Repository: envoyproxy/gateway
Pull request #4048 (2024-08-14 14:08:53)

chore: replace `targetRef` with `targetRefs` in doc
**What type of PR is this?**
<!--
Your PR title should be descriptive, and generally start with type that contains a subsystem name with `()` if necessary 
and summary followed by a colon. format `chore/docs/api/feat/fix/refactor/style/test: summary`.
Examples:
* "docs: fix grammar error"
* "feat(translator): add new feature"
* "fix: fix xx bug"
* "chore: change ci & build tools etc"
* "api: add xxx fields in ClientTrafficPolicy"
-->

<!--
NOTE: If your PR contains any API changes (changes under `/api`), we recommend you to separate these API changes into
a new PR, and we will review the API part first. It will save you lots of implementation time if the API get accepted.
-->

**What this PR does / why we need it**:

**Which issue(s) this PR fixes**:
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
-->
Fixes #


codecov[bot]: ## [Codecov](https://app.codecov.io/gh/envoyproxy/gateway/pull/4048?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 67.79%. Comparing base [(`7078a03`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/7078a03f1d480de738a327bfc8d8ff7ba345904c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) to head [(`19d400c`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/19d400cd002f8b8b186752eec2a9fa7d0684706a?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #4048      +/-   ##
==========================================
+ Coverage   67.75%   67.79%   +0.03%     
==========================================
  Files         187      187              
  Lines       22891    22891              
==========================================
+ Hits        15509    15518       +9     
+ Misses       6272     6264       -8     
+ Partials     1110     1109       -1     
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/envoyproxy/gateway/pull/4048?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

arkodg: thanks @shawnh2 !
can you also update `docs/` and `v1.1/` :) 

Patch:
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c7a5bee84..938a0fa2c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,26 +6,24 @@
 version: 2
 updates:
   - package-ecosystem: docker
-    directory: /tools/docker/envoy-gateway/
-    schedule:
-      interval: weekly
-  - package-ecosystem: docker
-    directory: /site
+    directories:
+      - /tools/docker/envoy-gateway/
+      - /site
     schedule:
       interval: weekly
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - /
+      - /tools/github-actions/setup-deps
     schedule:
       interval: weekly
     ignore:
       # skip to update retest, because it won't work with the latest version
       - dependency-name: "envoyproxy/toolshed/gh-actions/retest"
-  - package-ecosystem: github-actions
-    directory: /tools/github-actions/setup-deps
-    schedule:
-      interval: weekly
   - package-ecosystem: gomod
-    directory: /
+    directories:
+      - "/"
+      - "examples/extension-server"
     schedule:
       interval: weekly
     groups:
@@ -35,35 +33,22 @@ updates:
       go.opentelemetry.io:
         patterns:
           - "go.opentelemetry.io/*"
+      golang.org:
+        patterns:
+          - "golang.org/*"
   - package-ecosystem: pip
-    directory: /tools/src/codespell
-    schedule:
-      interval: weekly
-  - package-ecosystem: gomod
-    directory: /tools/src/helm-docs
-    schedule:
-      interval: weekly
-  - package-ecosystem: gomod
-    directory: /tools/src/buf
+    directories:
+      - /tools/src/codespell
+      - /tools/src/sphinx-build
+      - /tools/src/yamllint
     schedule:
       interval: weekly
   - package-ecosystem: gomod
-    directory: /tools/src/golangci-lint
-    schedule:
-      interval: weekly
-  - package-ecosystem: gomod
-    directory: /tools/src/kind
-    schedule:
-      interval: weekly
-  - package-ecosystem: gomod
-    directory: /tools/src/setup-envtest
-    schedule:
-      interval: weekly
-  - package-ecosystem: pip
-    directory: /tools/src/sphinx-build
-    schedule:
-      interval: weekly
-  - package-ecosystem: pip
-    directory: /tools/src/yamllint
+    directories:
+      - /tools/src/helm-docs
+      - /tools/src/buf
+      - /tools/src/golangci-lint
+      - /tools/src/kind
+      - /tools/src/setup-envtest
     schedule:
       interval: weekly
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7cb7462e0..5cde7a2c5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa  # v3.26.0
+      uses: github/codeql-action/init@429e1977040da7a23b6822b13c129cd1ba93dbb2  # v3.26.2
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa  # v3.26.0
+      uses: github/codeql-action/autobuild@429e1977040da7a23b6822b13c129cd1ba93dbb2  # v3.26.2
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa  # v3.26.0
+      uses: github/codeql-action/analyze@429e1977040da7a23b6822b13c129cd1ba93dbb2  # v3.26.2
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 2af996a99..5cb58c153 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa  # v3.26.0
+      uses: github/codeql-action/upload-sarif@429e1977040da7a23b6822b13c129cd1ba93dbb2  # v3.26.2
       with:
         sarif_file: results.sarif
diff --git a/api/v1alpha1/clienttrafficpolicy_types.go b/api/v1alpha1/clienttrafficpolicy_types.go
index 347eb9463..63b2c91fb 100644
--- a/api/v1alpha1/clienttrafficpolicy_types.go
+++ b/api/v1alpha1/clienttrafficpolicy_types.go
@@ -7,6 +7,7 @@ package v1alpha1
 
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 )
 
@@ -134,6 +135,12 @@ type HeaderSettings struct {
 	//
 	// +optional
 	PreserveXRequestID *bool `json:"preserveXRequestID,omitempty"`
+
+	// EarlyRequestHeaders defines settings for early request header modification, before envoy performs
+	// routing, tracing and built-in header manipulation.
+	//
+	// +optional
+	EarlyRequestHeaders *gwapiv1.HTTPHeaderFilter `json:"earlyRequestHeaders,omitempty"`
 }
 
 // WithUnderscoresAction configures the action to take when an HTTP header with underscores
diff --git a/api/v1alpha1/shared_types.go b/api/v1alpha1/shared_types.go
index 89aef19c3..c24db0ee5 100644
--- a/api/v1alpha1/shared_types.go
+++ b/api/v1alpha1/shared_types.go
@@ -483,6 +483,7 @@ type BackendCluster struct {
 	// backend server to which the authorization request will be sent.
 	//
 	// Deprecated: Use BackendRefs instead.
+	// +optional
 	BackendRef *gwapiv1.BackendObjectReference `json:"backendRef,omitempty"`
 
