Repository: envoyproxy/gateway
Pull request #4201 (2024-09-10 05:48:12)

bump ENVTEST_K8S_VERSION
follow up: https://github.com/envoyproxy/gateway/pull/4169

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/envoyproxy/gateway/pull/4201?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 67.96%. Comparing base [(`61dcc64`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/61dcc6472e964d9d7781a2d130c172dc00136a95?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) to head [(`73beebe`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/73beebe3d1e2eace3c1ad4606974ba7b8b7f4555?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #4201      +/-   ##
==========================================
- Coverage   68.00%   67.96%   -0.04%     
==========================================
  Files         190      190              
  Lines       23116    23116              
==========================================
- Hits        15720    15711       -9     
- Misses       6277     6285       +8     
- Partials     1119     1120       +1     
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/envoyproxy/gateway/pull/4201?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).


Patch:
diff --git a/api/v1alpha1/backendtrafficpolicy_types.go b/api/v1alpha1/backendtrafficpolicy_types.go
index 9d15ccd68..70a400015 100644
--- a/api/v1alpha1/backendtrafficpolicy_types.go
+++ b/api/v1alpha1/backendtrafficpolicy_types.go
@@ -57,11 +57,6 @@ type BackendTrafficPolicySpec struct {
 	// +optional
 	FaultInjection *FaultInjection `json:"faultInjection,omitempty"`
 
-	// Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
-	// If not set, retry will be disabled.
-	// +optional
-	Retry *Retry `json:"retry,omitempty"`
-
 	// UseClientProtocol configures Envoy to prefer sending requests to backends using
 	// the same HTTP protocol that the incoming request used. Defaults to false, which means
 	// that Envoy will use the protocol indicated by the attached BackendRef.
@@ -85,56 +80,6 @@ type BackendTrafficPolicyList struct {
 	Items           []BackendTrafficPolicy `json:"items"`
 }
 
-// ClusterSettings provides the various knobs that can be set to control how traffic to a given
-// backend will be configured.
-type ClusterSettings struct {
-	// LoadBalancer policy to apply when routing traffic from the gateway to
-	// the backend endpoints. Defaults to `LeastRequest`.
-	// +optional
-	LoadBalancer *LoadBalancer `json:"loadBalancer,omitempty"`
-
-	// ProxyProtocol enables the Proxy Protocol when communicating with the backend.
-	// +optional
-	ProxyProtocol *ProxyProtocol `json:"proxyProtocol,omitempty"`
-
-	// TcpKeepalive settings associated with the upstream client connection.
-	// Disabled by default.
-	//
-	// +optional
-	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty"`
-
-	// HealthCheck allows gateway to perform active health checking on backends.
-	//
-	// +optional
-	HealthCheck *HealthCheck `json:"healthCheck,omitempty"`
-
-	// Circuit Breaker settings for the upstream connections and requests.
-	// If not set, circuit breakers will be enabled with the default thresholds
-	//
-	// +optional
-	CircuitBreaker *CircuitBreaker `json:"circuitBreaker,omitempty"`
-
-	// Timeout settings for the backend connections.
-	//
-	// +optional
-	Timeout *Timeout `json:"timeout,omitempty"`
-
-	// Connection includes backend connection settings.
-	//
-	// +optional
-	Connection *BackendConnection `json:"connection,omitempty"`
-
-	// DNS includes dns resolution settings.
-	//
-	// +optional
-	DNS *DNS `json:"dns,omitempty"`
-
-	// HTTP2 provides HTTP/2 configuration for backend connections.
-	//
-	// +optional
-	HTTP2 *HTTP2Settings `json:"http2,omitempty"`
-}
-
 func init() {
 	SchemeBuilder.Register(&BackendTrafficPolicy{}, &BackendTrafficPolicyList{})
 }
diff --git a/api/v1alpha1/oidc_types.go b/api/v1alpha1/oidc_types.go
index 8951fbe63..73e1dea8c 100644
--- a/api/v1alpha1/oidc_types.go
+++ b/api/v1alpha1/oidc_types.go
@@ -106,7 +106,21 @@ type OIDC struct {
 }
 
 // OIDCProvider defines the OIDC Provider configuration.
+// +kubebuilder:validation:XValidation:rule="!has(self.backendRef)",message="BackendRefs must be used, backendRef is not supported."
+// +kubebuilder:validation:XValidation:rule="has(self.backendRefs)? self.backendRefs.size() > 1 : true",message="Only one backendRefs is allowed."
 type OIDCProvider struct {
+	// BackendRefs is used to specify the address of the OIDC Provider.
+	// If the BackendRefs is not specified, The host and port of the OIDC Provider's token endpoint
+	// will be used as the address of the OIDC Provider.
+	//
+	// TLS configuration can be specified in a BackendTLSConfig resource and target the BackendRefs.
+	//
+	// Other settings for the connection to the OIDC Provider can be specified in the BackendSettings resource.
+	//
+	// +optional
+	// +notImplementedHide
+	BackendCluster `json:",inline"`
+
 	// The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).
 	// Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST
 	// be https, a host component, and optionally, port and path components and
diff --git a/api/v1alpha1/shared_types.go b/api/v1alpha1/shared_types.go
index adfddff13..c74504a61 100644
--- a/api/v1alpha1/shared_types.go
+++ b/api/v1alpha1/shared_types.go
@@ -511,6 +511,61 @@ type BackendCluster struct {
 	BackendSettings *ClusterSettings `json:"backendSettings,omitempty"`
 }
 
