Repository: envoyproxy/gateway
Pull request #3719 (2024-07-01 04:17:17)

build(deps): bump github.com/docker/docker from 26.1.3+incompatible to 27.0.2+incompatible
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 26.1.3+incompatible to 27.0.2+incompatible.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p>
<blockquote>
<h2>v27.0.2</h2>
<h2>27.0.2</h2>
<p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p>
<ul>
<li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A27.0.2">docker/cli, 27.0.2 milestone</a></li>
<li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A27.0.2">moby/moby, 27.0.2 milestone</a></li>
<li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v27.0.2/docs/deprecated.md">Deprecated Features</a>.</li>
<li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v27.0.2/docs/api/version-history.md">API version history</a>.</li>
</ul>
<h3>Bug fixes and enhancements</h3>
<ul>
<li>Fix a regression that caused port numbers to be ignored when parsing a Docker registry URL. <a href="https://redirect.github.com/docker/cli/pull/5197">docker/cli#5197</a>, <a href="https://redirect.github.com/docker/cli/pull/5198">docker/cli#5198</a></li>
</ul>
<h3>Removed</h3>
<ul>
<li>api/types: deprecate <code>ContainerJSONBase.Node</code> field and <code>ContainerNode</code> type. These definitions were used by the standalone (&quot;classic&quot;) Swarm API, but never implemented in the Docker Engine itself. <a href="https://redirect.github.com/moby/moby/pull/48055">moby/moby#48055</a></li>
</ul>
<h2>v27.0.1</h2>
<h2>27.0.1</h2>
<p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p>
<ul>
<li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A27.0.0">docker/cli, 27.0.0 milestone</a></li>
<li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A27.0.0">moby/moby, 27.0.0 milestone</a></li>
<li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v27.0.1/docs/deprecated.md">Deprecated Features</a>.</li>
<li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v27.0.1/docs/api/version-history.md">API version history</a>.</li>
</ul>
<h3>New</h3>
<ul>
<li>containerd image store: Add <code>--platform</code> flag to <code>docker image push</code> and improve the default behavior when not all platforms of the multi-platform image are available locally. <a href="https://redirect.github.com/docker/cli/pull/4984">docker/cli#4984</a>, <a href="https://redirect.github.com/moby/moby/pull/47679">moby/moby#47679</a></li>
<li>Add support to <code>docker stack deploy</code> for <code>driver_opts</code> in a service's networks. <a href="https://redirect.github.com/docker/cli/pull/5125">docker/cli#5125</a></li>
<li>Consider additional <code>/usr/local/libexec</code> and <code>/usr/libexec</code> paths when looking up the userland proxy binaries by a name with a <code>docker-</code> prefix. <a href="https://redirect.github.com/moby/moby/pull/47804">moby/moby#47804</a></li>
</ul>
<h3>Bug fixes and enhancements</h3>
<ul>
<li><code>*client.Client</code> instances are now always safe for concurrent use by multiple goroutines. Previously, this could lead to data races when the <code>WithAPIVersionNegotiation()</code> option is used. <a href="https://redirect.github.com/moby/moby/pull/47961">moby/moby#47961</a></li>
<li>Fix a bug causing the Docker CLI to leak Unix sockets in <code>$TMPDIR</code> in some cases. <a href="https://redirect.github.com/docker/cli/pull/5146">docker/cli#5146</a></li>
<li>Don't ignore a custom seccomp profile when used in conjunction with <code>--privileged</code>. <a href="https://redirect.github.com/moby/moby/pull/47500">moby/moby#47500</a></li>
<li>rootless: overlay2: support native overlay diff when using rootless-mode with Linux kernel version 5.11 and later. <a href="https://redirect.github.com/moby/moby/pull/47605">moby/moby#47605</a></li>
<li>Fix the <code>StartInterval</code> default value of healthcheck to reflect the documented value of 5s. <a href="https://redirect.github.com/moby/moby/pull/47799">moby/moby#47799</a></li>
<li>Fix <code>docker save</code> and <code>docker load</code> not ending on the daemon side when the operation was cancelled by the user, for example with <!-- raw HTML omitted -->Ctrl+C<!-- raw HTML omitted -->. <a href="https://redirect.github.com/moby/moby/pull/47629">moby/moby#47629</a></li>