 	// BackendRefs references a Kubernetes object that represents the
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 79c8e98a5..62fa950a3 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -2714,6 +2714,11 @@ func (in *HeaderSettings) DeepCopyInto(out *HeaderSettings) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.EarlyRequestHeaders != nil {
+		in, out := &in.EarlyRequestHeaders, &out.EarlyRequestHeaders
+		*out = new(apisv1.HTTPHeaderFilter)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HeaderSettings.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
index 0dd5ac6a9..5483ff78e 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
@@ -159,6 +159,148 @@ spec:
                       DisableRateLimitHeaders configures Envoy Proxy to omit the "X-RateLimit-" response headers
                       when rate limiting is enabled.
                     type: boolean
+                  earlyRequestHeaders:
+                    description: |-
+                      EarlyRequestHeaders defines settings for early request header modification, before envoy performs
+                      routing, tracing and built-in header manipulation.
+                    properties:
+                      add:
+                        description: |-
+                          Add adds the given header(s) (name, value) to the request
+                          before the action. It appends to any existing values associated
+                          with the header name.
+
+
+                          Input:
+                            GET /foo HTTP/1.1
+                            my-header: foo
+
+
+                          Config:
+                            add:
+                            - name: "my-header"
+                              value: "bar,baz"
+
+
+                          Output:
+                            GET /foo HTTP/1.1
+                            my-header: foo,bar,baz
+                        items:
+                          description: HTTPHeader represents an HTTP Header name and
+                            value as defined by RFC 7230.
+                          properties:
+                            name:
+                              description: |-
+                                Name is the name of the HTTP Header to be matched. Name matching MUST be
+                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+
+
+                                If multiple entries specify equivalent header names, the first entry with
+                                an equivalent name MUST be considered for a match. Subsequent entries
+                                with an equivalent header name MUST be ignored. Due to the
+                                case-insensitivity of header names, "foo" and "Foo" are considered
+                                equivalent.
+                              maxLength: 256
+                              minLength: 1
+                              pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                              type: string
+                            value:
+                              description: Value is the value of HTTP Header to be
+                                matched.
+                              maxLength: 4096
+                              minLength: 1
+                              type: string
+                          required:
+                          - name
+                          - value
+                          type: object
+                        maxItems: 16
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      remove:
+                        description: |-
+                          Remove the given header(s) from the HTTP request before the action. The
+                          value of Remove is a list of HTTP header names. Note that the header
+                          names are case-insensitive (see
+                          https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
+
+
+                          Input:
+                            GET /foo HTTP/1.1
+                            my-header1: foo
+                            my-header2: bar
+                            my-header3: baz
+
+
+                          Config:
+                            remove: ["my-header1", "my-header3"]
+
+
+                          Output:
+                            GET /foo HTTP/1.1
+                            my-header2: bar
+                        items:
+                          type: string
+                        maxItems: 16
+                        type: array
+                        x-kubernetes-list-type: set
+                      set:
+                        description: |-
+                          Set overwrites the request with the given header (name, value)
+                          before the action.
+
+
+                          Input:
+                            GET /foo HTTP/1.1
+                            my-header: foo
+
+
+                          Config:
+                            set:
+                            - name: "my-header"
+                              value: "bar"
+
+
+                          Output:
+                            GET /foo HTTP/1.1
+                            my-header: bar
+                        items:
+                          description: HTTPHeader represents an HTTP Header name and
+                            value as defined by RFC 7230.
+                          properties:
+                            name:
+                              description: |-
+                                Name is the name of the HTTP Header to be matched. Name matching MUST be
+                                case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+
+
+                                If multiple entries specify equivalent header names, the first entry with
+                                an equivalent name MUST be considered for a match. Subsequent entries
+                                with an equivalent header name MUST be ignored. Due to the
+                                case-insensitivity of header names, "foo" and "Foo" are considered
+                                equivalent.
+                              maxLength: 256
+                              minLength: 1
+                              pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                              type: string
+                            value:
+                              description: Value is the value of HTTP Header to be
+                                matched.
+                              maxLength: 4096
+                              minLength: 1
+                              type: string
+                          required:
+                          - name
+                          - value
+                          type: object
+                        maxItems: 16
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                    type: object
                   enableEnvoyHeaders:
                     description: |-
                       EnableEnvoyHeaders configures Envoy Proxy to add the "X-Envoy-" headers to requests
diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go
index c1877ffa6..44d813c25 100644
--- a/internal/gatewayapi/clienttrafficpolicy.go
+++ b/internal/gatewayapi/clienttrafficpolicy.go
@@ -18,6 +18,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
@@ -432,7 +433,10 @@ func (t *Translator) translateClientTrafficPolicyForListener(policy *egv1a1.Clie
 		translateClientIPDetection(policy.Spec.ClientIPDetection, httpIR)
 
 		// Translate Header Settings
-		translateListenerHeaderSettings(policy.Spec.Headers, httpIR)
+		if err = translateListenerHeaderSettings(policy.Spec.Headers, httpIR); err != nil {
+			err = perr.WithMessage(err, "Headers")
+			errs = errors.Join(errs, err)
+		}
 
 		// Translate Path Settings
 		translatePathSettings(policy.Spec.Path, httpIR)
@@ -613,9 +617,9 @@ func translateClientIPDetection(clientIPDetection *egv1a1.ClientIPDetectionSetti
 	httpIR.ClientIPDetection = (*ir.ClientIPDetectionSettings)(clientIPDetection)
 }
 
-func translateListenerHeaderSettings(headerSettings *egv1a1.HeaderSettings, httpIR *ir.HTTPListener) {
+func translateListenerHeaderSettings(headerSettings *egv1a1.HeaderSettings, httpIR *ir.HTTPListener) error {
 	if headerSettings == nil {
-		return
+		return nil
 	}
 	httpIR.Headers = &ir.HeaderSettings{
 		EnableEnvoyHeaders:      ptr.Deref(headerSettings.EnableEnvoyHeaders, false),
@@ -634,6 +638,16 @@ func translateListenerHeaderSettings(headerSettings *egv1a1.HeaderSettings, http
 			httpIR.Headers.XForwardedClientCert.CertDetailsToAdd = headerSettings.XForwardedClientCert.CertDetailsToAdd
 		}
 	}
+
+	if headerSettings.EarlyRequestHeaders != nil {
+		headersToAdd, headersToRemove, err := translateEarlyRequestHeaders(headerSettings.EarlyRequestHeaders)
+		if err != nil {
+			return err
+		}
+		httpIR.Headers.EarlyAddRequestHeaders = headersToAdd
+		httpIR.Headers.EarlyRemoveRequestHeaders = headersToRemove
+	}
+	return nil
 }
 
 func translateHTTP1Settings(http1Settings *egv1a1.HTTP1Settings, httpIR *ir.HTTPListener) error {
@@ -869,3 +883,130 @@ func buildConnection(connection *egv1a1.ClientConnection) (*ir.ClientConnection,
 
 	return irConnection, nil
 }
+
+func translateEarlyRequestHeaders(headerModifier *gwapiv1.HTTPHeaderFilter) ([]ir.AddHeader, []string, error) {
+	// Make sure the header modifier config actually exists
+	if headerModifier == nil {
+		return nil, nil, nil
+	}
+	var errs error
+	emptyFilterConfig := true // keep track of whether the provided config is empty or not
+
+	var AddRequestHeaders []ir.AddHeader
+	var RemoveRequestHeaders []string
+
+	// Add request headers
+	if headersToAdd := headerModifier.Add; headersToAdd != nil {
+		if len(headersToAdd) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, addHeader := range headersToAdd {
+			emptyFilterConfig = false
+			if addHeader.Name == "" {
+				errs = errors.Join(errs, fmt.Errorf("EarlyRequestHeaders cannot add a header with an empty name"))
+				// try to process the rest of the headers and produce a valid config.
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.ContainsAny(string(addHeader.Name), "/:") {
+				errs = errors.Join(errs, fmt.Errorf("EarlyRequestHeaders Filter cannot set headers with a '/' or ':' character in them. Header: %q", string(addHeader.Name)))
+				continue
+			}
+			// Check if the header is a duplicate
+			headerKey := string(addHeader.Name)
+			canAddHeader := true
+			for _, h := range AddRequestHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+
+			if !canAddHeader {
+				continue
+			}
+
+			newHeader := ir.AddHeader{
+				Name:   headerKey,
+				Append: true,
+				Value:  strings.Split(addHeader.Value, ","),
+			}
+
+			AddRequestHeaders = append(AddRequestHeaders, newHeader)
+		}
+	}
+
+	// Set headers
+	if headersToSet := headerModifier.Set; headersToSet != nil {
+		if len(headersToSet) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, setHeader := range headersToSet {
+
+			if setHeader.Name == "" {
+				errs = errors.Join(errs, fmt.Errorf("EarlyRequestHeaders cannot set a header with an empty name"))
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.ContainsAny(string(setHeader.Name), "/:") {
+				errs = errors.Join(errs, fmt.Errorf("EarlyRequestHeaders cannot set headers with a '/' or ':' character in them. Header: '%s'", string(setHeader.Name)))
+				continue
+			}
+
+			// Check if the header to be set has already been configured
+			headerKey := string(setHeader.Name)
+			canAddHeader := true
+			for _, h := range AddRequestHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+			if !canAddHeader {
+				continue
+			}
+			newHeader := ir.AddHeader{
+				Name:   string(setHeader.Name),
+				Append: false,
+				Value:  strings.Split(setHeader.Value, ","),
+			}
+
+			AddRequestHeaders = append(AddRequestHeaders, newHeader)
+		}
+	}
+
+	// Remove request headers
+	// As far as Envoy is concerned, it is ok to configure a header to be added/set and also in the list of
+	// headers to remove. It will remove the original header if present and then add/set the header after.
+	if headersToRemove := headerModifier.Remove; headersToRemove != nil {
+		if len(headersToRemove) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, removedHeader := range headersToRemove {
+			if removedHeader == "" {
+				errs = errors.Join(errs, fmt.Errorf("EarlyRequestHeaders cannot remove a header with an empty name"))
+				continue
+			}
+
+			canRemHeader := true
+			for _, h := range RemoveRequestHeaders {
+				if strings.EqualFold(h, removedHeader) {
+					canRemHeader = false
+					break
+				}
+			}
+			if !canRemHeader {
+				continue
+			}
+
+			RemoveRequestHeaders = append(RemoveRequestHeaders, removedHeader)
+		}
+	}
+
+	// Update the status if the filter failed to configure any valid headers to add/remove
+	if len(AddRequestHeaders) == 0 && len(RemoveRequestHeaders) == 0 && !emptyFilterConfig {
+		errs = errors.Join(errs, fmt.Errorf("EarlyRequestHeaders did not provide valid configuration to add/set/remove any headers"))
+	}
+
+	return AddRequestHeaders, RemoveRequestHeaders, errs
+}
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index 56c1bef09..821d4bd1c 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -494,6 +494,12 @@ type HeaderSettings struct {
 	// (Edge request is the request from external clients to front Envoy) and not reset it, which is the current Envoy behaviour.
 	// It defaults to false.
 	PreserveXRequestID bool `json:"preserveXRequestID,omitempty" yaml:"preserveXRequestID,omitempty"`
+
+	// EarlyAddRequestHeaders defines headers that would be added before envoy request processing.
+	EarlyAddRequestHeaders []AddHeader `json:"earlyAddRequestHeaders,omitempty" yaml:"earlyAddRequestHeaders,omitempty"`
+
+	// EarlyRemoveRequestHeaders defines headers that would be removed before envoy request processing.
+	EarlyRemoveRequestHeaders []string `json:"earlyRemoveRequestHeaders,omitempty" yaml:"earlyRemoveRequestHeaders,omitempty"`
 }
 