+// ClusterSettings provides the various knobs that can be set to control how traffic to a given
+// backend will be configured.
+type ClusterSettings struct {
+	// LoadBalancer policy to apply when routing traffic from the gateway to
+	// the backend endpoints. Defaults to `LeastRequest`.
+	// +optional
+	LoadBalancer *LoadBalancer `json:"loadBalancer,omitempty"`
+
+	// Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+	// If not set, retry will be disabled.
+	// +optional
+	Retry *Retry `json:"retry,omitempty"`
+
+	// ProxyProtocol enables the Proxy Protocol when communicating with the backend.
+	// +optional
+	ProxyProtocol *ProxyProtocol `json:"proxyProtocol,omitempty"`
+
+	// TcpKeepalive settings associated with the upstream client connection.
+	// Disabled by default.
+	//
+	// +optional
+	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty"`
+
+	// HealthCheck allows gateway to perform active health checking on backends.
+	//
+	// +optional
+	HealthCheck *HealthCheck `json:"healthCheck,omitempty"`
+
+	// Circuit Breaker settings for the upstream connections and requests.
+	// If not set, circuit breakers will be enabled with the default thresholds
+	//
+	// +optional
+	CircuitBreaker *CircuitBreaker `json:"circuitBreaker,omitempty"`
+
+	// Timeout settings for the backend connections.
+	//
+	// +optional
+	Timeout *Timeout `json:"timeout,omitempty"`
+
+	// Connection includes backend connection settings.
+	//
+	// +optional
+	Connection *BackendConnection `json:"connection,omitempty"`
+
+	// DNS includes dns resolution settings.
+	//
+	// +optional
+	DNS *DNS `json:"dns,omitempty"`
+
+	// HTTP2 provides HTTP/2 configuration for backend connections.
+	//
+	// +optional
+	HTTP2 *HTTP2Settings `json:"http2,omitempty"`
+}
+
 // CIDR defines a CIDR Address range.
 // A CIDR can be an IPv4 address range such as "192.168.1.0/24" or an IPv6 address range such as "2001:0db8:11a3:09d7::/64".
 // +kubebuilder:validation:Pattern=`((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/([0-9]+))|((([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/([0-9]+))`
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index f2e3ce240..56b3332f2 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -540,11 +540,6 @@ func (in *BackendTrafficPolicySpec) DeepCopyInto(out *BackendTrafficPolicySpec)
 		*out = new(FaultInjection)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.Retry != nil {
-		in, out := &in.Retry, &out.Retry
-		*out = new(Retry)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.UseClientProtocol != nil {
 		in, out := &in.UseClientProtocol, &out.UseClientProtocol
 		*out = new(bool)
@@ -955,6 +950,11 @@ func (in *ClusterSettings) DeepCopyInto(out *ClusterSettings) {
 		*out = new(LoadBalancer)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Retry != nil {
+		in, out := &in.Retry, &out.Retry
+		*out = new(Retry)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.ProxyProtocol != nil {
 		in, out := &in.ProxyProtocol, &out.ProxyProtocol
 		*out = new(ProxyProtocol)
@@ -3613,6 +3613,7 @@ func (in *OIDCCookieNames) DeepCopy() *OIDCCookieNames {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCProvider) DeepCopyInto(out *OIDCProvider) {
 	*out = *in
+	in.BackendCluster.DeepCopyInto(&out.BackendCluster)
 	if in.AuthorizationEndpoint != nil {
 		in, out := &in.AuthorizationEndpoint, &out.AuthorizationEndpoint
 		*out = new(string)
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 92a538cf4..867b8933c 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -753,6 +753,86 @@ spec:
                           required:
                           - version
                           type: object
+                        retry:
+                          description: |-
+                            Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                            If not set, retry will be disabled.
+                          properties:
+                            numRetries:
+                              default: 2
+                              description: NumRetries is the number of retries to
+                                be attempted. Defaults to 2.
+                              format: int32
+                              minimum: 0
+                              type: integer
+                            perRetry:
+                              description: PerRetry is the retry policy to be applied
+                                per retry attempt.
+                              properties:
+                                backOff:
+                                  description: |-
+                                    Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                    back-off algorithm for retries. For additional details,
+                                    see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                  properties:
+                                    baseInterval:
+                                      description: BaseInterval is the base interval
+                                        between retries.
+                                      format: duration
+                                      type: string
+                                    maxInterval:
+                                      description: |-
+                                        MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                        The default is 10 times the base_interval
+                                      format: duration
+                                      type: string
+                                  type: object
+                                timeout:
+                                  description: Timeout is the timeout per retry attempt.
+                                  format: duration
+                                  type: string
+                              type: object
+                            retryOn:
+                              description: |-
+                                RetryOn specifies the retry trigger condition.
+
+                                If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                              properties:
+                                httpStatusCodes:
+                                  description: |-
+                                    HttpStatusCodes specifies the http status codes to be retried.
+                                    The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                  items:
+                                    description: HTTPStatus defines the http status
+                                      code.
+                                    exclusiveMaximum: true
+                                    maximum: 600
+                                    minimum: 100
+                                    type: integer
+                                  type: array
+                                triggers:
+                                  description: Triggers specifies the retry trigger
+                                    condition(Http/Grpc).
+                                  items:
+                                    description: TriggerEnum specifies the conditions
+                                      that trigger retries.
+                                    enum:
+                                    - 5xx
+                                    - gateway-error
+                                    - reset
+                                    - connect-failure
+                                    - retriable-4xx
+                                    - refused-stream
+                                    - retriable-status-codes
+                                    - cancelled
+                                    - deadline-exceeded
+                                    - internal
+                                    - resource-exhausted
+                                    - unavailable
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
                         tcpKeepalive:
                           description: |-
                             TcpKeepalive settings associated with the upstream client connection.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 6baf2056e..c227b546c 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -11076,6 +11076,90 @@ spec:
                                             required:
                                             - version
                                             type: object
+                                          retry:
+                                            description: |-
+                                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                                              If not set, retry will be disabled.
+                                            properties:
+                                              numRetries:
+                                                default: 2
+                                                description: NumRetries is the number
+                                                  of retries to be attempted. Defaults
+                                                  to 2.
+                                                format: int32
+                                                minimum: 0
+                                                type: integer
+                                              perRetry:
+                                                description: PerRetry is the retry
+                                                  policy to be applied per retry attempt.
+                                                properties:
+                                                  backOff:
+                                                    description: |-
+                                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                                      back-off algorithm for retries. For additional details,
+                                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                                    properties:
+                                                      baseInterval:
+                                                        description: BaseInterval
+                                                          is the base interval between
+                                                          retries.
+                                                        format: duration
+                                                        type: string
+                                                      maxInterval:
+                                                        description: |-
+                                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                                          The default is 10 times the base_interval
+                                                        format: duration
+                                                        type: string
+                                                    type: object
+                                                  timeout:
+                                                    description: Timeout is the timeout
+                                                      per retry attempt.
+                                                    format: duration
+                                                    type: string
+                                                type: object
+                                              retryOn:
+                                                description: |-
+                                                  RetryOn specifies the retry trigger condition.
+
+                                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                                properties:
+                                                  httpStatusCodes:
+                                                    description: |-
+                                                      HttpStatusCodes specifies the http status codes to be retried.
+                                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                                    items:
+                                                      description: HTTPStatus defines
+                                                        the http status code.
+                                                      exclusiveMaximum: true
+                                                      maximum: 600
+                                                      minimum: 100
+                                                      type: integer
+                                                    type: array
+                                                  triggers:
+                                                    description: Triggers specifies
+                                                      the retry trigger condition(Http/Grpc).
+                                                    items:
+                                                      description: TriggerEnum specifies
+                                                        the conditions that trigger
+                                                        retries.
+                                                      enum:
+                                                      - 5xx
+                                                      - gateway-error
+                                                      - reset
+                                                      - connect-failure
+                                                      - retriable-4xx
+                                                      - refused-stream
+                                                      - retriable-status-codes
+                                                      - cancelled
+                                                      - deadline-exceeded
+                                                      - internal
+                                                      - resource-exhausted
+                                                      - unavailable
+                                                      type: string
+                                                    type: array
+                                                type: object
+                                            type: object
                                           tcpKeepalive:
                                             description: |-
                                               TcpKeepalive settings associated with the upstream client connection.
@@ -11962,6 +12046,90 @@ spec:
                                             required:
                                             - version
                                             type: object
+                                          retry:
+                                            description: |-
+                                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                                              If not set, retry will be disabled.
+                                            properties:
+                                              numRetries:
+                                                default: 2
+                                                description: NumRetries is the number
+                                                  of retries to be attempted. Defaults
+                                                  to 2.
+                                                format: int32
+                                                minimum: 0
+                                                type: integer
+                                              perRetry:
+                                                description: PerRetry is the retry
+                                                  policy to be applied per retry attempt.
+                                                properties:
+                                                  backOff:
+                                                    description: |-
+                                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                                      back-off algorithm for retries. For additional details,
+                                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                                    properties:
+                                                      baseInterval:
+                                                        description: BaseInterval
+                                                          is the base interval between
+                                                          retries.
+                                                        format: duration
+                                                        type: string
+                                                      maxInterval:
+                                                        description: |-
+                                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                                          The default is 10 times the base_interval
+                                                        format: duration
+                                                        type: string
+                                                    type: object
+                                                  timeout:
+                                                    description: Timeout is the timeout
+                                                      per retry attempt.
+                                                    format: duration
+                                                    type: string
+                                                type: object
+                                              retryOn:
+                                                description: |-
+                                                  RetryOn specifies the retry trigger condition.
+
+                                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                                properties:
+                                                  httpStatusCodes:
+                                                    description: |-
+                                                      HttpStatusCodes specifies the http status codes to be retried.
+                                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                                    items:
+                                                      description: HTTPStatus defines
+                                                        the http status code.
+                                                      exclusiveMaximum: true
+                                                      maximum: 600
+                                                      minimum: 100
+                                                      type: integer
+                                                    type: array
+                                                  triggers:
+                                                    description: Triggers specifies
+                                                      the retry trigger condition(Http/Grpc).
+                                                    items:
+                                                      description: TriggerEnum specifies
+                                                        the conditions that trigger
+                                                        retries.
+                                                      enum:
+                                                      - 5xx
+                                                      - gateway-error
+                                                      - reset
+                                                      - connect-failure
+                                                      - retriable-4xx
+                                                      - refused-stream
+                                                      - retriable-status-codes
+                                                      - cancelled
+                                                      - deadline-exceeded
+                                                      - internal
+                                                      - resource-exhausted
+                                                      - unavailable
+                                                      type: string
+                                                    type: array
+                                                type: object
+                                            type: object
                                           tcpKeepalive:
                                             description: |-
                                               TcpKeepalive settings associated with the upstream client connection.
@@ -12896,6 +13064,87 @@ spec:
                                       required:
                                       - version
                                       type: object
+                                    retry:
+                                      description: |-
+                                        Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                                        If not set, retry will be disabled.
+                                      properties:
+                                        numRetries:
+                                          default: 2
+                                          description: NumRetries is the number of
+                                            retries to be attempted. Defaults to 2.
+                                          format: int32
+                                          minimum: 0
+                                          type: integer
+                                        perRetry:
+                                          description: PerRetry is the retry policy
+                                            to be applied per retry attempt.
+                                          properties:
+                                            backOff:
+                                              description: |-
+                                                Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                                back-off algorithm for retries. For additional details,
+                                                see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                              properties:
+                                                baseInterval:
+                                                  description: BaseInterval is the
+                                                    base interval between retries.
+                                                  format: duration
+                                                  type: string
+                                                maxInterval:
+                                                  description: |-
+                                                    MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                                    The default is 10 times the base_interval
+                                                  format: duration
+                                                  type: string
+                                              type: object
+                                            timeout:
+                                              description: Timeout is the timeout
+                                                per retry attempt.
+                                              format: duration
+                                              type: string
+                                          type: object
+                                        retryOn:
+                                          description: |-
+                                            RetryOn specifies the retry trigger condition.
+
+                                            If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                          properties:
+                                            httpStatusCodes:
+                                              description: |-
