{
-    									Key: "x-response-ext-processed",
+    									Key:      "x-response-ext-processed",
     									RawValue: []byte("true"),
     								},
     							},
@@ -352,7 +377,7 @@ spec:
             - sh
             - "-c"
             - "cp -a /app /app-live && cd /app-live && go  run . --certPath=/app-live/certs/ "
-          image: golang:1.21.3-alpine
+          image: golang:1.22.1-alpine
           ports:
             - containerPort: 8000
           volumeMounts:
diff --git a/test/e2e/tests/backend_tls.go b/test/e2e/tests/backend_tls.go
index 1c556a0bb..dea222b47 100644
--- a/test/e2e/tests/backend_tls.go
+++ b/test/e2e/tests/backend_tls.go
@@ -63,6 +63,5 @@ var BackendTLSTest = suite.ConformanceTest{
 
 			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
 		})
-
 	},
 }
diff --git a/test/e2e/tests/connection_limit.go b/test/e2e/tests/connection_limit.go
index 220be1a56..62f8f0011 100644
--- a/test/e2e/tests/connection_limit.go
+++ b/test/e2e/tests/connection_limit.go
@@ -82,7 +82,6 @@ var ConnectionLimitTest = suite.ConformanceTest{
 			} else {
 				t.Errorf("expected error when connection limit is reached")
 			}
-
 		})
 	},
 }
diff --git a/test/e2e/tests/ext_proc.go b/test/e2e/tests/ext_proc.go
index aa9978e92..eb069380b 100644
--- a/test/e2e/tests/ext_proc.go
+++ b/test/e2e/tests/ext_proc.go
@@ -26,10 +26,10 @@ func init() {
 	ConformanceTests = append(ConformanceTests, ExtProcTest)
 }
 
-// ExtProcTest tests ExtProcs authentication for an http route with ExtProcs configured.
+// ExtProcTest tests ExtProc authentication for an http route with ExtProc configured.
 var ExtProcTest = suite.ConformanceTest{
-	ShortName:   "ExtProcs",
-	Description: "Test ExtProcs service that adds request and response headers",
+	ShortName:   "ExtProc",
+	Description: "Test ExtProc service that adds request and response headers",
 	Manifests:   []string{"testdata/ext-proc-service.yaml", "testdata/ext-proc-envoyextensionpolicy.yaml"},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
 		t.Run("http route with ext proc", func(t *testing.T) {
@@ -56,19 +56,25 @@ var ExtProcTest = suite.ConformanceTest{
 					Host: "www.example.com",
 					Path: "/processor",
 					Headers: map[string]string{
-						"x-request-ext-processed": "true", // header added by ext-processor to request
+						"x-request-ext-processed":          "true",     // header added by ext-processor to backend-bound request
+						"x-request-client-header-received": "original", // this is the original client header preserved by ext-proc in a new header
+						"x-request-client-header":          "mutated",  // this is the mutated value expected to reach upstream
 					},
 				},
 				Response: http.Response{
 					StatusCode: 200,
 					Headers: map[string]string{
-						"x-response-ext-processed": "true", // header added by ext-processor to request
+						"x-response-ext-processed": "true", // header added by ext-processor to client-bound response
 					},
 				},
 				Namespace: ns,
 			}
 
 			req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
+
+			// add a request header that will be mutated by ext-proc
+			req.Headers["x-request-client-header"] = []string{"original"}
+
 			cReq, cResp, err := suite.RoundTripper.CaptureRoundTrip(req)
 			if err != nil {
 				t.Errorf("failed to get expected response: %v", err)
@@ -79,9 +85,9 @@ var ExtProcTest = suite.ConformanceTest{
 			}
 		})
 
-		t.Run("http route without ext proc", func(t *testing.T) {
+		t.Run("http route without proc mode", func(t *testing.T) {
 			ns := "gateway-conformance-infra"
-			routeNN := types.NamespacedName{Name: "http-with-ext-proc", Namespace: ns}
+			routeNN := types.NamespacedName{Name: "http-without-procmode", Namespace: ns}
 			gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
 			gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
 