 // ClientTimeout sets the timeout configuration for downstream connections
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index 5f8f879e6..d38cd3b82 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -1481,6 +1481,18 @@ func (in *HeaderSettings) DeepCopyInto(out *HeaderSettings) {
 		*out = new(XForwardedClientCert)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.EarlyAddRequestHeaders != nil {
+		in, out := &in.EarlyAddRequestHeaders, &out.EarlyAddRequestHeaders
+		*out = make([]AddHeader, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.EarlyRemoveRequestHeaders != nil {
+		in, out := &in.EarlyRemoveRequestHeaders, &out.EarlyRemoveRequestHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HeaderSettings.
diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go
index 0812010ad..9b442c751 100644
--- a/internal/xds/translator/listener.go
+++ b/internal/xds/translator/listener.go
@@ -12,6 +12,7 @@ import (
 
 	xdscore "github.com/cncf/xds/go/xds/core/v3"
 	matcher "github.com/cncf/xds/go/xds/type/matcher/v3"
+	mutation_rulesv3 "github.com/envoyproxy/go-control-plane/envoy/config/common/mutation_rules/v3"
 	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
 	tls_inspectorv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/tls_inspector/v3"
@@ -19,6 +20,7 @@ import (
 	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
 	tcpv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/tcp_proxy/v3"
 	udpv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/udp/udp_proxy/v3"
+	early_header_mutationv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/http/early_header_mutation/header_mutation/v3"
 	preservecasev3 "github.com/envoyproxy/go-control-plane/envoy/extensions/http/header_formatters/preserve_case/v3"
 	customheaderv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/http/original_ip_detection/custom_header/v3"
 	quicv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/quic/v3"
@@ -274,9 +276,10 @@ func (t *Translator) addHCMToXDSListener(xdsListener *listenerv3.Listener, irLis
 		CommonHttpProtocolOptions: &corev3.HttpProtocolOptions{
 			HeadersWithUnderscoresAction: buildHeadersWithUnderscoresAction(irListener.Headers),
 		},
-		Tracing:                   hcmTracing,
-		ForwardClientCertDetails:  buildForwardClientCertDetailsAction(irListener.Headers),
-		PreserveExternalRequestId: ptr.Deref(irListener.Headers, ir.HeaderSettings{}).PreserveXRequestID,
+		Tracing:                       hcmTracing,
+		ForwardClientCertDetails:      buildForwardClientCertDetailsAction(irListener.Headers),
+		PreserveExternalRequestId:     ptr.Deref(irListener.Headers, ir.HeaderSettings{}).PreserveXRequestID,
+		EarlyHeaderMutationExtensions: buildEarlyHeaderMutation(irListener.Headers),
 	}
 
 	if mgr.ForwardClientCertDetails == hcmv3.HttpConnectionManager_APPEND_FORWARD || mgr.ForwardClientCertDetails == hcmv3.HttpConnectionManager_SANITIZE_SET {
@@ -365,6 +368,73 @@ func (t *Translator) addHCMToXDSListener(xdsListener *listenerv3.Listener, irLis
 	return nil
 }
 