+                                                HttpStatusCodes specifies the http status codes to be retried.
+                                                The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                              items:
+                                                description: HTTPStatus defines the
+                                                  http status code.
+                                                exclusiveMaximum: true
+                                                maximum: 600
+                                                minimum: 100
+                                                type: integer
+                                              type: array
+                                            triggers:
+                                              description: Triggers specifies the
+                                                retry trigger condition(Http/Grpc).
+                                              items:
+                                                description: TriggerEnum specifies
+                                                  the conditions that trigger retries.
+                                                enum:
+                                                - 5xx
+                                                - gateway-error
+                                                - reset
+                                                - connect-failure
+                                                - retriable-4xx
+                                                - refused-stream
+                                                - retriable-status-codes
+                                                - cancelled
+                                                - deadline-exceeded
+                                                - internal
+                                                - resource-exhausted
+                                                - unavailable
+                                                type: string
+                                              type: array
+                                          type: object
+                                      type: object
                                     tcpKeepalive:
                                       description: |-
                                         TcpKeepalive settings associated with the upstream client connection.
@@ -13791,6 +14040,87 @@ spec:
                                 required:
                                 - version
                                 type: object
+                              retry:
+                                description: |-
+                                  Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                                  If not set, retry will be disabled.
+                                properties:
+                                  numRetries:
+                                    default: 2
+                                    description: NumRetries is the number of retries
+                                      to be attempted. Defaults to 2.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  perRetry:
+                                    description: PerRetry is the retry policy to be
+                                      applied per retry attempt.
+                                    properties:
+                                      backOff:
+                                        description: |-
+                                          Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                          back-off algorithm for retries. For additional details,
+                                          see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                        properties:
+                                          baseInterval:
+                                            description: BaseInterval is the base
+                                              interval between retries.
+                                            format: duration
+                                            type: string
+                                          maxInterval:
+                                            description: |-
+                                              MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                              The default is 10 times the base_interval
+                                            format: duration
+                                            type: string
+                                        type: object
+                                      timeout:
+                                        description: Timeout is the timeout per retry
+                                          attempt.
+                                        format: duration
+                                        type: string
+                                    type: object
+                                  retryOn:
+                                    description: |-
+                                      RetryOn specifies the retry trigger condition.
+
+                                      If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                    properties:
+                                      httpStatusCodes:
+                                        description: |-
+                                          HttpStatusCodes specifies the http status codes to be retried.
+                                          The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                        items:
+                                          description: HTTPStatus defines the http
+                                            status code.
+                                          exclusiveMaximum: true
+                                          maximum: 600
+                                          minimum: 100
+                                          type: integer
+                                        type: array
+                                      triggers:
+                                        description: Triggers specifies the retry
+                                          trigger condition(Http/Grpc).
+                                        items:
+                                          description: TriggerEnum specifies the conditions
+                                            that trigger retries.
+                                          enum:
+                                          - 5xx
+                                          - gateway-error
+                                          - reset
+                                          - connect-failure
+                                          - retriable-4xx
+                                          - refused-stream
+                                          - retriable-status-codes
+                                          - cancelled
+                                          - deadline-exceeded
+                                          - internal
+                                          - resource-exhausted
+                                          - unavailable
+                                          type: string
+                                        type: array
+                                    type: object
+                                type: object
                               tcpKeepalive:
                                 description: |-
                                   TcpKeepalive settings associated with the upstream client connection.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index f00722dc4..f2c08a230 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -1024,6 +1024,87 @@ spec:
                             required:
                             - version
                             type: object
+                          retry:
+                            description: |-
+                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                              If not set, retry will be disabled.
+                            properties:
+                              numRetries:
+                                default: 2
+                                description: NumRetries is the number of retries to
+                                  be attempted. Defaults to 2.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                              perRetry:
+                                description: PerRetry is the retry policy to be applied
+                                  per retry attempt.
+                                properties:
+                                  backOff:
+                                    description: |-
+                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                      back-off algorithm for retries. For additional details,
+                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                    properties:
+                                      baseInterval:
+                                        description: BaseInterval is the base interval
+                                          between retries.
+                                        format: duration
+                                        type: string
+                                      maxInterval:
+                                        description: |-
+                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                          The default is 10 times the base_interval
+                                        format: duration
+                                        type: string
+                                    type: object
+                                  timeout:
+                                    description: Timeout is the timeout per retry
+                                      attempt.
+                                    format: duration
+                                    type: string
+                                type: object
+                              retryOn:
+                                description: |-
+                                  RetryOn specifies the retry trigger condition.
+
+                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                properties:
+                                  httpStatusCodes:
+                                    description: |-
+                                      HttpStatusCodes specifies the http status codes to be retried.
+                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                    items:
+                                      description: HTTPStatus defines the http status
+                                        code.
+                                      exclusiveMaximum: true
+                                      maximum: 600
+                                      minimum: 100
+                                      type: integer
+                                    type: array
+                                  triggers:
+                                    description: Triggers specifies the retry trigger
+                                      condition(Http/Grpc).
+                                    items:
+                                      description: TriggerEnum specifies the conditions
+                                        that trigger retries.
+                                      enum:
+                                      - 5xx
+                                      - gateway-error
+                                      - reset
+                                      - connect-failure
+                                      - retriable-4xx
+                                      - refused-stream
+                                      - retriable-status-codes
+                                      - cancelled
+                                      - deadline-exceeded
+                                      - internal
+                                      - resource-exhausted
+                                      - unavailable
+                                      type: string
+                                    type: array
+                                type: object
+                            type: object
                           tcpKeepalive:
                             description: |-
                               TcpKeepalive settings associated with the upstream client connection.
@@ -1821,6 +1902,87 @@ spec:
                             required:
                             - version
                             type: object
+                          retry:
+                            description: |-
+                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                              If not set, retry will be disabled.
+                            properties:
+                              numRetries:
+                                default: 2
+                                description: NumRetries is the number of retries to
+                                  be attempted. Defaults to 2.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                              perRetry:
+                                description: PerRetry is the retry policy to be applied
+                                  per retry attempt.
+                                properties:
+                                  backOff:
+                                    description: |-
+                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                      back-off algorithm for retries. For additional details,
+                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                    properties:
+                                      baseInterval:
+                                        description: BaseInterval is the base interval
+                                          between retries.
+                                        format: duration
+                                        type: string
+                                      maxInterval:
+                                        description: |-
+                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                          The default is 10 times the base_interval
+                                        format: duration
+                                        type: string
+                                    type: object
+                                  timeout:
+                                    description: Timeout is the timeout per retry
+                                      attempt.
+                                    format: duration
+                                    type: string
+                                type: object
+                              retryOn:
+                                description: |-
+                                  RetryOn specifies the retry trigger condition.
+
+                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                properties:
+                                  httpStatusCodes:
+                                    description: |-
+                                      HttpStatusCodes specifies the http status codes to be retried.
+                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                    items:
+                                      description: HTTPStatus defines the http status
+                                        code.
+                                      exclusiveMaximum: true
+                                      maximum: 600
+                                      minimum: 100
+                                      type: integer
+                                    type: array
+                                  triggers:
+                                    description: Triggers specifies the retry trigger
+                                      condition(Http/Grpc).
+                                    items:
+                                      description: TriggerEnum specifies the conditions
+                                        that trigger retries.
+                                      enum:
+                                      - 5xx
+                                      - gateway-error
+                                      - reset
+                                      - connect-failure
+                                      - retriable-4xx
+                                      - refused-stream
+                                      - retriable-status-codes
+                                      - cancelled
+                                      - deadline-exceeded
+                                      - internal
+                                      - resource-exhausted
+                                      - unavailable
+                                      type: string
+                                    type: array
+                                type: object
+                            type: object
                           tcpKeepalive:
                             description: |-
                               TcpKeepalive settings associated with the upstream client connection.
@@ -2189,22 +2351,872 @@ spec:
                           The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).
                           If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
                         type: string
-                      issuer:
+                      backendRef:
                         description: |-
-                          The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).
-                          Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST
-                          be https, a host component, and optionally, port and path components and
-                          no query or fragment components.
-                        minLength: 1
-                        type: string
-                      tokenEndpoint:
+                          BackendRef references a Kubernetes object that represents the
+                          backend server to which the authorization request will be sent.
+
+                          Deprecated: Use BackendRefs instead.
+                        properties:
+                          group:
+                            default: ""
+                            description: |-
+                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                              When unspecified or empty string, core API group is inferred.
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Service
+                            description: |-
+                              Kind is the Kubernetes resource kind of the referent. For example
+                              "Service".
+
+                              Defaults to "Service" when not specified.
+
+                              ExternalName services can refer to CNAME DNS records that may live
+                              outside of the cluster and as such are difficult to reason about in
+                              terms of conformance. They also may not be safe to forward to (see
+                              CVE-2021-25740 for more information). Implementations SHOULD NOT
+                              support ExternalName Services.
+
+                              Support: Core (Services with a type other than ExternalName)
+
+                              Support: Implementation-specific (Services with type ExternalName)
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: Name is the name of the referent.
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
+                            description: |-
+                              Namespace is the namespace of the backend. When unspecified, the local
+                              namespace is inferred.
+
+                              Note that when a namespace different than the local namespace is specified,
+                              a ReferenceGrant object is required in the referent namespace to allow that
+                              namespace's owner to accept the reference. See the ReferenceGrant
+                              documentation for details.
+
+                              Support: Core
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                            type: string
+                          port:
+                            description: |-
+                              Port specifies the destination port number to use for this resource.
+                              Port is required when the referent is a Kubernetes Service. In this
+                              case, the port number is the service port number, not the target port.
+                              For other resources, destination port might be derived from the referent
+                              resource or this field.
+                            format: int32
+                            maximum: 65535
+                            minimum: 1
+                            type: integer
+                        required:
+                        - name
+                        type: object
+                        x-kubernetes-validations:
+                        - message: Must have port for Service reference
+                          rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                            ? has(self.port) : true'
+                      backendRefs:
                         description: |-
-                          The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
-                          If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
-                        type: string
-                    required:
-                    - issuer
-                    type: object
+                          BackendRefs references a Kubernetes object that represents the
+                          backend server to which the authorization request will be sent.
+                        items:
+                          description: BackendRef defines how an ObjectReference that
+                            is specific to BackendRef.
+                          properties:
+                            fallback:
+                              description: |-
+                                Fallback indicates whether the backend is designated as a fallback.
+                                Multiple fallback backends can be configured.
+                                It is highly recommended to configure active or passive health checks to ensure that failover can be detected
+                                when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again.
+                                The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
+                                the health of the active backends falls below 72%.
+                              type: boolean
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Service
+                              description: |-
+                                Kind is the Kubernetes resource kind of the referent. For example
+                                "Service".
+
+                                Defaults to "Service" when not specified.
+
+                                ExternalName services can refer to CNAME DNS records that may live
+                                outside of the cluster and as such are difficult to reason about in
+                                terms of conformance. They also may not be safe to forward to (see
+                                CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                support ExternalName Services.
+
+                                Support: Core (Services with a type other than ExternalName)
+
+                                Support: Implementation-specific (Services with type ExternalName)
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the backend. When unspecified, the local
+                                namespace is inferred.
+
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                            port:
+                              description: |-
+                                Port specifies the destination port number to use for this resource.
+                                Port is required when the referent is a Kubernetes Service. In this