<li>The <code>StartedAt</code> property of containers is now recorded before container startup, guaranteeing that the <code>StartedAt</code> is always before <code>FinishedAt</code>. <a href="https://redirect.github.com/moby/moby/pull/47003">moby/moby#47003</a></li>
<li>The internal DNS resolver used by Windows containers on Windows now forwards requests to external DNS servers by default. This enables <code>nslookup</code> to resolve external hostnames. This behaviour can be disabled via <code>daemon.json</code>, using <code>&quot;features&quot;: { &quot;windows-dns-proxy&quot;: false }</code>. The configuration option will be removed in a future release. <a href="https://redirect.github.com/moby/moby/pull/47826">moby/moby#47826</a></li>
<li>Print a warning when the CLI does not have permissions to read the configuration file. <a href="https://redirect.github.com/docker/cli/pull/5077">docker/cli#5077</a></li>
<li>Fix a goroutine and file-descriptor leak on container attach. <a href="https://redirect.github.com/moby/moby/pull/45052">moby/moby#45052</a></li>
<li>Clear the networking state of all stopped or dead containers during daemon start-up. <a href="https://redirect.github.com/moby/moby/pull/47984">moby/moby#47984</a></li>
<li>Write volume options JSON atomically to avoid &quot;invalid JSON&quot; errors after system crash. <a href="https://redirect.github.com/moby/moby/pull/48034">moby/moby#48034</a></li>
<li>Allow multiple macvlan networks with the same parent. <a href="https://redirect.github.com/moby/moby/pull/47318">moby/moby#47318</a></li>
<li>Allow BuildKit to be used on Windows daemons that advertise it. <a href="https://redirect.github.com/docker/cli/pull/5178">docker/cli#5178</a></li>
</ul>
<h3>Networking</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/moby/moby/commit/e953d76450b64bd64b2374137b0580223a114fdb"><code>e953d76</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48060">#48060</a> from thaJeztah/27.0_backport_api_deprecate_Containe...</li>
<li><a href="https://github.com/moby/moby/commit/861fde8cc9740f42f1ca6078dc437539d9109b76"><code>861fde8</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48061">#48061</a> from thaJeztah/27_backport_bump_golangci_lint</li>
<li><a href="https://github.com/moby/moby/commit/355707786738b8d954d2ae58640e4b361a43cc5b"><code>3557077</code></a> update golangci-lint to v1.59.1</li>
<li><a href="https://github.com/moby/moby/commit/c95b917167bc153570ab27c71817bfecceed055d"><code>c95b917</code></a> pkg/archive: reformat code to make #nosec comment work again</li>
<li><a href="https://github.com/moby/moby/commit/c0ff08acbd97dc4dcc37d6377ccb75df92224ea9"><code>c0ff08a</code></a> builder/remotecontext: reformat code to make #nosec comment work again</li>
<li><a href="https://github.com/moby/moby/commit/45876882585554409191c2f3b4089ec8cdee8ed0"><code>4587688</code></a> api/types: deprecate ContainerJSONBase.Node, ContainerNode</li>
<li><a href="https://github.com/moby/moby/commit/ff1e2c0de72a1bbbe4cdbe1558da57d327899df5"><code>ff1e2c0</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48050">#48050</a> from thaJeztah/deprecate_graphdriver_plugins</li>
<li><a href="https://github.com/moby/moby/commit/6da604aa6a74ab770207932b3cbc3d009c3ae25f"><code>6da604a</code></a> deprecate experimental Graphdriver plugins, and disable by default</li>
<li><a href="https://github.com/moby/moby/commit/81b202797920d5b52ffd960f344f62cb25ebab71"><code>81b2027</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48049">#48049</a> from thaJeztah/fix_swagger_tmpfsopts</li>
<li><a href="https://github.com/moby/moby/commit/97f6a9d005fa3389ae2cea198fa2f4c850876a95"><code>97f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48045">#48045</a> from thaJeztah/bump_ttrpc_1.2.5</li>