+func buildEarlyHeaderMutation(headers *ir.HeaderSettings) []*corev3.TypedExtensionConfig {
+	if headers == nil || (len(headers.EarlyAddRequestHeaders) == 0 && len(headers.EarlyRemoveRequestHeaders) == 0) {
+		return nil
+	}
+
+	var mutationRules []*mutation_rulesv3.HeaderMutation
+
+	for _, header := range headers.EarlyAddRequestHeaders {
+		var appendAction corev3.HeaderValueOption_HeaderAppendAction
+		if header.Append {
+			appendAction = corev3.HeaderValueOption_APPEND_IF_EXISTS_OR_ADD
+		} else {
+			appendAction = corev3.HeaderValueOption_OVERWRITE_IF_EXISTS_OR_ADD
+		}
+		// Allow empty headers to be set, but don't add the config to do so unless necessary
+		if len(header.Value) == 0 {
+			mutationRules = append(mutationRules, &mutation_rulesv3.HeaderMutation{
+				Action: &mutation_rulesv3.HeaderMutation_Append{
+					Append: &corev3.HeaderValueOption{
+						Header: &corev3.HeaderValue{
+							Key: header.Name,
+						},
+						AppendAction:   appendAction,
+						KeepEmptyValue: true,
+					},
+				},
+			})
+		} else {
+			for _, val := range header.Value {
+				mutationRules = append(mutationRules, &mutation_rulesv3.HeaderMutation{
+					Action: &mutation_rulesv3.HeaderMutation_Append{
+						Append: &corev3.HeaderValueOption{
+							Header: &corev3.HeaderValue{
+								Key:   header.Name,
+								Value: val,
+							},
+							AppendAction:   appendAction,
+							KeepEmptyValue: val == "",
+						},
+					},
+				})
+			}
+		}
+	}
+
+	for _, header := range headers.EarlyRemoveRequestHeaders {
+		mr := &mutation_rulesv3.HeaderMutation{
+			Action: &mutation_rulesv3.HeaderMutation_Remove{
+				Remove: header,
+			},
+		}
+
+		mutationRules = append(mutationRules, mr)
+	}
+
+	earlyHeaderMutationAny, _ := anypb.New(&early_header_mutationv3.HeaderMutation{
+		Mutations: mutationRules,
+	})
+
+	return []*corev3.TypedExtensionConfig{
+		{
+			Name:        "envoy.http.early_header_mutation.header_mutation",
+			TypedConfig: earlyHeaderMutationAny,
+		},
+	}
+}
+
 func addServerNamesMatch(xdsListener *listenerv3.Listener, filterChain *listenerv3.FilterChain, hostnames []string) error {
 	// Dont add a filter chain match if the hostname is a wildcard character.
 	if len(hostnames) > 0 && hostnames[0] != "*" {
diff --git a/site/content/en/docs/tasks/extensibility/envoy-patch-policy.md b/site/content/en/docs/tasks/extensibility/envoy-patch-policy.md
index ff819754d..7fe847621 100644
--- a/site/content/en/docs/tasks/extensibility/envoy-patch-policy.md
+++ b/site/content/en/docs/tasks/extensibility/envoy-patch-policy.md
@@ -111,7 +111,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -151,7 +150,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -195,7 +193,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: GatewayClass
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -235,7 +232,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: GatewayClass
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -322,7 +318,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
 status:
   conditions:
diff --git a/site/content/en/docs/tasks/extensibility/ext-proc.md b/site/content/en/docs/tasks/extensibility/ext-proc.md
index 9028447ab..31ad551c6 100644
--- a/site/content/en/docs/tasks/extensibility/ext-proc.md
+++ b/site/content/en/docs/tasks/extensibility/ext-proc.md
@@ -113,10 +113,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: ext-proc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extProc:
   - backendRefs:
     - name: grpc-ext-proc
@@ -139,10 +139,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: ext-proc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extProc:
     - backendRefs:
         - name: grpc-ext-proc
diff --git a/site/content/en/docs/tasks/extensibility/wasm.md b/site/content/en/docs/tasks/extensibility/wasm.md
index d973de779..cb2e013dd 100644
--- a/site/content/en/docs/tasks/extensibility/wasm.md
+++ b/site/content/en/docs/tasks/extensibility/wasm.md
@@ -44,10 +44,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   wasm:
   - name: wasm-filter
     rootID: my_root_id
@@ -70,10 +70,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   wasm:
     - name: wasm-filter
       rootID: my_root_id
@@ -107,8 +107,8 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   wasm:
@@ -132,17 +132,17 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   wasm:
-    - name: wasm-filter
-      rootID: my_root_id
-      code:
-        type: Image
-        image:
-          url: zhaohuabing/testwasm:v0.0.1
+  - name: wasm-filter
+    rootID: my_root_id
+    code:
+      type: Image
+      image:
+        url: zhaohuabing/testwasm:v0.0.1
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/docs/tasks/security/basic-auth.md b/site/content/en/docs/tasks/security/basic-auth.md
index 956963b6d..0cd2b92a9 100644
--- a/site/content/en/docs/tasks/security/basic-auth.md
+++ b/site/content/en/docs/tasks/security/basic-auth.md
@@ -110,10 +110,10 @@ kind: SecurityPolicy
 metadata:
   name: basic-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   basicAuth:
     users:
       name: "basic-auth"
@@ -131,10 +131,10 @@ kind: SecurityPolicy
 metadata:
   name: basic-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   basicAuth:
     users:
       name: "basic-auth"
diff --git a/site/content/en/docs/tasks/security/cors.md b/site/content/en/docs/tasks/security/cors.md
index cfbe979cd..fe7110414 100644
--- a/site/content/en/docs/tasks/security/cors.md
+++ b/site/content/en/docs/tasks/security/cors.md
@@ -32,8 +32,8 @@ kind: SecurityPolicy
 metadata:
   name: cors-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   cors:
@@ -63,8 +63,8 @@ kind: SecurityPolicy
 metadata:
   name: cors-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   cors:
diff --git a/site/content/en/docs/tasks/security/ext-auth.md b/site/content/en/docs/tasks/security/ext-auth.md
index 5fc733211..8b048016a 100644
--- a/site/content/en/docs/tasks/security/ext-auth.md
+++ b/site/content/en/docs/tasks/security/ext-auth.md
@@ -110,15 +110,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     http:
-      backendRef:
-        name: http-ext-auth
-        port: 9002
+      backendRefs:
+        - name: http-ext-auth
+          port: 9002
       headersToBackend: ["x-current-user"]
 EOF
 ```
@@ -134,15 +134,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     http:
-      backendRef:
-        name: http-ext-auth
-        port: 9002
+      backendRefs:
+        - name: http-ext-auth
+          port: 9002
       headersToBackend: ["x-current-user"]
 ```
 
@@ -296,15 +296,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     grpc:
-      backendRef:
-        name: grpc-ext-auth
-        port: 9002
+      backendRefs:
+        - name: grpc-ext-auth
+          port: 9002
 EOF
 ```
 
@@ -319,15 +319,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     grpc:
-      backendRef:
-        name: grpc-ext-auth
-        port: 9002
+      backendRefs:
+        - name: grpc-ext-auth
+          port: 9002
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/docs/tasks/security/mutual-tls.md b/site/content/en/docs/tasks/security/mutual-tls.md
index 64f471ba1..8a28d0d36 100644
--- a/site/content/en/docs/tasks/security/mutual-tls.md
+++ b/site/content/en/docs/tasks/security/mutual-tls.md
@@ -89,11 +89,10 @@ metadata:
   name: enable-mtls
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tls:
     clientValidation:
       caCertificateRefs:
@@ -115,11 +114,10 @@ metadata:
   name: enable-mtls
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tls:
     clientValidation:
       caCertificateRefs:
diff --git a/site/content/en/docs/tasks/security/oidc.md b/site/content/en/docs/tasks/security/oidc.md
index ac7d6d60b..5110cc974 100644
--- a/site/content/en/docs/tasks/security/oidc.md
+++ b/site/content/en/docs/tasks/security/oidc.md
@@ -135,10 +135,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   oidc:
     provider:
       issuer: "https://accounts.google.com"
@@ -161,10 +161,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   oidc:
     provider:
       issuer: "https://accounts.google.com"
@@ -239,10 +239,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   oidc:
     provider:
       issuer: "https://accounts.google.com"
@@ -265,10 +265,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   oidc:
     provider:
       issuer: "https://accounts.google.com"
diff --git a/site/content/en/docs/tasks/security/private-key-provider.md b/site/content/en/docs/tasks/security/private-key-provider.md
index cf40a96e9..79f992aa5 100644
--- a/site/content/en/docs/tasks/security/private-key-provider.md
+++ b/site/content/en/docs/tasks/security/private-key-provider.md
@@ -433,7 +433,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
@@ -475,7 +474,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
@@ -520,7 +518,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
@@ -562,7 +559,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
diff --git a/site/content/en/docs/tasks/security/restrict-ip-access.md b/site/content/en/docs/tasks/security/restrict-ip-access.md
index ba6af1182..9eded4e71 100644
--- a/site/content/en/docs/tasks/security/restrict-ip-access.md
+++ b/site/content/en/docs/tasks/security/restrict-ip-access.md
@@ -33,10 +33,10 @@ kind: SecurityPolicy
 metadata:
   name: authorization-client-ip
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   authorization:
     defaultAction: Deny
     rules:
@@ -58,10 +58,10 @@ kind: SecurityPolicy
 metadata:
   name: authorization-client-ip
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   authorization:
     defaultAction: Deny
     rules:
@@ -102,10 +102,10 @@ spec:
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 1
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 EOF
 ```
 
@@ -123,10 +123,10 @@ spec:
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 1
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/docs/tasks/traffic/circuit-breaker.md b/site/content/en/docs/tasks/traffic/circuit-breaker.md
index d36317395..267bb05cc 100644
--- a/site/content/en/docs/tasks/traffic/circuit-breaker.md
+++ b/site/content/en/docs/tasks/traffic/circuit-breaker.md
@@ -72,10 +72,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: circuitbreaker-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
@@ -93,10 +93,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: circuitbreaker-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
diff --git a/site/content/en/docs/tasks/traffic/client-traffic-policy.md b/site/content/en/docs/tasks/traffic/client-traffic-policy.md
index 894770116..42ee63ac4 100644
--- a/site/content/en/docs/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/docs/tasks/traffic/client-traffic-policy.md
@@ -34,10 +34,10 @@ metadata:
   name: enable-tcp-keepalive-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -57,10 +57,10 @@ metadata:
   name: enable-tcp-keepalive-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -214,10 +214,10 @@ metadata:
   name: enable-proxy-protocol-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   enableProxyProtocol: true
 EOF
 ```
@@ -234,10 +234,10 @@ metadata:
   name: enable-proxy-protocol-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   enableProxyProtocol: true
 ```
 