+                                case, the port number is the service port number, not the target port.
+                                For other resources, destination port might be derived from the referent
+                                resource or this field.
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                          required:
+                          - name
+                          type: object
+                          x-kubernetes-validations:
+                          - message: Must have port for Service reference
+                            rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                              ? has(self.port) : true'
+                        maxItems: 16
+                        type: array
+                      backendSettings:
+                        description: |-
+                          BackendSettings holds configuration for managing the connection
+                          to the backend.
+                        properties:
+                          circuitBreaker:
+                            description: |-
+                              Circuit Breaker settings for the upstream connections and requests.
+                              If not set, circuit breakers will be enabled with the default thresholds
+                            properties:
+                              maxConnections:
+                                default: 1024
+                                description: The maximum number of connections that
+                                  Envoy will establish to the referenced backend defined
+                                  within a xRoute rule.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                              maxParallelRequests:
+                                default: 1024
+                                description: The maximum number of parallel requests
+                                  that Envoy will make to the referenced backend defined
+                                  within a xRoute rule.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                              maxParallelRetries:
+                                default: 1024
+                                description: The maximum number of parallel retries
+                                  that Envoy will make to the referenced backend defined
+                                  within a xRoute rule.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                              maxPendingRequests:
+                                default: 1024
+                                description: The maximum number of pending requests
+                                  that Envoy will queue to the referenced backend
+                                  defined within a xRoute rule.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                              maxRequestsPerConnection:
+                                description: |-
+                                  The maximum number of requests that Envoy will make over a single connection to the referenced backend defined within a xRoute rule.
+                                  Default: unlimited.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                            type: object
+                          connection:
+                            description: Connection includes backend connection settings.
+                            properties:
+                              bufferLimit:
+                                allOf:
+                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  BufferLimit Soft limit on size of the cluster’s connections read and write buffers.
+                                  BufferLimit applies to connection streaming (maybe non-streaming) channel between processes, it's in user space.
+                                  If unspecified, an implementation defined default is applied (32768 bytes).
+                                  For example, 20Mi, 1Gi, 256Ki etc.
+                                  Note: that when the suffix is not provided, the value is interpreted as bytes.
+                                x-kubernetes-int-or-string: true
+                              socketBufferLimit:
+                                allOf:
+                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  SocketBufferLimit provides configuration for the maximum buffer size in bytes for each socket
+                                  to backend.
+                                  SocketBufferLimit applies to socket streaming channel between TCP/IP stacks, it's in kernel space.
+                                  For example, 20Mi, 1Gi, 256Ki etc.
+                                  Note that when the suffix is not provided, the value is interpreted as bytes.
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          dns:
+                            description: DNS includes dns resolution settings.
+                            properties:
+                              dnsRefreshRate:
+                                description: |-
+                                  DNSRefreshRate specifies the rate at which DNS records should be refreshed.
+                                  Defaults to 30 seconds.
+                                type: string
+                              respectDnsTtl:
+                                description: |-
+                                  RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.
+                                  If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.
+                                  Defaults to true.
+                                type: boolean
+                            type: object
+                          healthCheck:
+                            description: HealthCheck allows gateway to perform active
+                              health checking on backends.
+                            properties:
+                              active:
+                                description: Active health check configuration
+                                properties:
+                                  grpc:
+                                    description: |-
+                                      GRPC defines the configuration of the GRPC health checker.
+                                      It's optional, and can only be used if the specified type is GRPC.
+                                    properties:
+                                      service:
+                                        description: |-
+                                          Service to send in the health check request.
+                                          If this is not specified, then the health check request applies to the entire
+                                          server and not to a specific service.
+                                        type: string
+                                    type: object
+                                  healthyThreshold:
+                                    default: 1
+                                    description: HealthyThreshold defines the number
+                                      of healthy health checks required before a backend
+                                      host is marked healthy.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  http:
+                                    description: |-
+                                      HTTP defines the configuration of http health checker.
+                                      It's required while the health checker type is HTTP.
+                                    properties:
+                                      expectedResponse:
+                                        description: ExpectedResponse defines a list
+                                          of HTTP expected responses to match.
+                                        properties:
+                                          binary:
+                                            description: Binary payload base64 encoded.
+                                            format: byte
+                                            type: string
+                                          text:
+                                            description: Text payload in plain text.
+                                            type: string
+                                          type:
+                                            allOf:
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            description: Type defines the type of
+                                              the payload.
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                        x-kubernetes-validations:
+                                        - message: If payload type is Text, text field
+                                            needs to be set.
+                                          rule: 'self.type == ''Text'' ? has(self.text)
+                                            : !has(self.text)'
+                                        - message: If payload type is Binary, binary
+                                            field needs to be set.
+                                          rule: 'self.type == ''Binary'' ? has(self.binary)
+                                            : !has(self.binary)'
+                                      expectedStatuses:
+                                        description: |-
+                                          ExpectedStatuses defines a list of HTTP response statuses considered healthy.
+                                          Defaults to 200 only
+                                        items:
+                                          description: HTTPStatus defines the http
+                                            status code.
+                                          exclusiveMaximum: true
+                                          maximum: 600
+                                          minimum: 100
+                                          type: integer
+                                        type: array
+                                      method:
+                                        description: |-
+                                          Method defines the HTTP method used for health checking.
+                                          Defaults to GET
+                                        type: string
+                                      path:
+                                        description: Path defines the HTTP path that
+                                          will be requested during health checking.
+                                        maxLength: 1024
+                                        minLength: 1
+                                        type: string
+                                    required:
+                                    - path
+                                    type: object
+                                  interval:
+                                    default: 3s
+                                    description: Interval defines the time between
+                                      active health checks.
+                                    format: duration
+                                    type: string
+                                  tcp:
+                                    description: |-
+                                      TCP defines the configuration of tcp health checker.
+                                      It's required while the health checker type is TCP.
+                                    properties:
+                                      receive:
+                                        description: Receive defines the expected
+                                          response payload.
+                                        properties:
+                                          binary:
+                                            description: Binary payload base64 encoded.
+                                            format: byte
+                                            type: string
+                                          text:
+                                            description: Text payload in plain text.
+                                            type: string
+                                          type:
+                                            allOf:
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            description: Type defines the type of
+                                              the payload.
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                        x-kubernetes-validations:
+                                        - message: If payload type is Text, text field
+                                            needs to be set.
+                                          rule: 'self.type == ''Text'' ? has(self.text)
+                                            : !has(self.text)'
+                                        - message: If payload type is Binary, binary
+                                            field needs to be set.
+                                          rule: 'self.type == ''Binary'' ? has(self.binary)
+                                            : !has(self.binary)'
+                                      send:
+                                        description: Send defines the request payload.
+                                        properties:
+                                          binary:
+                                            description: Binary payload base64 encoded.
+                                            format: byte
+                                            type: string
+                                          text:
+                                            description: Text payload in plain text.
+                                            type: string
+                                          type:
+                                            allOf:
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            description: Type defines the type of
+                                              the payload.
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                        x-kubernetes-validations:
+                                        - message: If payload type is Text, text field
+                                            needs to be set.
+                                          rule: 'self.type == ''Text'' ? has(self.text)
+                                            : !has(self.text)'
+                                        - message: If payload type is Binary, binary
+                                            field needs to be set.
+                                          rule: 'self.type == ''Binary'' ? has(self.binary)
+                                            : !has(self.binary)'
+                                    type: object
+                                  timeout:
+                                    default: 1s
+                                    description: Timeout defines the time to wait
+                                      for a health check response.
+                                    format: duration
+                                    type: string
+                                  type:
+                                    allOf:
+                                    - enum:
+                                      - HTTP
+                                      - TCP
+                                      - GRPC
+                                    - enum:
+                                      - HTTP
+                                      - TCP
+                                      - GRPC
+                                    description: Type defines the type of health checker.
+                                    type: string
+                                  unhealthyThreshold:
+                                    default: 3
+                                    description: UnhealthyThreshold defines the number
+                                      of unhealthy health checks required before a
+                                      backend host is marked unhealthy.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                required:
+                                - type
+                                type: object
+                                x-kubernetes-validations:
+                                - message: If Health Checker type is HTTP, http field
+                                    needs to be set.
+                                  rule: 'self.type == ''HTTP'' ? has(self.http) :
+                                    !has(self.http)'
+                                - message: If Health Checker type is TCP, tcp field
+                                    needs to be set.
+                                  rule: 'self.type == ''TCP'' ? has(self.tcp) : !has(self.tcp)'
+                                - message: The grpc field can only be set if the Health
+                                    Checker type is GRPC.
+                                  rule: 'has(self.grpc) ? self.type == ''GRPC'' :
+                                    true'
+                              passive:
+                                description: Passive passive check configuration
+                                properties:
+                                  baseEjectionTime:
+                                    default: 30s
+                                    description: BaseEjectionTime defines the base
+                                      duration for which a host will be ejected on
+                                      consecutive failures.
+                                    format: duration
+                                    type: string
+                                  consecutive5XxErrors:
+                                    default: 5
+                                    description: Consecutive5xxErrors sets the number
+                                      of consecutive 5xx errors triggering ejection.
+                                    format: int32
+                                    type: integer
+                                  consecutiveGatewayErrors:
+                                    default: 0
+                                    description: ConsecutiveGatewayErrors sets the
+                                      number of consecutive gateway errors triggering
+                                      ejection.
+                                    format: int32
+                                    type: integer
+                                  consecutiveLocalOriginFailures:
+                                    default: 5
+                                    description: |-
+                                      ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.
+                                      Parameter takes effect only when split_external_local_origin_errors is set to true.
+                                    format: int32
+                                    type: integer
+                                  interval:
+                                    default: 3s
+                                    description: Interval defines the time between
+                                      passive health checks.
+                                    format: duration
+                                    type: string
+                                  maxEjectionPercent:
+                                    default: 10
+                                    description: MaxEjectionPercent sets the maximum
+                                      percentage of hosts in a cluster that can be
+                                      ejected.
+                                    format: int32
+                                    type: integer
+                                  splitExternalLocalOriginErrors:
+                                    default: false
+                                    description: SplitExternalLocalOriginErrors enables
+                                      splitting of errors between external and local
+                                      origin.
+                                    type: boolean
+                                type: object
+                            type: object
+                          http2:
+                            description: HTTP2 provides HTTP/2 configuration for backend
+                              connections.
+                            properties:
+                              initialConnectionWindowSize:
+                                allOf:
+                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.
+                                  If not set, the default value is 1 MiB.
+                                x-kubernetes-int-or-string: true
+                              initialStreamWindowSize:
+                                allOf:
+                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  InitialStreamWindowSize sets the initial window size for HTTP/2 streams.
+                                  If not set, the default value is 64 KiB(64*1024).
+                                x-kubernetes-int-or-string: true
+                              maxConcurrentStreams:
+                                description: |-
+                                  MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.
+                                  If not set, the default value is 100.
+                                format: int32
+                                maximum: 2147483647
+                                minimum: 1
+                                type: integer
+                              onInvalidMessage:
+                                description: |-
+                                  OnInvalidMessage determines if Envoy will terminate the connection or just the offending stream in the event of HTTP messaging error
+                                  It's recommended for L2 Envoy deployments to set this value to TerminateStream.
+                                  https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/level_two
+                                  Default: TerminateConnection
+                                type: string
+                            type: object
+                          loadBalancer:
+                            description: |-
+                              LoadBalancer policy to apply when routing traffic from the gateway to
+                              the backend endpoints. Defaults to `LeastRequest`.
+                            properties:
+                              consistentHash:
+                                description: |-
+                                  ConsistentHash defines the configuration when the load balancer type is
+                                  set to ConsistentHash
+                                properties:
+                                  cookie:
+                                    description: Cookie configures the cookie hash
+                                      policy when the consistent hash type is set
+                                      to Cookie.
+                                    properties:
+                                      attributes:
+                                        additionalProperties:
+                                          type: string
+                                        description: Additional Attributes to set
+                                          for the generated cookie.
+                                        type: object
+                                      name:
+                                        description: |-
+                                          Name of the cookie to hash.
+                                          If this cookie does not exist in the request, Envoy will generate a cookie and set
+                                          the TTL on the response back to the client based on Layer 4
+                                          attributes of the backend endpoint, to ensure that these future requests
+                                          go to the same backend endpoint. Make sure to set the TTL field for this case.
+                                        type: string