@@ -91,7 +97,7 @@ var ExtProcTest = suite.ConformanceTest{
 				Namespace: gatewayapi.NamespacePtr(gwNN.Namespace),
 				Name:      gwv1.ObjectName(gwNN.Name),
 			}
-			EnvoyExtensionPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "ext-proc-test", Namespace: ns}, suite.ControllerName, ancestorRef)
+			EnvoyExtensionPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "ext-proc-no-procmode-test", Namespace: ns}, suite.ControllerName, ancestorRef)
 
 			podReady := corev1.PodCondition{Type: corev1.PodReady, Status: corev1.ConditionTrue}
 
@@ -102,6 +108,9 @@ var ExtProcTest = suite.ConformanceTest{
 				Request: http.Request{
 					Host: "www.example.com",
 					Path: "/no-processor",
+					Headers: map[string]string{
+						"x-request-client-header": "original",
+					},
 				},
 				Response: http.Response{
 					StatusCode:    200,
@@ -111,6 +120,10 @@ var ExtProcTest = suite.ConformanceTest{
 			}
 
 			req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
+
+			// add a request header that will be mutated by ext-proc if the request headers are sent
+			req.Headers["x-request-client-header"] = []string{"original"}
+
 			cReq, cResp, err := suite.RoundTripper.CaptureRoundTrip(req)
 			if err != nil {
 				t.Errorf("failed to get expected response: %v", err)
diff --git a/test/e2e/tests/gateway_infra_resource.go b/test/e2e/tests/gateway_infra_resource.go
index 864cc4b1b..c14cb1450 100644
--- a/test/e2e/tests/gateway_infra_resource.go
+++ b/test/e2e/tests/gateway_infra_resource.go
@@ -25,7 +25,7 @@ import (
 
 func init() {
 	// nolint
-	//ConformanceTests = append(ConformanceTests, GatewayInfraResourceTest)
+	// ConformanceTests = append(ConformanceTests, GatewayInfraResourceTest)
 }
 
 // nolint
diff --git a/test/e2e/tests/jwt.go b/test/e2e/tests/jwt.go
index 73de072e6..fc7e826dd 100644
--- a/test/e2e/tests/jwt.go
+++ b/test/e2e/tests/jwt.go
@@ -170,6 +170,5 @@ var OptionalJWTTest = suite.ConformanceTest{
 				http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, tc)
 			})
 		}
-
 	},
 }
diff --git a/test/e2e/tests/merge_gateways.go b/test/e2e/tests/merge_gateways.go
index 9b725cb40..abcd809f7 100644
--- a/test/e2e/tests/merge_gateways.go
+++ b/test/e2e/tests/merge_gateways.go
@@ -146,6 +146,5 @@ var MergeGatewaysTest = suite.ConformanceTest{
 				Namespace: ns,
 			})
 		})
-
 	},
 }
diff --git a/test/e2e/tests/preservecase.go b/test/e2e/tests/preservecase.go
index 59d54c2f8..458bebd82 100644
--- a/test/e2e/tests/preservecase.go
+++ b/test/e2e/tests/preservecase.go
@@ -135,6 +135,5 @@ var PreserveCaseTest = suite.ConformanceTest{
 				t.Errorf("case was not preserved for test header: %+v", respBody)
 			}
 		})
-
 	},
 }
diff --git a/test/e2e/tests/ratelimit.go b/test/e2e/tests/ratelimit.go
index c02802abe..0115dbe00 100644
--- a/test/e2e/tests/ratelimit.go
+++ b/test/e2e/tests/ratelimit.go
@@ -284,7 +284,6 @@ var RateLimitBasedJwtClaimsTest = suite.ConformanceTest{
 			if err := GotExactExpectedResponse(t, 1, suite.RoundTripper, noTokenReq, noTokenResp); err != nil {
 				t.Errorf("failed to get expected response: %v", err)
 			}
-
 		})
 	},
 }
diff --git a/test/e2e/tests/redirect_replaceprefixmatch_slash.go b/test/e2e/tests/redirect_replaceprefixmatch_slash.go
index 3dcc4e908..c19868090 100644
--- a/test/e2e/tests/redirect_replaceprefixmatch_slash.go
+++ b/test/e2e/tests/redirect_replaceprefixmatch_slash.go
@@ -19,7 +19,6 @@ import (
 
 func init() {
 	ConformanceTests = append(ConformanceTests, RedirectTrailingSlashTest)
-
 }
 