<li>Additional commits viewable in <a href="https://github.com/docker/docker/compare/v26.1.3...v27.0.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/docker/docker&package-manager=go_modules&previous-version=26.1.3+incompatible&new-version=27.0.2+incompatible)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/envoyproxy/gateway/pull/3719?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 68.84%. Comparing base [(`4a74e60`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/4a74e608fffe59b3a20f6e7160dfa17b13289677?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) to head [(`a1a51e1`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/a1a51e116028438f4d3f46e89143561418831bec?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #3719      +/-   ##
==========================================
+ Coverage   68.81%   68.84%   +0.03%     
==========================================
  Files         175      175              
  Lines       21525    21525              
==========================================
+ Hits        14812    14819       +7     
+ Misses       5636     5629       -7     
  Partials     1077     1077              
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/envoyproxy/gateway/pull/3719?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).


Patch:
diff --git a/.github/workflows/benchmark.yaml b/.github/workflows/benchmark.yaml
deleted file mode 100644
index 9f87ca4cb..000000000
--- a/.github/workflows/benchmark.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: Benchmarking Tests at Scale
-on:
-  pull_request:
-    branches:
-      - "main"
-      - "release/v*"
-  workflow_dispatch:
-    inputs:
-      rps:
-        description: "The target requests-per-second rate. Default: 10000"
-        default: '10000'
-        type: string
-        required: false
-      connections:
-        description: "The maximum allowed number of concurrent connections per event loop. HTTP/1 only. Default: 100."
-        default: '100'
-        type: string
-        required: false
-      duration:
-        description: "The number of seconds that the test should run. Default: 90."
-        default: '90'
-        type: string
-        required: false
-      cpu_limits:
-        description: "The CPU resource limits for the envoy gateway, in unit 'm'. Default: 1000."
-        default: '1000'
-        type: string
-        required: false
-      memory_limits:
-        description: "The memory resource limits for the envoy gateway, in unit 'Mi'. Default: 1024."
-        default: '1024'
-        type: string
-        required: false
-
-jobs:
-  benchmark-test:
-    name: Benchmark Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - uses: ./tools/github-actions/setup-deps
-
-      - name: Run Benchmark tests
-        env:
-          KIND_NODE_TAG: v1.28.0
-          IMAGE_PULL_POLICY: IfNotPresent
-          BENCHMARK_RPS: ${{ github.event.inputs.rps || 10000 }}
-          BENCHMARK_CONNECTIONS: ${{ github.event.inputs.connections || 100 }}
-          BENCHMARK_DURATION: ${{ github.event.inputs.duration || 90 }}
-          BENCHMARK_CPU_LIMITS: ${{ github.event.inputs.cpu_limits || 1000 }}
-          BENCHMARK_MEMORY_LIMITS: ${{ github.event.inputs.memory_limits || 2048 }}
-        run: make benchmark
-
-      - name: Read Benchmark report
-        run: cat test/benchmark/benchmark_report.md
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 5035275d1..da76ee7ae 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@23acc5c183826b7a8a97bce3cecc52db901f8251  # v3.25.10
+      uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c  # v3.25.11
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@23acc5c183826b7a8a97bce3cecc52db901f8251  # v3.25.10
+      uses: github/codeql-action/autobuild@b611370bb5703a7efb587f9d136a52ea24c5c38c  # v3.25.11
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@23acc5c183826b7a8a97bce3cecc52db901f8251  # v3.25.10
+      uses: github/codeql-action/analyze@b611370bb5703a7efb587f9d136a52ea24c5c38c  # v3.25.11
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/license-scan.yml b/.github/workflows/license-scan.yml
index b90f3a053..d4ecceec1 100644
--- a/.github/workflows/license-scan.yml
+++ b/.github/workflows/license-scan.yml
@@ -18,7 +18,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
     - name: Run scanner
-      uses: google/osv-scanner-action/osv-scanner-action@ba0b4d196d231340e0ae94ae00933c8be0984192  # v1.7.4