+                                      ttl:
+                                        description: |-
+                                          TTL of the generated cookie if the cookie is not present. This value sets the
+                                          Max-Age attribute value.
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                  header:
+                                    description: Header configures the header hash
+                                      policy when the consistent hash type is set
+                                      to Header.
+                                    properties:
+                                      name:
+                                        description: Name of the header to hash.
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                  tableSize:
+                                    default: 65537
+                                    description: The table size for consistent hashing,
+                                      must be prime number limited to 5000011.
+                                    format: int64
+                                    maximum: 5000011
+                                    minimum: 2
+                                    type: integer
+                                  type:
+                                    description: |-
+                                      ConsistentHashType defines the type of input to hash on. Valid Type values are
+                                      "SourceIP",
+                                      "Header",
+                                      "Cookie".
+                                    enum:
+                                    - SourceIP
+                                    - Header
+                                    - Cookie
+                                    type: string
+                                required:
+                                - type
+                                type: object
+                                x-kubernetes-validations:
+                                - message: If consistent hash type is header, the
+                                    header field must be set.
+                                  rule: 'self.type == ''Header'' ? has(self.header)
+                                    : !has(self.header)'
+                                - message: If consistent hash type is cookie, the
+                                    cookie field must be set.
+                                  rule: 'self.type == ''Cookie'' ? has(self.cookie)
+                                    : !has(self.cookie)'
+                              slowStart:
+                                description: |-
+                                  SlowStart defines the configuration related to the slow start load balancer policy.
+                                  If set, during slow start window, traffic sent to the newly added hosts will gradually increase.
+                                  Currently this is only supported for RoundRobin and LeastRequest load balancers
+                                properties:
+                                  window:
+                                    description: |-
+                                      Window defines the duration of the warm up period for newly added host.
+                                      During slow start window, traffic sent to the newly added hosts will gradually increase.
+                                      Currently only supports linear growth of traffic. For additional details,
+                                      see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    type: string
+                                required:
+                                - window
+                                type: object
+                              type:
+                                description: |-
+                                  Type decides the type of Load Balancer policy.
+                                  Valid LoadBalancerType values are
+                                  "ConsistentHash",
+                                  "LeastRequest",
+                                  "Random",
+                                  "RoundRobin".
+                                enum:
+                                - ConsistentHash
+                                - LeastRequest
+                                - Random
+                                - RoundRobin
+                                type: string
+                            required:
+                            - type
+                            type: object
+                            x-kubernetes-validations:
+                            - message: If LoadBalancer type is consistentHash, consistentHash
+                                field needs to be set.
+                              rule: 'self.type == ''ConsistentHash'' ? has(self.consistentHash)
+                                : !has(self.consistentHash)'
+                            - message: Currently SlowStart is only supported for RoundRobin
+                                and LeastRequest load balancers.
+                              rule: 'self.type in [''Random'', ''ConsistentHash'']
+                                ? !has(self.slowStart) : true '
+                          proxyProtocol:
+                            description: ProxyProtocol enables the Proxy Protocol
+                              when communicating with the backend.
+                            properties:
+                              version:
+                                description: |-
+                                  Version of ProxyProtol
+                                  Valid ProxyProtocolVersion values are
+                                  "V1"
+                                  "V2"
+                                enum:
+                                - V1
+                                - V2
+                                type: string
+                            required:
+                            - version
+                            type: object
+                          retry:
+                            description: |-
+                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                              If not set, retry will be disabled.
+                            properties:
+                              numRetries:
+                                default: 2
+                                description: NumRetries is the number of retries to
+                                  be attempted. Defaults to 2.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                              perRetry:
+                                description: PerRetry is the retry policy to be applied
+                                  per retry attempt.
+                                properties:
+                                  backOff:
+                                    description: |-
+                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                      back-off algorithm for retries. For additional details,
+                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                    properties:
+                                      baseInterval:
+                                        description: BaseInterval is the base interval
+                                          between retries.
+                                        format: duration
+                                        type: string
+                                      maxInterval:
+                                        description: |-
+                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                          The default is 10 times the base_interval
+                                        format: duration
+                                        type: string
+                                    type: object
+                                  timeout:
+                                    description: Timeout is the timeout per retry
+                                      attempt.
+                                    format: duration
+                                    type: string
+                                type: object
+                              retryOn:
+                                description: |-
+                                  RetryOn specifies the retry trigger condition.
+
+                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                properties:
+                                  httpStatusCodes:
+                                    description: |-
+                                      HttpStatusCodes specifies the http status codes to be retried.
+                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                    items:
+                                      description: HTTPStatus defines the http status
+                                        code.
+                                      exclusiveMaximum: true
+                                      maximum: 600
+                                      minimum: 100
+                                      type: integer
+                                    type: array
+                                  triggers:
+                                    description: Triggers specifies the retry trigger
+                                      condition(Http/Grpc).
+                                    items:
+                                      description: TriggerEnum specifies the conditions
+                                        that trigger retries.
+                                      enum:
+                                      - 5xx
+                                      - gateway-error
+                                      - reset
+                                      - connect-failure
+                                      - retriable-4xx
+                                      - refused-stream
+                                      - retriable-status-codes
+                                      - cancelled
+                                      - deadline-exceeded
+                                      - internal
+                                      - resource-exhausted
+                                      - unavailable
+                                      type: string
+                                    type: array
+                                type: object
+                            type: object
+                          tcpKeepalive:
+                            description: |-
+                              TcpKeepalive settings associated with the upstream client connection.
+                              Disabled by default.
+                            properties:
+                              idleTime:
+                                description: |-
+                                  The duration a connection needs to be idle before keep-alive
+                                  probes start being sent.
+                                  The duration format is
+                                  Defaults to `7200s`.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                type: string
+                              interval:
+                                description: |-
+                                  The duration between keep-alive probes.
+                                  Defaults to `75s`.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                type: string
+                              probes:
+                                description: |-
+                                  The total number of unacknowledged probes to send before deciding
+                                  the connection is dead.
+                                  Defaults to 9.
+                                format: int32
+                                type: integer
+                            type: object
+                          timeout:
+                            description: Timeout settings for the backend connections.
+                            properties:
+                              http:
+                                description: Timeout settings for HTTP.
+                                properties:
+                                  connectionIdleTimeout:
+                                    description: |-
+                                      The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+                                      Default: 1 hour.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                    type: string
+                                  maxConnectionDuration:
+                                    description: |-
+                                      The maximum duration of an HTTP connection.
+                                      Default: unlimited.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                    type: string
+                                type: object
+                              tcp:
+                                description: Timeout settings for TCP.
+                                properties:
+                                  connectTimeout:
+                                    description: |-
+                                      The timeout for network connection establishment, including TCP and TLS handshakes.
+                                      Default: 10 seconds.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                    type: string
+                                type: object
+                            type: object
+                        type: object
+                      issuer:
+                        description: |-
+                          The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).
+                          Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST
+                          be https, a host component, and optionally, port and path components and
+                          no query or fragment components.
+                        minLength: 1
+                        type: string
+                      tokenEndpoint:
+                        description: |-
+                          The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
+                          If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
+                        type: string
+                    required:
+                    - issuer
+                    type: object
+                    x-kubernetes-validations:
+                    - message: BackendRefs must be used, backendRef is not supported.
+                      rule: '!has(self.backendRef)'
+                    - message: Only one backendRefs is allowed.
+                      rule: 'has(self.backendRefs)? self.backendRefs.size() > 1 :
+                        true'
                   redirectURL:
                     description: |-
                       The redirect URL to be used in the OIDC
diff --git a/examples/kubernetes/jwt/README.md b/examples/kubernetes/jwt/README.md
new file mode 100644
index 000000000..cc4d6eaca
--- /dev/null
+++ b/examples/kubernetes/jwt/README.md
@@ -0,0 +1,3 @@
+The JWKS and private key in this directory are for testing purposes only and should not be considered confidential. Please do not use them in a production environment.
+
+A new JWT token can be generated using tools like https://www.scottbrady91.com/tools/jwt .
\ No newline at end of file
diff --git a/examples/kubernetes/jwt/jwks.json b/examples/kubernetes/jwt/jwks.json
index 6cd882726..b58d8e04f 100644
--- a/examples/kubernetes/jwt/jwks.json
+++ b/examples/kubernetes/jwt/jwks.json
@@ -1,1 +1,22 @@
-{"keys":[{"kty":"RSA","n":"u1SU1LfVLPHCozMxH2Mo4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0_IzW7yWR7QkrmBL7jTKEn5u-qKhbwKfBstIs-bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyehkd3qqGElvW_VDL5AaWTg0nLVkjRo9z-40RQzuVaE8AkAFmxZzow3x-VJYKdjykkJ0iT9wCS0DRTXu269V264Vf_3jvredZiKRkgwlL9xNAwxXFg0x_XFw005UWVRIkdgcKWTjpBP2dPwVZ4WWC-9aGVd-Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbcmw","e":"AQAB","alg":"RS256","use":"sig"}]}
+{
+    "keys": [
+        {
+            "kty": "RSA",
+            "n": "u1SU1LfVLPHCozMxH2Mo4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0_IzW7yWR7QkrmBL7jTKEn5u-qKhbwKfBstIs-bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyehkd3qqGElvW_VDL5AaWTg0nLVkjRo9z-40RQzuVaE8AkAFmxZzow3x-VJYKdjykkJ0iT9wCS0DRTXu269V264Vf_3jvredZiKRkgwlL9xNAwxXFg0x_XFw005UWVRIkdgcKWTjpBP2dPwVZ4WWC-9aGVd-Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbcmw",
+            "e": "AQAB",
+            "alg": "RS256",
+            "use": "sig"
+        },
+        {
+            "alg": "RS256",
+            "e": "AQAB",
+            "key_ops": [
+                "verify"
+            ],
+            "kty": "RSA",
+            "n": "xOHb-i1WDfeAvsbXTSOtosl3hCUDHQ8fRDqX_Rt998-hZDJmAoPOu4J-wcwq5aZtSn_iWUYLcK2WmC_1n-p1eyc-Pl4CBnxF7LUjCk-WGhniaCzXC5I5RON6c5N-MdE0UfukK0PM0zD3iQonZq0fIsnOYyFdYdWvQ5XW-C2aLlq2FUKrjmhAav10jIC0KGd2dHRzauzfLMUmt_iMnpU84Xrur1zRYzBO4D90rN0ypC2HH7o_zI8Osx4o1L8BScW78545sWyVbaprhBV1I2Sa4SH3NAc25ej3RIh-f13Yu97FVfO0AIG4VfFiaMmsTqNTCiBkM20tXD2Z-cHJTKemXzFgInJoqFLAkHLzJ0lPvAkKOgAOufLHa7RA-C276OXd72IXPsL1UOLN4sjhGqTtaynVa00yuHdi3f4-aoy9F9SUJeWfPg--nZNLzuI0eyufsTFywnx1bTQ_kdYlEr0dRE5sujlMk3cZ7FmOQRvcjA9MxFzoVKMmlZc6LMCgqw-P",
+            "use": "sig",
+            "kid": "b520b3c2c4bd75a10e9cebc9576933dc"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/examples/kubernetes/jwt/key.json b/examples/kubernetes/jwt/key.json
new file mode 100644
index 000000000..6fbf5bb22
--- /dev/null
+++ b/examples/kubernetes/jwt/key.json
@@ -0,0 +1,17 @@
+{
+    "alg": "RS256",
+    "d": "URyb_B3hbi-hovdYjDc-ueo2iwKUncw1HW7mXyiMZSPtYdJBpJeY_Ddu8Xij06kVLbQyFIV_ARUDDf_0OcXmUK6CPj-Mpg9c34Bgx0aymF5BoJmYnvPHFFKDiEojm3KNE5mQsSJlqDxsPtEoGm0IftSVatG8Hyph4n5A6k4fTymgCnJFK45Xu7xf3-LGVj8J1kCDrHGaIF-46-JCTLM_OcXjv-uFeE_Wrxx1fSJEUs9O9AtPbX8ilzi9qahnZ3VGmG1sSv0IPy1zUcRqF0nHVi4FP4yK-jZNbGvYobqlf-CpW6FKRNwKzc9a8QfnJB-bA4DQkHZBqKOLpMlPgGQj4Sgp4OnaBrJhXO4gLkXlhLpQNjr74qZr0KYR34MsVJIbCT0m6P1HrH1Yz-k8PIWE1LfY4Ku5ECpJOP9PCqd4vcUM4ErON08MozvSvALkuzgvWC7jjkHECSaRvRKhA6cEuBPLlzwUSWPRiso6BC9TvaEmbg2zk-xBtMfiKdtc9NPB",
+    "dp": "vAzERP3CMHHpBMK_0--UPaoTcfTDlcR6-2oRfjkbb3sfbryZJkoCrnlBBbFAnbSkCIrJL9Ig2lfEpK44OQJJ48AYja5z2APQyTgoOQMpp61OH8AWgvnupLNtWdhwYQgDkb276pAcPBkgRxXt29qW_Tvbcq-vcmV9NrqEWrJj_Os7gQvVDTgagaQZ3eH7eHqKCoAcAEwKL1SOH7DEh-LSX9N2G54tU11RFSmuiGMZ_XzU-hFmQN210sRckjHivCvR",
+    "dq": "yT4AWazCtcgW44VdhSlpebeMnz591P9KA41_l8vDALCBIjbom0wX5BZaaLaPsUPvfGkIOduCs7cJWzBPwOrd_BLenqd7rsHlhAz5aBVj0aXenUGwYQ8DaZzrB_wmPrJHkyzT9HOJ1jmiC5op-igcNSHrPfwFJ5K-bjUHJE4zIMmsMzi8XoWIj52uyRdXAq1u1t12Hc3_g_Fy5PugufrNIh8bMBw8wsEfTnMc21Y5s7xTTFouf4RUgVP5oBCe12Lh",
+    "e": "AQAB",
+    "key_ops": [
+      "sign"
+    ],
+    "kty": "RSA",
+    "n": "xOHb-i1WDfeAvsbXTSOtosl3hCUDHQ8fRDqX_Rt998-hZDJmAoPOu4J-wcwq5aZtSn_iWUYLcK2WmC_1n-p1eyc-Pl4CBnxF7LUjCk-WGhniaCzXC5I5RON6c5N-MdE0UfukK0PM0zD3iQonZq0fIsnOYyFdYdWvQ5XW-C2aLlq2FUKrjmhAav10jIC0KGd2dHRzauzfLMUmt_iMnpU84Xrur1zRYzBO4D90rN0ypC2HH7o_zI8Osx4o1L8BScW78545sWyVbaprhBV1I2Sa4SH3NAc25ej3RIh-f13Yu97FVfO0AIG4VfFiaMmsTqNTCiBkM20tXD2Z-cHJTKemXzFgInJoqFLAkHLzJ0lPvAkKOgAOufLHa7RA-C276OXd72IXPsL1UOLN4sjhGqTtaynVa00yuHdi3f4-aoy9F9SUJeWfPg--nZNLzuI0eyufsTFywnx1bTQ_kdYlEr0dRE5sujlMk3cZ7FmOQRvcjA9MxFzoVKMmlZc6LMCgqw-P",
+    "p": "7m9XI2SOtfdUd-BTKSoot9bgo5oKHcG3pilZtNlqgf5o47rHeSQj8Js85PL-2IXGDuRkTA08uTzQtoPEwsGb8aB96KhSw3SSqtEN_hNFCUQ4AuxWtXj5nTEudqhyFHyYb5U-6_iVrKk_rJYI4l1dRSe0ePuIgmHJOSJUBnPFHiYURKmI3F2MCLXD3PQKbtBYx24QP0bvsTl6uz_uh5_EvPLBgtCJf0ey6D2DHt-4NQxp-_13PCBxt_ARi6lAYG8D",
+    "q": "02Lf5WZuXf0ZBvnug8lwkZ1a2pe0MG_-b6KHMaUN3su3uyqvB8x6b9wEl3UN-4z8OgDfWewYFxU5v3DMPY6ecMoMFfOzSApTEimLsJ_4i3qqxFvVeG5w0jX7nyGBvCdIuqjQYGd03P2BpXQwiFzJ7Sai4Dj_IOPUBM59TCR3R-fk8I9PoTXDXG1di6DwpXRvfYoUypxufvhQcmvBELB-sNgbX2LjVwJ4ZjniMFSkjvGNm88BH32SMRMuh3oSFiGF",
+    "qi": "wh-Gs9spzz9ogGpj_XSkHguvHayVqLzDK9GVbdXUO-bOYvZkvQO37GDBBRv39drYQrpgivT-iwgtWn6ESQ1atxcx1I6IXtAi9CZUJeBH7ipuOi5GPr_igphr0Z9O2a7Bwv3ZwwnuoseGYIW4ybPj93D1P2nHKcoh4u5dpSpXuy3qh4urAtVkivEXtxPPQdTkoizwGPAa19-Tyzv8Xrt3W6M2rCBQa8mpLkBHYhkgxfDx8olrerXxT11kMLlqFcwN",
+    "use": "sig",
+    "kid": "b520b3c2c4bd75a10e9cebc9576933dc"
+  }
\ No newline at end of file
diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go
index 44d813c25..7d4c95e6e 100644
--- a/internal/gatewayapi/clienttrafficpolicy.go
+++ b/internal/gatewayapi/clienttrafficpolicy.go
@@ -661,6 +661,7 @@ func translateHTTP1Settings(http1Settings *egv1a1.HTTP1Settings, httpIR *ir.HTTP
 	if http1Settings.HTTP10 != nil {
 		var defaultHost *string
 		if ptr.Deref(http1Settings.HTTP10.UseDefaultHost, false) {
+			// First level of precedence - the first non-wildcard hostname associated with the listener
 			for _, hostname := range httpIR.Hostnames {
 				if !strings.Contains(hostname, "*") {
 					// make linter happy
@@ -669,8 +670,27 @@ func translateHTTP1Settings(http1Settings *egv1a1.HTTP1Settings, httpIR *ir.HTTP
 					break
 				}
 			}
+			// second level of precedence - try to get a hostname from the HTTPRoutes
+			numMatchingRoutes := 0
 			if defaultHost == nil {
-				return fmt.Errorf("cannot set http10 default host on listener with only wildcard hostnames")
+				// When taken from the routes, a default hostname can only be chosen if there
+				// is exactly one HTTPRoute with a non-wildcard hostname configured.
+				for _, route := range httpIR.Routes {
+					if route.Hostname != "" && !strings.Contains(route.Hostname, "*") {
+						numMatchingRoutes++
+						// make the linter happy
+						theHost := route.Hostname
+						defaultHost = ptr.To(theHost)
+					}
+					if numMatchingRoutes > 1 {
+						break
+					}
+				}
+				if numMatchingRoutes == 0 {
+					return fmt.Errorf("cannot set http10 default host on listener with only wildcard hostnames")
+				} else if numMatchingRoutes > 1 {
+					return fmt.Errorf("cannot set http10 default host on listener with only wildcard hostnames and more than one possible default route")
+				}
 			}
 		}
 		// If useDefaultHost was set, then defaultHost will have the hostname to use.
diff --git a/internal/gatewayapi/clustersettings.go b/internal/gatewayapi/clustersettings.go
index 4b295ea5b..cf8221d27 100644
--- a/internal/gatewayapi/clustersettings.go
+++ b/internal/gatewayapi/clustersettings.go
@@ -299,14 +299,12 @@ func buildLoadBalancer(policy egv1a1.ClusterSettings) (*ir.LoadBalancer, error)
 			ConsistentHash: consistentHash,
 		}
 	case egv1a1.LeastRequestLoadBalancerType:
-		lb = &ir.LoadBalancer{}
-		if policy.LoadBalancer.SlowStart != nil {
-			if policy.LoadBalancer.SlowStart.Window != nil {
-				lb.LeastRequest = &ir.LeastRequest{
-					SlowStart: &ir.SlowStart{
-						Window: policy.LoadBalancer.SlowStart.Window,
-					},
-				}
+		lb = &ir.LoadBalancer{
+			LeastRequest: &ir.LeastRequest{},
+		}
+		if policy.LoadBalancer.SlowStart != nil && policy.LoadBalancer.SlowStart.Window != nil {
+			lb.LeastRequest.SlowStart = &ir.SlowStart{
+				Window: policy.LoadBalancer.SlowStart.Window,
 			}
 		}
 	case egv1a1.RandomLoadBalancerType:
@@ -315,17 +313,11 @@ func buildLoadBalancer(policy egv1a1.ClusterSettings) (*ir.LoadBalancer, error)
 		}
 	case egv1a1.RoundRobinLoadBalancerType:
 		lb = &ir.LoadBalancer{
-			RoundRobin: &ir.RoundRobin{
-				SlowStart: &ir.SlowStart{},
-			},
+			RoundRobin: &ir.RoundRobin{},
 		}
-		if policy.LoadBalancer.SlowStart != nil {
-			if policy.LoadBalancer.SlowStart.Window != nil {
-				lb.RoundRobin = &ir.RoundRobin{
-					SlowStart: &ir.SlowStart{
-						Window: policy.LoadBalancer.SlowStart.Window,
-					},
-				}
+		if policy.LoadBalancer.SlowStart != nil && policy.LoadBalancer.SlowStart.Window != nil {
+			lb.RoundRobin.SlowStart = &ir.SlowStart{
+				Window: policy.LoadBalancer.SlowStart.Window,
 			}
 		}
 	}
diff --git a/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml b/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/translator.go b/internal/gatewayapi/translator.go
index 1be3f59f2..6346bb1a4 100644
--- a/internal/gatewayapi/translator.go
+++ b/internal/gatewayapi/translator.go
@@ -186,9 +186,6 @@ func (t *Translator) Translate(resources *Resources) (*TranslateResult, error) {
 	// Process EnvoyPatchPolicies
 	t.ProcessEnvoyPatchPolicies(resources.EnvoyPatchPolicies, xdsIR)
 