 // RedirectTrailingSlashTest tests that only one slash in the redirect URL
diff --git a/test/e2e/tests/retry.go b/test/e2e/tests/retry.go
index c2acfecf3..c067df375 100644
--- a/test/e2e/tests/retry.go
+++ b/test/e2e/tests/retry.go
@@ -24,7 +24,6 @@ import (
 
 func init() {
 	ConformanceTests = append(ConformanceTests, RetryTest)
-
 }
 
 var RetryTest = suite.ConformanceTest{
diff --git a/test/e2e/tests/tcp_route.go b/test/e2e/tests/tcp_route.go
index 0aa8b609e..f09521db0 100644
--- a/test/e2e/tests/tcp_route.go
+++ b/test/e2e/tests/tcp_route.go
@@ -77,7 +77,6 @@ var TCPRouteTest = suite.ConformanceTest{
 			// Send a request to an valid path and expect a successful response
 			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, OkResp)
 		})
-
 	},
 }
 
@@ -124,7 +123,6 @@ func GatewayAndTCPRoutesMustBeAccepted(t *testing.T, c client.Client, timeoutCon
 	}
 
 	return gwAddr
-
 }
 
 // WaitForGatewayAddress waits until at least one IP Address has been set in the
diff --git a/test/e2e/tests/tracing.go b/test/e2e/tests/tracing.go
index 880b166b4..9ded2662c 100644
--- a/test/e2e/tests/tracing.go
+++ b/test/e2e/tests/tracing.go
@@ -119,7 +119,6 @@ func QueryTraceFromTempo(t *testing.T, c client.Client, tags map[string]string)
 
 	req, err := http.NewRequest("GET", tempoURL.String(), nil)
 	if err != nil {
-
 		return -1, err
 	}
 
diff --git a/test/e2e/tests/weighted_backend.go b/test/e2e/tests/weighted_backend.go
index b31dce8f0..250c6ef4c 100644
--- a/test/e2e/tests/weighted_backend.go
+++ b/test/e2e/tests/weighted_backend.go
@@ -70,7 +70,6 @@ var WeightEqualTest = suite.ConformanceTest{
 				if len(podName) == 0 {
 					// it shouldn't be missing here
 					t.Errorf("failed to get pod header in response: %v", err)
-
 				} else {
 					// all we need is the pod Name prefix
 					podNamePrefix := ExtractPodNamePrefix(podName)
@@ -135,7 +134,6 @@ var WeightBlueGreenTest = suite.ConformanceTest{
 				if len(podName) == 0 {
 					// it shouldn't be missing here
 					t.Errorf("failed to get pod header in response: %v", err)
-
 				} else {
 					// all we need is the pod Name prefix
 					podNamePrefix := ExtractPodNamePrefix(podName)
@@ -200,7 +198,6 @@ var WeightCompleteRolloutTest = suite.ConformanceTest{
 				if len(podName) == 0 {
 					// it shouldn't be missing here
 					t.Errorf("failed to get pod header in response: %v", err)
-
 				} else {
 					// all we need is the pod Name prefix
 					podNamePrefix := ExtractPodNamePrefix(podName)
@@ -222,7 +219,6 @@ var WeightCompleteRolloutTest = suite.ConformanceTest{
 
 // ExtractPodNamePrefix Extract the Pod Name prefix
 func ExtractPodNamePrefix(podName string) string {
-
 	pattern := regexp.MustCompile(`infra-backend-(.+?)-`)
 	match := pattern.FindStringSubmatch(podName)
 	if len(match) > 1 {
diff --git a/test/e2e/upgrade/eg_upgrade_test.go b/test/e2e/upgrade/eg_upgrade_test.go
index a1be622cb..6ad83b14b 100644
--- a/test/e2e/upgrade/eg_upgrade_test.go
+++ b/test/e2e/upgrade/eg_upgrade_test.go
@@ -52,6 +52,9 @@ func TestEGUpgrade(t *testing.T) {
 		CleanupBaseResources: *flags.CleanupBaseResources,
 		FS:                   &e2e.Manifests,
 		RunTest:              *flags.RunTest,
+		SkipTests: []string{
+			tests.EnvoyShutdownTest.ShortName, // https://github.com/envoyproxy/gateway/issues/3262
+		},
 	})
 
 	cSuite.Setup(t)