@@ -351,10 +351,10 @@ metadata:
   name: http-client-ip-detection
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
@@ -373,10 +373,10 @@ metadata:
   name: http-client-ip-detection
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
@@ -502,10 +502,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       requestReceivedTimeout: 2s
@@ -523,10 +523,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       requestReceivedTimeout: 2s
@@ -582,10 +582,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       idleTimeout: 5s
@@ -603,10 +603,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       idleTimeout: 5s
@@ -647,10 +647,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     bufferLimit: 1024
 EOF
@@ -667,10 +667,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     bufferLimit: 1024
 ```
diff --git a/site/content/en/docs/tasks/traffic/connection-limit.md b/site/content/en/docs/tasks/traffic/connection-limit.md
index 55b0e005f..e754d1dba 100644
--- a/site/content/en/docs/tasks/traffic/connection-limit.md
+++ b/site/content/en/docs/tasks/traffic/connection-limit.md
@@ -68,10 +68,10 @@ metadata:
   name: connection-limit-ctp
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     connectionLimit:
       value: 5    
@@ -90,10 +90,10 @@ metadata:
   name: connection-limit-ctp
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     connectionLimit:
       value: 5    
diff --git a/site/content/en/docs/tasks/traffic/fault-injection.md b/site/content/en/docs/tasks/traffic/fault-injection.md
index d4f536dbb..4e0bd6222 100644
--- a/site/content/en/docs/tasks/traffic/fault-injection.md
+++ b/site/content/en/docs/tasks/traffic/fault-injection.md
@@ -36,8 +36,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-50-percent-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: foo
   faultInjection:
@@ -50,8 +50,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-delay
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: bar
   faultInjection:
@@ -113,8 +113,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-50-percent-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: foo
   faultInjection:
@@ -127,8 +127,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-delay
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: bar
   faultInjection:
@@ -210,8 +210,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: GRPCRoute
     name: yages
   faultInjection:
@@ -250,8 +250,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: GRPCRoute
     name: yages
   faultInjection:
diff --git a/site/content/en/docs/tasks/traffic/global-rate-limit.md b/site/content/en/docs/tasks/traffic/global-rate-limit.md
index 83c618612..3d80caa2e 100644
--- a/site/content/en/docs/tasks/traffic/global-rate-limit.md
+++ b/site/content/en/docs/tasks/traffic/global-rate-limit.md
@@ -236,8 +236,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -265,8 +265,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -454,8 +454,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -483,8 +483,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -655,8 +655,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -680,8 +680,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -811,8 +811,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -860,8 +860,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -951,8 +951,8 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example
   jwt:
@@ -969,8 +969,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example 
   rateLimit:
@@ -1019,8 +1019,8 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example
   jwt:
@@ -1037,8 +1037,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example 
   rateLimit:
diff --git a/site/content/en/docs/tasks/traffic/http-routing.md b/site/content/en/docs/tasks/traffic/http-routing.md
index aba57adc9..da6e3debf 100644
--- a/site/content/en/docs/tasks/traffic/http-routing.md
+++ b/site/content/en/docs/tasks/traffic/http-routing.md
@@ -141,10 +141,10 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: jwt-claim-routing
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: jwt-claim-routing
   jwt:
     providers:
       - name: example
@@ -209,10 +209,10 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: jwt-claim-routing
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: jwt-claim-routing
   jwt:
     providers:
       - name: example
diff --git a/site/content/en/docs/tasks/traffic/http3.md b/site/content/en/docs/tasks/traffic/http3.md
index 4fe660ddf..1a65339c5 100644
--- a/site/content/en/docs/tasks/traffic/http3.md
+++ b/site/content/en/docs/tasks/traffic/http3.md
@@ -70,10 +70,10 @@ metadata:
   name: enable-http3
 spec:
   http3: {}
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 EOF
 ```
 
@@ -89,10 +89,10 @@ metadata:
   name: enable-http3
 spec:
   http3: {}
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/docs/tasks/traffic/local-rate-limit.md b/site/content/en/docs/tasks/traffic/local-rate-limit.md
index 4284c7e4f..15ec9d2f2 100644
--- a/site/content/en/docs/tasks/traffic/local-rate-limit.md
+++ b/site/content/en/docs/tasks/traffic/local-rate-limit.md
@@ -46,8 +46,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -75,8 +75,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -262,8 +262,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -287,8 +287,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
diff --git a/site/content/en/docs/tasks/traffic/retry.md b/site/content/en/docs/tasks/traffic/retry.md
index 83429f35e..a0e1eff57 100644
--- a/site/content/en/docs/tasks/traffic/retry.md
+++ b/site/content/en/docs/tasks/traffic/retry.md
@@ -56,10 +56,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: retry-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   retry:
     numRetries: 5
     perRetry:
@@ -87,10 +87,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: retry-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   retry:
     numRetries: 5
     perRetry:
diff --git a/site/content/en/v1.1/tasks/extensibility/envoy-patch-policy.md b/site/content/en/v1.1/tasks/extensibility/envoy-patch-policy.md
index ff819754d..7fe847621 100644
--- a/site/content/en/v1.1/tasks/extensibility/envoy-patch-policy.md
+++ b/site/content/en/v1.1/tasks/extensibility/envoy-patch-policy.md
@@ -111,7 +111,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -151,7 +150,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -195,7 +193,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: GatewayClass
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -235,7 +232,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: GatewayClass
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -322,7 +318,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
 status:
   conditions:
diff --git a/site/content/en/v1.1/tasks/extensibility/ext-proc.md b/site/content/en/v1.1/tasks/extensibility/ext-proc.md
index 9028447ab..31ad551c6 100644
--- a/site/content/en/v1.1/tasks/extensibility/ext-proc.md
+++ b/site/content/en/v1.1/tasks/extensibility/ext-proc.md
@@ -113,10 +113,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: ext-proc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extProc:
   - backendRefs:
     - name: grpc-ext-proc
@@ -139,10 +139,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: ext-proc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extProc:
     - backendRefs:
         - name: grpc-ext-proc
diff --git a/site/content/en/v1.1/tasks/extensibility/wasm.md b/site/content/en/v1.1/tasks/extensibility/wasm.md
index d973de779..cb2e013dd 100644
--- a/site/content/en/v1.1/tasks/extensibility/wasm.md
+++ b/site/content/en/v1.1/tasks/extensibility/wasm.md
@@ -44,10 +44,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   wasm:
   - name: wasm-filter
     rootID: my_root_id
@@ -70,10 +70,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   wasm:
     - name: wasm-filter
       rootID: my_root_id
@@ -107,8 +107,8 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   wasm:
@@ -132,17 +132,17 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   wasm:
-    - name: wasm-filter
-      rootID: my_root_id
-      code:
-        type: Image
-        image:
-          url: zhaohuabing/testwasm:v0.0.1
+  - name: wasm-filter
+    rootID: my_root_id
+    code:
+      type: Image
+      image:
+        url: zhaohuabing/testwasm:v0.0.1
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/v1.1/tasks/security/basic-auth.md b/site/content/en/v1.1/tasks/security/basic-auth.md
index 956963b6d..0cd2b92a9 100644
--- a/site/content/en/v1.1/tasks/security/basic-auth.md
+++ b/site/content/en/v1.1/tasks/security/basic-auth.md
@@ -110,10 +110,10 @@ kind: SecurityPolicy
 metadata:
   name: basic-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   basicAuth:
     users:
       name: "basic-auth"
@@ -131,10 +131,10 @@ kind: SecurityPolicy
 metadata:
   name: basic-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   basicAuth:
     users:
       name: "basic-auth"
diff --git a/site/content/en/v1.1/tasks/security/cors.md b/site/content/en/v1.1/tasks/security/cors.md
index cfbe979cd..fe7110414 100644
--- a/site/content/en/v1.1/tasks/security/cors.md
+++ b/site/content/en/v1.1/tasks/security/cors.md
@@ -32,8 +32,8 @@ kind: SecurityPolicy
 metadata:
   name: cors-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   cors:
@@ -63,8 +63,8 @@ kind: SecurityPolicy
 metadata:
   name: cors-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   cors:
diff --git a/site/content/en/v1.1/tasks/security/ext-auth.md b/site/content/en/v1.1/tasks/security/ext-auth.md
index 5fc733211..8b048016a 100644
--- a/site/content/en/v1.1/tasks/security/ext-auth.md
+++ b/site/content/en/v1.1/tasks/security/ext-auth.md
@@ -110,15 +110,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     http:
-      backendRef:
-        name: http-ext-auth
-        port: 9002
+      backendRefs:
+        - name: http-ext-auth
+          port: 9002
       headersToBackend: ["x-current-user"]
 EOF
 ```
@@ -134,15 +134,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     http:
-      backendRef:
-        name: http-ext-auth
-        port: 9002
+      backendRefs:
+        - name: http-ext-auth
+          port: 9002
       headersToBackend: ["x-current-user"]
 ```
 