+      uses: google/osv-scanner-action/osv-scanner-action@3c399db9dd6dd8106a27d280d53c55077d3f7cea  # v1.8.1
       with:
         scan-args: |-
           --skip-git
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index cfee87bd5..63f546be8 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -16,7 +16,7 @@ on:
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@ba0b4d196d231340e0ae94ae00933c8be0984192"  # v1.7.4
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@3c399db9dd6dd8106a27d280d53c55077d3f7cea"  # v1.8.1
     permissions:
       actions: read
       contents: read
@@ -24,7 +24,7 @@ jobs:
       security-events: write
   scan-pr:
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@ba0b4d196d231340e0ae94ae00933c8be0984192"  # v1.7.4
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@3c399db9dd6dd8106a27d280d53c55077d3f7cea"  # v1.8.1
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index fe20eff3c..03b7272a1 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@23acc5c183826b7a8a97bce3cecc52db901f8251  # v3.25.10
+      uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c  # v3.25.11
       with:
         sarif_file: results.sarif
diff --git a/go.mod b/go.mod
index b65d90750..eac471fea 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.2.1
 	github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
-	github.com/docker/cli v26.1.3+incompatible
+	github.com/docker/cli v27.0.2+incompatible
 	github.com/dominikbraun/graph v0.23.0
 	github.com/envoyproxy/go-control-plane v0.12.1-0.20240612043845-c54ec4ce422d
 	github.com/envoyproxy/ratelimit v1.4.1-0.20230427142404-e2a87f41d3a7
@@ -23,7 +23,7 @@ require (
 	github.com/golang/protobuf v1.5.4
 	github.com/google/cel-go v0.20.1
 	github.com/google/go-cmp v0.6.0
-	github.com/google/go-containerregistry v0.19.1
+	github.com/google/go-containerregistry v0.19.2
 	github.com/grafana/tempo v1.5.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/miekg/dns v1.1.61
@@ -62,7 +62,7 @@ require (
 	sigs.k8s.io/yaml v1.4.0
 )
 
-require github.com/docker/docker v26.1.3+incompatible
+require github.com/docker/docker v27.0.2+incompatible
 
 require (
 	cel.dev/expr v0.15.0 // indirect
diff --git a/go.sum b/go.sum
index 8bc7d41c3..3b8f46b48 100644
--- a/go.sum
+++ b/go.sum
@@ -150,13 +150,13 @@ github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2 h1:aB
 github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v26.1.3+incompatible h1:bUpXT/N0kDE3VUHI2r5VMsYQgi38kYuoC0oL9yt3lqc=
-github.com/docker/cli v26.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v27.0.2+incompatible h1:IgWU3lWqAYNibtcxgl/PY4TB0eCmK1ZpNUZVJfenDQs=
+github.com/docker/cli v27.0.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v26.1.3+incompatible h1:lLCzRbrVZrljpVNobJu1J2FHk8V0s4BawoZippkc+xo=
-github.com/docker/docker v26.1.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.0.2+incompatible h1:mNhCtgXNV1fIRns102grG7rdzIsGGCq1OlOD0KunZos=
+github.com/docker/docker v27.0.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -335,8 +335,8 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-containerregistry v0.19.1 h1:yMQ62Al6/V0Z7CqIrrS1iYoA5/oQCm88DeNujc7C1KY=
-github.com/google/go-containerregistry v0.19.1/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
+github.com/google/go-containerregistry v0.19.2 h1:TannFKE1QSajsP6hPWb5oJNgKe1IKjHukIKDUmvsV6w=
+github.com/google/go-containerregistry v0.19.2/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
diff --git a/internal/gatewayapi/envoyextensionpolicy.go b/internal/gatewayapi/envoyextensionpolicy.go
index af7904ec3..5baecbcb5 100644
--- a/internal/gatewayapi/envoyextensionpolicy.go
+++ b/internal/gatewayapi/envoyextensionpolicy.go
@@ -430,7 +430,7 @@ func (t *Translator) buildExtProcs(policy *egv1a1.EnvoyExtensionPolicy, resource
 	}
 
 	for idx, ep := range policy.Spec.ExtProc {
-		name := irConfigNameForEEP(policy, idx)
+		name := irConfigNameForExtProc(policy, idx)
 		extProcIR, err := t.buildExtProc(name, utils.NamespacedName(policy), ep, idx, resources, envoyProxy)
 		if err != nil {
 			return nil, err
@@ -534,12 +534,11 @@ func (t *Translator) buildExtProc(
 	return extProcIR, err
 }
 