-	// Process ClientTrafficPolicies
-	clientTrafficPolicies := t.ProcessClientTrafficPolicies(resources, gateways, xdsIR, infraIR)
-
 	// Process all Addresses for all relevant Gateways.
 	t.ProcessAddresses(gateways, xdsIR, infraIR, resources)
 
@@ -210,6 +207,9 @@ func (t *Translator) Translate(resources *Resources) (*TranslateResult, error) {
 	// Process all relevant UDPRoutes.
 	udpRoutes := t.ProcessUDPRoutes(resources.UDPRoutes, gateways, resources, xdsIR)
 
+	// Process ClientTrafficPolicies
+	clientTrafficPolicies := t.ProcessClientTrafficPolicies(resources, gateways, xdsIR, infraIR)
+
 	// Process BackendTrafficPolicies
 	routes := []RouteContext{}
 	for _, h := range httpRoutes {
diff --git a/internal/gatewayapi/validate.go b/internal/gatewayapi/validate.go
index 5c442812d..d92dee3bc 100644
--- a/internal/gatewayapi/validate.go
+++ b/internal/gatewayapi/validate.go
@@ -314,6 +314,19 @@ func (t *Translator) validateBackendRefBackend(backendRef *gwapiv1a2.BackendRef,
 		return false
 	}
 