@@ -296,15 +296,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     grpc:
-      backendRef:
-        name: grpc-ext-auth
-        port: 9002
+      backendRefs:
+        - name: grpc-ext-auth
+          port: 9002
 EOF
 ```
 
@@ -319,15 +319,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     grpc:
-      backendRef:
-        name: grpc-ext-auth
-        port: 9002
+      backendRefs:
+        - name: grpc-ext-auth
+          port: 9002
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/v1.1/tasks/security/mutual-tls.md b/site/content/en/v1.1/tasks/security/mutual-tls.md
index 64f471ba1..8a28d0d36 100644
--- a/site/content/en/v1.1/tasks/security/mutual-tls.md
+++ b/site/content/en/v1.1/tasks/security/mutual-tls.md
@@ -89,11 +89,10 @@ metadata:
   name: enable-mtls
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tls:
     clientValidation:
       caCertificateRefs:
@@ -115,11 +114,10 @@ metadata:
   name: enable-mtls
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tls:
     clientValidation:
       caCertificateRefs:
diff --git a/site/content/en/v1.1/tasks/security/oidc.md b/site/content/en/v1.1/tasks/security/oidc.md
index ac7d6d60b..5110cc974 100644
--- a/site/content/en/v1.1/tasks/security/oidc.md
+++ b/site/content/en/v1.1/tasks/security/oidc.md
@@ -135,10 +135,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   oidc:
     provider:
       issuer: "https://accounts.google.com"
@@ -161,10 +161,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   oidc:
     provider:
       issuer: "https://accounts.google.com"
@@ -239,10 +239,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   oidc:
     provider:
       issuer: "https://accounts.google.com"
@@ -265,10 +265,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   oidc:
     provider:
       issuer: "https://accounts.google.com"
diff --git a/site/content/en/v1.1/tasks/security/private-key-provider.md b/site/content/en/v1.1/tasks/security/private-key-provider.md
index cf40a96e9..79f992aa5 100644
--- a/site/content/en/v1.1/tasks/security/private-key-provider.md
+++ b/site/content/en/v1.1/tasks/security/private-key-provider.md
@@ -433,7 +433,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
@@ -475,7 +474,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
@@ -520,7 +518,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
@@ -562,7 +559,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
diff --git a/site/content/en/v1.1/tasks/security/restrict-ip-access.md b/site/content/en/v1.1/tasks/security/restrict-ip-access.md
index ba6af1182..9eded4e71 100644
--- a/site/content/en/v1.1/tasks/security/restrict-ip-access.md
+++ b/site/content/en/v1.1/tasks/security/restrict-ip-access.md
@@ -33,10 +33,10 @@ kind: SecurityPolicy
 metadata:
   name: authorization-client-ip
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   authorization:
     defaultAction: Deny
     rules:
@@ -58,10 +58,10 @@ kind: SecurityPolicy
 metadata:
   name: authorization-client-ip
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   authorization:
     defaultAction: Deny
     rules:
@@ -102,10 +102,10 @@ spec:
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 1
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 EOF
 ```
 
@@ -123,10 +123,10 @@ spec:
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 1
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/v1.1/tasks/traffic/circuit-breaker.md b/site/content/en/v1.1/tasks/traffic/circuit-breaker.md
index d36317395..267bb05cc 100644
--- a/site/content/en/v1.1/tasks/traffic/circuit-breaker.md
+++ b/site/content/en/v1.1/tasks/traffic/circuit-breaker.md
@@ -72,10 +72,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: circuitbreaker-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
@@ -93,10 +93,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: circuitbreaker-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
diff --git a/site/content/en/v1.1/tasks/traffic/client-traffic-policy.md b/site/content/en/v1.1/tasks/traffic/client-traffic-policy.md
index 894770116..42ee63ac4 100644
--- a/site/content/en/v1.1/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/v1.1/tasks/traffic/client-traffic-policy.md
@@ -34,10 +34,10 @@ metadata:
   name: enable-tcp-keepalive-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -57,10 +57,10 @@ metadata:
   name: enable-tcp-keepalive-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -214,10 +214,10 @@ metadata:
   name: enable-proxy-protocol-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   enableProxyProtocol: true
 EOF
 ```
@@ -234,10 +234,10 @@ metadata:
   name: enable-proxy-protocol-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   enableProxyProtocol: true
 ```
 
@@ -351,10 +351,10 @@ metadata:
   name: http-client-ip-detection
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
@@ -373,10 +373,10 @@ metadata:
   name: http-client-ip-detection
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
@@ -502,10 +502,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       requestReceivedTimeout: 2s
@@ -523,10 +523,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       requestReceivedTimeout: 2s
@@ -582,10 +582,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       idleTimeout: 5s
@@ -603,10 +603,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       idleTimeout: 5s
@@ -647,10 +647,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     bufferLimit: 1024
 EOF
@@ -667,10 +667,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     bufferLimit: 1024
 ```
diff --git a/site/content/en/v1.1/tasks/traffic/connection-limit.md b/site/content/en/v1.1/tasks/traffic/connection-limit.md
index 55b0e005f..e754d1dba 100644
--- a/site/content/en/v1.1/tasks/traffic/connection-limit.md
+++ b/site/content/en/v1.1/tasks/traffic/connection-limit.md
@@ -68,10 +68,10 @@ metadata:
   name: connection-limit-ctp
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     connectionLimit:
       value: 5    
@@ -90,10 +90,10 @@ metadata:
   name: connection-limit-ctp
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     connectionLimit:
       value: 5    
diff --git a/site/content/en/v1.1/tasks/traffic/fault-injection.md b/site/content/en/v1.1/tasks/traffic/fault-injection.md
index d4f536dbb..4e0bd6222 100644
--- a/site/content/en/v1.1/tasks/traffic/fault-injection.md
+++ b/site/content/en/v1.1/tasks/traffic/fault-injection.md
@@ -36,8 +36,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-50-percent-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: foo
   faultInjection:
@@ -50,8 +50,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-delay
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: bar
   faultInjection:
@@ -113,8 +113,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-50-percent-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: foo
   faultInjection:
@@ -127,8 +127,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-delay
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: bar
   faultInjection:
@@ -210,8 +210,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: GRPCRoute
     name: yages
   faultInjection:
@@ -250,8 +250,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: GRPCRoute
     name: yages
   faultInjection:
diff --git a/site/content/en/v1.1/tasks/traffic/global-rate-limit.md b/site/content/en/v1.1/tasks/traffic/global-rate-limit.md
index 83c618612..3d80caa2e 100644
--- a/site/content/en/v1.1/tasks/traffic/global-rate-limit.md
+++ b/site/content/en/v1.1/tasks/traffic/global-rate-limit.md
@@ -236,8 +236,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -265,8 +265,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -454,8 +454,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -483,8 +483,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -655,8 +655,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -680,8 +680,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -811,8 +811,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -860,8 +860,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -951,8 +951,8 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example
   jwt:
@@ -969,8 +969,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example 
   rateLimit:
@@ -1019,8 +1019,8 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example
   jwt:
@@ -1037,8 +1037,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example 
   rateLimit:
diff --git a/site/content/en/v1.1/tasks/traffic/http-routing.md b/site/content/en/v1.1/tasks/traffic/http-routing.md
index aba57adc9..da6e3debf 100644
--- a/site/content/en/v1.1/tasks/traffic/http-routing.md
+++ b/site/content/en/v1.1/tasks/traffic/http-routing.md
@@ -141,10 +141,10 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: jwt-claim-routing
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: jwt-claim-routing
   jwt:
     providers:
       - name: example
@@ -209,10 +209,10 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: jwt-claim-routing
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: jwt-claim-routing
   jwt:
     providers:
       - name: example
diff --git a/site/content/en/v1.1/tasks/traffic/http3.md b/site/content/en/v1.1/tasks/traffic/http3.md
index 4fe660ddf..1a65339c5 100644
--- a/site/content/en/v1.1/tasks/traffic/http3.md
+++ b/site/content/en/v1.1/tasks/traffic/http3.md
@@ -70,10 +70,10 @@ metadata:
   name: enable-http3
 spec:
   http3: {}
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 EOF
 ```
 