-func irConfigNameForEEP(policy *egv1a1.EnvoyExtensionPolicy, idx int) string {
+func irConfigNameForExtProc(policy *egv1a1.EnvoyExtensionPolicy, index int) string {
 	return fmt.Sprintf(
-		"%s/%s/%d",
-		strings.ToLower(egv1a1.KindEnvoyExtensionPolicy),
-		utils.NamespacedName(policy).String(),
-		idx)
+		"%s/extproc/%s",
+		irConfigName(policy),
+		strconv.Itoa(index))
 }
 
 func (t *Translator) buildWasms(


Test patch:
diff --git a/.github/workflows/build_and_test.yaml b/.github/workflows/build_and_test.yaml
index 72a03539a..f7079180f 100644
--- a/.github/workflows/build_and_test.yaml
+++ b/.github/workflows/build_and_test.yaml
@@ -135,6 +135,29 @@ jobs:
         IMAGE_PULL_POLICY: IfNotPresent
       run: make e2e
 
+  benchmark-test:
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: ./tools/github-actions/setup-deps
+
+    # Benchmark
+    - name: Run Benchmark tests
+      env:
+        KIND_NODE_TAG: v1.28.9
+        IMAGE_PULL_POLICY: IfNotPresent
+        # Args for benchmark test
+        BENCHMARK_RPS: 10000
+        BENCHMARK_CONNECTIONS: 100
+        BENCHMARK_DURATION: 30
+        BENCHMARK_CPU_LIMITS: 1000
+        BENCHMARK_MEMORY_LIMITS: 2000
+      run: make benchmark
+
+    - name: Read Benchmark report
+      run: cat test/benchmark/benchmark_report.md
+
   publish:
     runs-on: ubuntu-latest
     needs: [conformance-test, e2e-test]
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
index 76a40d590..295ca972e 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
@@ -230,7 +230,7 @@ xdsIR:
             settings:
             - protocol: GRPC
               weight: 1
-          name: envoyextensionpolicy/default/policy-for-route-1/0
+          name: envoyextensionpolicy/default/policy-for-route-1/extproc/0
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
@@ -254,7 +254,7 @@ xdsIR:
             settings:
             - protocol: GRPC
               weight: 1
-          name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
+          name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/extproc/0
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
index c5accb662..4be44031a 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
@@ -315,7 +315,7 @@ xdsIR:
                   name: policy-btls-grpc-2/default-ca
                 sni: grpc-backend-2
               weight: 1
-          name: envoyextensionpolicy/default/policy-for-http-route/0
+          name: envoyextensionpolicy/default/policy-for-http-route/extproc/0
           requestHeaderProcessing: true
           responseHeaderProcessing: true
         hostname: www.foo.com
@@ -349,7 +349,7 @@ xdsIR:
               weight: 1
           failOpen: true
           messageTimeout: 5s
-          name: envoyextensionpolicy/default/policy-for-gateway/0
+          name: envoyextensionpolicy/default/policy-for-gateway/extproc/0
           requestBodyProcessingMode: Buffered
           requestHeaderProcessing: true
           responseBodyProcessingMode: Streamed
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
index dcc1e7522..800cafff0 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
@@ -335,7 +335,7 @@ xdsIR:
                   name: policy-btls-backend-ip/envoy-gateway-ca
                 sni: ip-backend
               weight: 1
-          name: envoyextensionpolicy/default/policy-for-http-route/0
+          name: envoyextensionpolicy/default/policy-for-http-route/extproc/0
         hostname: www.foo.com
         isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.in.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.in.yaml
index dd96ed4b0..38d1e20e0 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.in.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.in.yaml
@@ -10,7 +10,7 @@ envoyProxyForGatewayClass:
         settings:
         - matches:
           - "response.code >= 400"
-          - ")++++" # invalid CEL expression will be ignored
+          - ")++++"
           format:
             type: Text
             text: |
diff --git a/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml b/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml
index 64773de0a..8209c2947 100644