+	if err := validateBackend(backend); err != nil {
+		status.SetRouteStatusCondition(routeStatus,
+			parentRef.routeParentStatusIdx,
+			route.GetGeneration(),
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			"UnsupportedRefAddressFound",
+			fmt.Sprintf("Invalid Backend reference to Backend %s/%s found", backendNamespace,
+				string(backendRef.Name)),
+		)
+		return false
+	}
+
 	for _, bep := range backend.Spec.Endpoints {
 		if bep.Unix != nil {
 			status.SetRouteStatusCondition(routeStatus,
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
index 4ac9979f3..75bfc532b 100644
--- a/internal/xds/translator/cluster.go
+++ b/internal/xds/translator/cluster.go
@@ -183,15 +183,13 @@ func buildXdsCluster(args *xdsClusterArgs) *clusterv3.Cluster {
 		}
 	} else if args.loadBalancer.RoundRobin != nil {
 		cluster.LbPolicy = clusterv3.Cluster_ROUND_ROBIN
-		if args.loadBalancer.RoundRobin.SlowStart != nil {
-			if args.loadBalancer.RoundRobin.SlowStart.Window != nil {
-				cluster.LbConfig = &clusterv3.Cluster_RoundRobinLbConfig_{
-					RoundRobinLbConfig: &clusterv3.Cluster_RoundRobinLbConfig{
-						SlowStartConfig: &clusterv3.Cluster_SlowStartConfig{
-							SlowStartWindow: durationpb.New(args.loadBalancer.RoundRobin.SlowStart.Window.Duration),
-						},
+		if args.loadBalancer.RoundRobin.SlowStart != nil && args.loadBalancer.RoundRobin.SlowStart.Window != nil {
+			cluster.LbConfig = &clusterv3.Cluster_RoundRobinLbConfig_{
+				RoundRobinLbConfig: &clusterv3.Cluster_RoundRobinLbConfig{
+					SlowStartConfig: &clusterv3.Cluster_SlowStartConfig{
+						SlowStartWindow: durationpb.New(args.loadBalancer.RoundRobin.SlowStart.Window.Duration),
 					},
-				}
+				},
 			}
 		}
 	} else if args.loadBalancer.Random != nil {
diff --git a/tools/docker/envoy-gateway/Dockerfile b/tools/docker/envoy-gateway/Dockerfile
index e25c4cc79..4b40efa93 100644
--- a/tools/docker/envoy-gateway/Dockerfile
+++ b/tools/docker/envoy-gateway/Dockerfile
@@ -1,4 +1,4 @@
-FROM busybox@sha256:82742949a3709938cbeb9cec79f5eaf3e48b255389f2dcedf2de29ef96fd841c as source
+FROM busybox@sha256:34b191d63fbc93e25e275bfccf1b5365664e5ac28f06d974e8d50090fbb49f41 as source
 # Create the data directory for eg
 RUN mkdir -p /var/lib/eg
 