@@ -89,10 +89,10 @@ metadata:
   name: enable-http3
 spec:
   http3: {}
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/v1.1/tasks/traffic/local-rate-limit.md b/site/content/en/v1.1/tasks/traffic/local-rate-limit.md
index 4284c7e4f..15ec9d2f2 100644
--- a/site/content/en/v1.1/tasks/traffic/local-rate-limit.md
+++ b/site/content/en/v1.1/tasks/traffic/local-rate-limit.md
@@ -46,8 +46,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -75,8 +75,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -262,8 +262,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -287,8 +287,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
diff --git a/site/content/en/v1.1/tasks/traffic/retry.md b/site/content/en/v1.1/tasks/traffic/retry.md
index 83429f35e..a0e1eff57 100644
--- a/site/content/en/v1.1/tasks/traffic/retry.md
+++ b/site/content/en/v1.1/tasks/traffic/retry.md
@@ -56,10 +56,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: retry-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   retry:
     numRetries: 5
     perRetry:
@@ -87,10 +87,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: retry-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   retry:
     numRetries: 5
     perRetry:


Test patch:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.in.yaml
new file mode 100644
index 000000000..3b2331bba
--- /dev/null
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.in.yaml
@@ -0,0 +1,43 @@
+clientTrafficPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1
+  spec:
+    headers:
+      enableEnvoyHeaders: true
+      withUnderscoresAction: Allow
+      preserveXRequestID: true
+      earlyRequestHeaders:
+        add:
+        - name: ""
+          value: "empty"
+        - name: "invalid"
+          value: ":/"
+        set:
+        - name: ""
+          value: "empty"
+        - name: "invalid"
+          value: ":/"
+        remove:
+        - ""
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-1
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml
new file mode 100644
index 000000000..9eee58d7d
--- /dev/null
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml
@@ -0,0 +1,127 @@
+clientTrafficPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1
+    namespace: envoy-gateway
+  spec:
+    headers:
+      earlyRequestHeaders:
+        add:
+        - name: ""
+          value: empty
+        - name: invalid
+          value: :/
+        remove:
+        - ""
+        set:
+        - name: ""
+          value: empty
+        - name: invalid
+          value: :/
+      enableEnvoyHeaders: true
+      preserveXRequestID: true
+      withUnderscoresAction: Allow
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: |-
+          Headers: EarlyRequestHeaders cannot add a header with an empty name
+          EarlyRequestHeaders cannot set a header with an empty name
+          EarlyRequestHeaders cannot remove a header with an empty name.
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http-1
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      headers:
+        enableEnvoyHeaders: true
+        preserveXRequestID: true
+        withUnderscoresAction: Allow
+      hostnames:
+      - '*'
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-1
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-headers.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-headers.in.yaml
index 6d73bee1a..3234aed7d 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-headers.in.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-headers.in.yaml
@@ -9,6 +9,20 @@ clientTrafficPolicies:
       enableEnvoyHeaders: true
       withUnderscoresAction: Allow
       preserveXRequestID: true
+      earlyRequestHeaders:
+        add:
+        - name: "my-added-header"
+          value: "my-added-header-value"
+        - name: "my-added-header"
+          value: "my-added-header-value"
+        set:
+        - name: "my-set-header"
+          value: "my-set-header-value"
+        - name: "my-set-header"
+          value: "my-set-header-value"
+        remove:
+        - "my-removed-header"
+        - "my-removed-header"
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml
index 8b32bb192..4e66bd91c 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml
@@ -7,6 +7,20 @@ clientTrafficPolicies:
     namespace: envoy-gateway
   spec:
     headers:
+      earlyRequestHeaders:
+        add:
+        - name: my-added-header
+          value: my-added-header-value
+        - name: my-added-header
+          value: my-added-header-value
+        remove:
+        - my-removed-header
+        - my-removed-header
+        set:
+        - name: my-set-header
+          value: my-set-header-value
+        - name: my-set-header
+          value: my-set-header-value
       enableEnvoyHeaders: true
       preserveXRequestID: true
       withUnderscoresAction: Allow
@@ -129,6 +143,17 @@ xdsIR:
     http:
     - address: 0.0.0.0
       headers:
+        earlyAddRequestHeaders:
+        - append: true
+          name: my-added-header
+          value:
+          - my-added-header-value
+        - append: false
+          name: my-set-header
+          value:
+          - my-set-header-value
+        earlyRemoveRequestHeaders:
+        - my-removed-header
         enableEnvoyHeaders: true
         preserveXRequestID: true
         withUnderscoresAction: Allow
@@ -147,6 +172,17 @@ xdsIR:
       port: 10080
     - address: 0.0.0.0
       headers:
+        earlyAddRequestHeaders:
+        - append: true
+          name: my-added-header
+          value:
+          - my-added-header-value
+        - append: false
+          name: my-set-header
+          value:
+          - my-set-header-value
+        earlyRemoveRequestHeaders:
+        - my-removed-header
         enableEnvoyHeaders: true
         preserveXRequestID: true
         withUnderscoresAction: Allow
diff --git a/internal/xds/translator/testdata/in/xds-ir/http-early-header-mutation.yaml b/internal/xds/translator/testdata/in/xds-ir/http-early-header-mutation.yaml
new file mode 100644
index 000000000..6301153cd
--- /dev/null
+++ b/internal/xds/translator/testdata/in/xds-ir/http-early-header-mutation.yaml
@@ -0,0 +1,59 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  http1:
+    preserveHeaderCase: true
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "second-listener"
+  address: "0.0.0.0"
+  port: 10081
+  hostnames:
+  - "*"
+  headers:
+    earlyAddRequestHeaders:
+    - name: "some-header"
+      value:
+      - "some-value1"
+      - "some-value2"
+      append: true
+    - name: "some-header-2"
+      value:
+      - "some-value"
+      append: true
+    - name: "some-header3"
+      value:
+      - "some-value"
+      append: false
+    - name: "some-header4"
+      value:
+      - "some-value"
+      append: false
+    - name: "empty-header"
+      value:
+      append: false
+    earlyRemoveRequestHeaders:
+    - "some-header5"
+    - "some-header6"
+  routes:
+  - name: "second-route"
+    hostname: "*"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.5"
+          port: 50000
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.clusters.yaml
new file mode 100644
index 000000000..22e672706
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.clusters.yaml
@@ -0,0 +1,44 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        httpProtocolOptions:
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.endpoints.yaml
new file mode 100644
index 000000000..28a57caf3
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.endpoints.yaml
@@ -0,0 +1,24 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.5
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.listeners.yaml
new file mode 100644
index 000000000..69c2612a5
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.listeners.yaml
@@ -0,0 +1,108 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        httpProtocolOptions:
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+        mergeSlashes: true
+        normalizePath: true
+        pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http-10080
+        useRemoteAddress: true
+    name: first-listener
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10081
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        earlyHeaderMutationExtensions:
+        - name: envoy.http.early_header_mutation.header_mutation
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.http.early_header_mutation.header_mutation.v3.HeaderMutation
+            mutations:
+            - append:
+                header:
+                  key: some-header
+                  value: some-value1
+            - append:
+                header:
+                  key: some-header
+                  value: some-value2
+            - append:
+                header:
+                  key: some-header-2
+                  value: some-value
+            - append:
+                appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+                header:
+                  key: some-header3
+                  value: some-value
+            - append:
+                appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+                header:
+                  key: some-header4
+                  value: some-value
+            - append:
+                appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+                header:
+                  key: empty-header
+                keepEmptyValue: true
+            - remove: some-header5
+            - remove: some-header6
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: second-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http-10081
+        useRemoteAddress: true
+    name: second-listener
+  drainType: MODIFY_ONLY
+  name: second-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.routes.yaml
new file mode 100644
index 000000000..ff93cfff3
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-early-header-mutation.routes.yaml
@@ -0,0 +1,28 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: second-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: second-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 99caabc36..0530e4389 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -68,7 +68,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `logName` | _string_ |  false  | LogName defines the friendly name of the access log to be returned in<br />StreamAccessLogsMessage.Identifier. This allows the access log server<br />to differentiate between different access logs coming from the same Envoy. |
@@ -294,7 +294,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 
@@ -1484,7 +1484,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `messageTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | MessageTimeout is the timeout for a response to be returned from the external processor<br />Default: 200ms |
@@ -1713,7 +1713,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 
@@ -1863,7 +1863,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `path` | _string_ |  true  | Path is the path of the HTTP External Authorization service.<br />If path is specified, the authorization request will be sent to that path,<br />or else the authorization request will be sent to the root path. |
@@ -1962,6 +1962,7 @@ _Appears in:_
 | `xForwardedClientCert` | _[XForwardedClientCert](#xforwardedclientcert)_ |  false  | XForwardedClientCert configures how Envoy Proxy handle the x-forwarded-client-cert (XFCC) HTTP header.<br /><br />x-forwarded-client-cert (XFCC) is an HTTP header used to forward the certificate<br />information of part or all of the clients or proxies that a request has flowed through,<br />on its way from the client to the server.<br /><br />Envoy proxy may choose to sanitize/append/forward the XFCC header before proxying the request.<br /><br />If not set, the default behavior is sanitizing the XFCC header. |
 | `withUnderscoresAction` | _[WithUnderscoresAction](#withunderscoresaction)_ |  false  | WithUnderscoresAction configures the action to take when an HTTP header with underscores<br />is encountered. The default action is to reject the request. |
 | `preserveXRequestID` | _boolean_ |  false  | PreserveXRequestID configures Envoy to keep the X-Request-ID header if passed for a request that is edge<br />(Edge request is the request from external clients to front Envoy) and not reset it, which is the current Envoy behaviour.<br />It defaults to false. |
+| `earlyRequestHeaders` | _[HTTPHeaderFilter](#httpheaderfilter)_ |  false  | EarlyRequestHeaders defines settings for early request header modification, before envoy performs<br />routing, tracing and built-in header manipulation. |
 