--- a/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml
@@ -19,7 +19,7 @@ http:
               protocol: HTTP
               weight: 1
         extProc:
-          - name: envoyextensionpolicy/default/policy-for-route-2/0
+          - name: envoyextensionpolicy/default/policy-for-route-2/extproc/0
             failOpen: true
             messageTimeout: 5s
             requestHeaderProcessing: true
@@ -31,7 +31,7 @@ http:
               settings:
                 - protocol: GRPC
                   weight: 1
-          - name: envoyextensionpolicy/default/policy-for-route-1/0
+          - name: envoyextensionpolicy/default/policy-for-route-1/extproc/0
             failOpen: true
             messageTimeout: 5s
             responseHeaderProcessing: true
@@ -59,14 +59,14 @@ http:
               protocol: HTTP
               weight: 1
         extProc:
-          - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0
+          - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/extproc/0
             authority: grpc-backend-3.envoy-gateway:3000
             destination:
               name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
               settings:
                 - protocol: GRPC
                   weight: 1
-          - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
+          - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/extproc/0
             failOpen: false
             messageTimeout: 15s
             authority: grpc-backend.envoy-gateway:9000
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml
index eed8c83a0..8e85e79cf 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml
@@ -15,7 +15,7 @@
           maxConcurrentStreams: 100
         httpFilters:
         - disabled: true
-          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-2/0
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-2/extproc/0
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
             failureModeAllow: true
@@ -33,7 +33,7 @@
               responseHeaderMode: SKIP
               responseTrailerMode: SKIP
         - disabled: true
-          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-1/0
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-1/extproc/0
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
             failureModeAllow: true
@@ -50,7 +50,7 @@
               responseHeaderMode: SEND
               responseTrailerMode: SKIP
         - disabled: true
-          name: envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/extproc/0
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
             grpcService:
@@ -64,7 +64,7 @@
               responseHeaderMode: SKIP
               responseTrailerMode: SKIP
         - disabled: true
-          name: envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/extproc/0
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
             grpcService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml
index 0daf1919c..c17e6456d 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml
@@ -13,10 +13,10 @@
         upgradeConfigs:
         - upgradeType: websocket
       typedPerFilterConfig:
-        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-1/0:
+        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-1/extproc/0:
           '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
           config: {}
-        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-2/0:
+        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-2/extproc/0:
           '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
           config: {}
     - match:
@@ -27,9 +27,9 @@
         upgradeConfigs:
         - upgradeType: websocket
       typedPerFilterConfig:
-        envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0:
+        envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/extproc/0:
           '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
           config: {}
-        envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0:
+        envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/extproc/0:
           '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
           config: {}