diff --git a/tools/make/kube.mk b/tools/make/kube.mk
index 38a3d5b97..dd5cd74c6 100644
--- a/tools/make/kube.mk
+++ b/tools/make/kube.mk
@@ -1,7 +1,9 @@
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION ?= 1.28.0
+# To know the available versions check:
+# - https://github.com/kubernetes-sigs/controller-tools/blob/main/envtest-releases.yaml
+ENVTEST_K8S_VERSION ?= 1.28.3
 # Need run cel validation across multiple versions of k8s
-ENVTEST_K8S_VERSIONS ?= 1.27.1 1.28.0 1.29.0
+ENVTEST_K8S_VERSIONS ?= 1.28.3 1.29.5 1.30.3 1.31.0
 # GATEWAY_API_VERSION refers to the version of Gateway API CRDs.
 # For more details, see https://gateway-api.sigs.k8s.io/guides/getting-started/#installing-gateway-api
 GATEWAY_API_VERSION ?= $(shell go list -m -f '{{.Version}}' sigs.k8s.io/gateway-api)


Test patch:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.in.yaml
index 5ea01c153..c4f16d4a2 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.in.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.in.yaml
@@ -40,6 +40,34 @@ clientTrafficPolicies:
       kind: Gateway
       name: gateway-1
       sectionName: http-3
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1-section-http-4
+  spec:
+    http1:
+      http10:
+        useDefaultHost: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-4
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1-section-http-5
+  spec:
+    http1:
+      http10:
+        useDefaultHost: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-5
 gateways:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
@@ -68,3 +96,57 @@ gateways:
       allowedRoutes:
         namespaces:
           from: Same
+    - name: http-4
+      protocol: HTTP
+      port: 8082
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: http-5
+      protocol: HTTP
+      port: 8083
+      allowedRoutes:
+        namespaces:
+          from: Same
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    hostnames:
+    - route.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http-4
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http-5
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-2
+  spec:
+    hostnames:
+    - route2.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http-5
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
index d0d0a8975..8561d9300 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
@@ -89,6 +89,67 @@ clientTrafficPolicies:
         status: "False"
         type: Accepted
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1-section-http-4
+    namespace: envoy-gateway
+  spec:
+    http1:
+      http10:
+        useDefaultHost: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-4
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-4
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1-section-http-5
+    namespace: envoy-gateway
+  spec:
+    http1:
+      http10:
+        useDefaultHost: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-5
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-5
+      conditions:
+      - lastTransitionTime: null
+        message: 'HTTP1: cannot set http10 default host on listener with only wildcard
+          hostnames and more than one possible default route.'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
 gateways:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
@@ -118,6 +179,18 @@ gateways:
       name: http-3
       port: 8081
       protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http-4
+      port: 8082
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http-5
+      port: 8083
+      protocol: HTTP
   status:
     listeners:
     - attachedRoutes: 0
@@ -189,6 +262,148 @@ gateways:
         kind: HTTPRoute
       - group: gateway.networking.k8s.io
         kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-4
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-5
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - route.example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http-4
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http-5
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-4
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-5
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - route2.example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http-5
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-5
 infraIR:
   envoy-gateway/gateway-1:
     proxy:
@@ -214,6 +429,20 @@ infraIR:
           name: http-8081
           protocol: HTTP
           servicePort: 8081
+      - address: null
+        name: envoy-gateway/gateway-1/http-4
+        ports:
+        - containerPort: 8082
+          name: http-8082
+          protocol: HTTP
+          servicePort: 8082
+      - address: null
+        name: envoy-gateway/gateway-1/http-5
+        ports:
+        - containerPort: 8083
+          name: http-8083
+          protocol: HTTP
+          servicePort: 8083
       metadata:
         labels:
           gateway.envoyproxy.io/owning-gateway-name: gateway-1
@@ -273,3 +502,88 @@ xdsIR:
         escapedSlashesAction: UnescapeAndRedirect
         mergeSlashes: true
       port: 8081
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      http1:
+        http10:
+          defaultHost: route.example.com
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-4
+      name: envoy-gateway/gateway-1/http-4
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8082
+      routes:
+      - destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - weight: 1
+        directResponse:
+          statusCode: 500
+        hostname: route.example.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: envoy-gateway
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/route_example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      http1: {}
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-5
+      name: envoy-gateway/gateway-1/http-5
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8083
+      routes:
+      - destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - weight: 1
+        directResponse:
+          statusCode: 500
+        hostname: route.example.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: envoy-gateway
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/route_example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      - destination:
+          name: httproute/envoy-gateway/httproute-2/rule/0
+          settings:
+          - weight: 1
+        directResponse:
+          statusCode: 500
+        hostname: route2.example.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-2
+          namespace: envoy-gateway
+        name: httproute/envoy-gateway/httproute-2/rule/0/match/0/route2_example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml b/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml b/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
index b25d2af5d..25ee9e8ba 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
@@ -272,9 +272,10 @@ httpRoutes:
         status: "True"
         type: Accepted
       - lastTransitionTime: null
-        message: Resolved all the Object references for the Route
-        reason: ResolvedRefs
-        status: "True"
+        message: Invalid Backend reference to Backend default/backend-ip-localhost
+          found
+        reason: UnsupportedRefAddressFound
+        status: "False"
         type: ResolvedRefs
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
       parentRef:
@@ -309,9 +310,10 @@ httpRoutes:
         status: "True"
         type: Accepted
       - lastTransitionTime: null
-        message: Resolved all the Object references for the Route
-        reason: ResolvedRefs
-        status: "True"
+        message: Invalid Backend reference to Backend default/backend-fqdn-localhost
+          found
+        reason: UnsupportedRefAddressFound
+        status: "False"
         type: ResolvedRefs
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
       parentRef:
@@ -413,11 +415,9 @@ xdsIR:
       - destination:
           name: httproute/default/httproute-4/rule/0
           settings:
-          - addressType: IP
-            endpoints:
-            - host: 127.0.0.1
-              port: 3001
-            weight: 1
+          - weight: 1
+        directResponse:
+          statusCode: 500
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -432,11 +432,9 @@ xdsIR:
       - destination:
           name: httproute/default/httproute-5/rule/0
           settings:
-          - addressType: FQDN
-            endpoints:
-            - host: localhost
-              port: 3001
-            weight: 1
+          - weight: 1
+        directResponse:
+          statusCode: 500
         hostname: '*'
         isHTTP2: false
         metadata:
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index bd74b7b64..4dc8b30f3 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -290,6 +290,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -353,6 +354,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -466,6 +468,7 @@ _Appears in:_
 | `targetRefs` | _[LocalPolicyTargetReferenceWithSectionName](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.LocalPolicyTargetReferenceWithSectionName) array_ |  true  | TargetRefs are the names of the Gateway resources this policy<br />is being attached to. |
 | `targetSelectors` | _[TargetSelector](#targetselector) array_ |  true  | TargetSelectors allow targeting resources for this policy based on labels |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
+| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -476,7 +479,6 @@ _Appears in:_
 | `http2` | _[HTTP2Settings](#http2settings)_ |  false  | HTTP2 provides HTTP/2 configuration for backend connections. |
 | `rateLimit` | _[RateLimitSpec](#ratelimitspec)_ |  false  | RateLimit allows the user to limit the number of incoming requests<br />to a predefined value based on attributes within the traffic flow. |
 | `faultInjection` | _[FaultInjection](#faultinjection)_ |  false  | FaultInjection defines the fault injection policy to be applied. This configuration can be used to<br />inject delays and abort requests to mimic failure scenarios such as service failures and overloads |
-| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `useClientProtocol` | _boolean_ |  false  | UseClientProtocol configures Envoy to prefer sending requests to backends using<br />the same HTTP protocol that the incoming request used. Defaults to false, which means<br />that Envoy will use the protocol indicated by the attached BackendRef. |
 
 
@@ -717,6 +719,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -724,6 +727,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
+| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -2567,6 +2571,9 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `issuer` | _string_ |  true  | The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).<br />Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST<br />be https, a host component, and optionally, port and path components and<br />no query or fragment components. |
 | `authorizationEndpoint` | _string_ |  false  | The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
 | `tokenEndpoint` | _string_ |  false  | The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
@@ -3310,20 +3317,6 @@ _Appears in:_
 | `File` | ResourceProviderTypeFile defines the "File" provider.<br /> | 
 
 
-#### Retry
-
-
-
-Retry defines the retry strategy to be applied.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `numRetries` | _integer_ |  false  | NumRetries is the number of retries to be attempted. Defaults to 2. |
-| `retryOn` | _[RetryOn](#retryon)_ |  false  | RetryOn specifies the retry trigger condition.<br /><br />If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503). |
-| `perRetry` | _[PerRetryPolicy](#perretrypolicy)_ |  false  | PerRetry is the retry policy to be applied per retry attempt. |
 
 
 #### RetryOn
diff --git a/site/content/zh/latest/api/extension_types.md b/site/content/zh/latest/api/extension_types.md
index bd74b7b64..4dc8b30f3 100644
--- a/site/content/zh/latest/api/extension_types.md
+++ b/site/content/zh/latest/api/extension_types.md
@@ -290,6 +290,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -353,6 +354,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -466,6 +468,7 @@ _Appears in:_
 | `targetRefs` | _[LocalPolicyTargetReferenceWithSectionName](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.LocalPolicyTargetReferenceWithSectionName) array_ |  true  | TargetRefs are the names of the Gateway resources this policy<br />is being attached to. |
 | `targetSelectors` | _[TargetSelector](#targetselector) array_ |  true  | TargetSelectors allow targeting resources for this policy based on labels |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
+| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -476,7 +479,6 @@ _Appears in:_
 | `http2` | _[HTTP2Settings](#http2settings)_ |  false  | HTTP2 provides HTTP/2 configuration for backend connections. |
 | `rateLimit` | _[RateLimitSpec](#ratelimitspec)_ |  false  | RateLimit allows the user to limit the number of incoming requests<br />to a predefined value based on attributes within the traffic flow. |
 | `faultInjection` | _[FaultInjection](#faultinjection)_ |  false  | FaultInjection defines the fault injection policy to be applied. This configuration can be used to<br />inject delays and abort requests to mimic failure scenarios such as service failures and overloads |
-| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `useClientProtocol` | _boolean_ |  false  | UseClientProtocol configures Envoy to prefer sending requests to backends using<br />the same HTTP protocol that the incoming request used. Defaults to false, which means<br />that Envoy will use the protocol indicated by the attached BackendRef. |
 
 
@@ -717,6 +719,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -724,6 +727,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
+| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -2567,6 +2571,9 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `issuer` | _string_ |  true  | The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).<br />Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST<br />be https, a host component, and optionally, port and path components and<br />no query or fragment components. |
 | `authorizationEndpoint` | _string_ |  false  | The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
 | `tokenEndpoint` | _string_ |  false  | The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
@@ -3310,20 +3317,6 @@ _Appears in:_
 | `File` | ResourceProviderTypeFile defines the "File" provider.<br /> | 
 
 
-#### Retry
-
-
-
-Retry defines the retry strategy to be applied.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `numRetries` | _integer_ |  false  | NumRetries is the number of retries to be attempted. Defaults to 2. |
-| `retryOn` | _[RetryOn](#retryon)_ |  false  | RetryOn specifies the retry trigger condition.<br /><br />If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503). |
-| `perRetry` | _[PerRetryPolicy](#perretrypolicy)_ |  false  | PerRetry is the retry policy to be applied per retry attempt. |
 
 
 #### RetryOn
diff --git a/tools/src/setup-envtest/go.mod b/tools/src/setup-envtest/go.mod
index 53668dc72..0c710903b 100644
--- a/tools/src/setup-envtest/go.mod
+++ b/tools/src/setup-envtest/go.mod
@@ -2,14 +2,15 @@ module local
 
 go 1.22.7
 
-require sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20240423173400-ed81fa696dea
+require sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20240813183042-b901db121e1f
 
 require (
-	github.com/go-logr/logr v1.2.4 // indirect
-	github.com/go-logr/zapr v1.2.4 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/spf13/afero v1.6.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	go.uber.org/multierr v1.10.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
-	golang.org/x/text v0.12.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )
diff --git a/tools/src/setup-envtest/go.sum b/tools/src/setup-envtest/go.sum
index 42182a05c..e0e71ae4e 100644
--- a/tools/src/setup-envtest/go.sum
+++ b/tools/src/setup-envtest/go.sum
@@ -1,29 +1,23 @@
-github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/zapr v1.2.4 h1:QHVo+6stLbfJmYGkQ7uGHUCu5hnAFAj6mDe6Ea0SeOo=
-github.com/go-logr/zapr v1.2.4/go.mod h1:FyHWQIzQORZ0QVE1BtVHv3cKtNLuXsbNLtpuhNapBOA=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
+github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 h1:yAJXTCF9TqKcTiHJAE8dj7HMvPfh66eeA2JYW7eFpSE=
-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
+github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/onsi/ginkgo/v2 v2.12.1 h1:uHNEO1RP2SpuZApSkel9nEh1/Mu+hmQe7Q+Pepg5OYA=
-github.com/onsi/ginkgo/v2 v2.12.1/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
-github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
-github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
+github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
+github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
+github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
+github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -32,66 +26,41 @@ github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
 go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
 go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
 go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
 go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
-golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
-golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
-golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20240423173400-ed81fa696dea h1:DHNmuXblCDcQ9DoxnUWcqsSeFneWU2SxvGUnOOqUcZE=
-sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20240423173400-ed81fa696dea/go.mod h1:B2xTzIWVko5xZLWDkXFS7Zo9hxX+ecdMzZ8oiTPJoRI=
+k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc=
+k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
+sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20240813183042-b901db121e1f h1:RIqUbZQO5yizUt9nozxQdzyLRD1sG6s2oi/QZrlg/hs=
+sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20240813183042-b901db121e1f/go.mod h1:IaDsO8xSPRxRG1/rm9CP7+jPmj0nMNAuNi/yiHnLX8k=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=