 
 
@@ -2514,7 +2515,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  | Host define the extension service hostname.<br />Deprecated: Use BackendRefs instead. |
@@ -2873,7 +2874,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  | Host define the service hostname.<br />Deprecated: Use BackendRefs instead. |
@@ -3589,7 +3590,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `type` | _[TracingProviderType](#tracingprovidertype)_ |  true  | Type defines the tracing provider type. |
diff --git a/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md b/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
index 9626dc937..36930d737 100644
--- a/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
+++ b/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
@@ -110,7 +110,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -150,7 +149,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -194,7 +192,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: GatewayClass
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -234,7 +231,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: GatewayClass
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
@@ -321,7 +317,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
 status:
   conditions:
diff --git a/site/content/en/latest/tasks/extensibility/ext-proc.md b/site/content/en/latest/tasks/extensibility/ext-proc.md
index f6b8b5c74..910332f47 100644
--- a/site/content/en/latest/tasks/extensibility/ext-proc.md
+++ b/site/content/en/latest/tasks/extensibility/ext-proc.md
@@ -106,10 +106,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: ext-proc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extProc:
   - backendRefs:
     - name: grpc-ext-proc
@@ -132,10 +132,10 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: ext-proc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extProc:
     - backendRefs:
         - name: grpc-ext-proc
diff --git a/site/content/en/latest/tasks/extensibility/wasm.md b/site/content/en/latest/tasks/extensibility/wasm.md
index 6cb3d1092..8a640471e 100644
--- a/site/content/en/latest/tasks/extensibility/wasm.md
+++ b/site/content/en/latest/tasks/extensibility/wasm.md
@@ -37,8 +37,8 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   wasm:
@@ -63,18 +63,18 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   wasm:
-    - name: wasm-filter
-      rootID: my_root_id
-      code:
-        type: HTTP
-        http:
-          url: https://raw.githubusercontent.com/envoyproxy/envoy/main/examples/wasm-cc/lib/envoy_filter_http_wasm_example.wasm
-          sha256: 79c9f85128bb0177b6511afa85d587224efded376ac0ef76df56595f1e6315c0
+  - name: wasm-filter
+    rootID: my_root_id
+    code:
+      type: HTTP
+      http:
+        url: https://raw.githubusercontent.com/envoyproxy/envoy/main/examples/wasm-cc/lib/envoy_filter_http_wasm_example.wasm
+        sha256: 79c9f85128bb0177b6511afa85d587224efded376ac0ef76df56595f1e6315c0
 ```
 
 {{% /tab %}}
@@ -100,8 +100,8 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   wasm:
@@ -125,17 +125,17 @@ kind: EnvoyExtensionPolicy
 metadata:
   name: wasm-test
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   wasm:
-    - name: wasm-filter
-      rootID: my_root_id
-      code:
-        type: Image
-        image:
-          url: zhaohuabing/testwasm:v0.0.1
+  - name: wasm-filter
+    rootID: my_root_id
+    code:
+      type: Image
+      image:
+        url: zhaohuabing/testwasm:v0.0.1
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/latest/tasks/security/basic-auth.md b/site/content/en/latest/tasks/security/basic-auth.md
index 79e481560..38fa436f0 100644
--- a/site/content/en/latest/tasks/security/basic-auth.md
+++ b/site/content/en/latest/tasks/security/basic-auth.md
@@ -109,10 +109,10 @@ kind: SecurityPolicy
 metadata:
   name: basic-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   basicAuth:
     users:
       name: "basic-auth"
@@ -130,10 +130,10 @@ kind: SecurityPolicy
 metadata:
   name: basic-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   basicAuth:
     users:
       name: "basic-auth"
diff --git a/site/content/en/latest/tasks/security/cors.md b/site/content/en/latest/tasks/security/cors.md
index 129e318cc..90a972ce4 100644
--- a/site/content/en/latest/tasks/security/cors.md
+++ b/site/content/en/latest/tasks/security/cors.md
@@ -31,8 +31,8 @@ kind: SecurityPolicy
 metadata:
   name: cors-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   cors:
@@ -62,8 +62,8 @@ kind: SecurityPolicy
 metadata:
   name: cors-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   cors:
diff --git a/site/content/en/latest/tasks/security/ext-auth.md b/site/content/en/latest/tasks/security/ext-auth.md
index e0f30e031..1d1625d57 100644
--- a/site/content/en/latest/tasks/security/ext-auth.md
+++ b/site/content/en/latest/tasks/security/ext-auth.md
@@ -103,15 +103,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     http:
-      backendRef:
-        name: http-ext-auth
-        port: 9002
+      backendRefs:
+        - name: http-ext-auth
+          port: 9002
       headersToBackend: ["x-current-user"]
 EOF
 ```
@@ -127,15 +127,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     http:
-      backendRef:
-        name: http-ext-auth
-        port: 9002
+      backendRefs:
+        - name: http-ext-auth
+          port: 9002
       headersToBackend: ["x-current-user"]
 ```
 
@@ -289,15 +289,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     grpc:
-      backendRef:
-        name: grpc-ext-auth
-        port: 9002
+      backendRefs:
+        - name: grpc-ext-auth
+          port: 9002
 EOF
 ```
 
@@ -312,15 +312,15 @@ kind: SecurityPolicy
 metadata:
   name: ext-auth-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   extAuth:
     grpc:
-      backendRef:
-        name: grpc-ext-auth
-        port: 9002
+      backendRefs:
+        - name: grpc-ext-auth
+          port: 9002
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/latest/tasks/security/mutual-tls.md b/site/content/en/latest/tasks/security/mutual-tls.md
index 4eed29a1c..4ac9f9643 100644
--- a/site/content/en/latest/tasks/security/mutual-tls.md
+++ b/site/content/en/latest/tasks/security/mutual-tls.md
@@ -88,11 +88,10 @@ metadata:
   name: enable-mtls
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tls:
     clientValidation:
       caCertificateRefs:
@@ -114,11 +113,10 @@ metadata:
   name: enable-mtls
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tls:
     clientValidation:
       caCertificateRefs:
diff --git a/site/content/en/latest/tasks/security/oidc.md b/site/content/en/latest/tasks/security/oidc.md
index f7890b5d1..8add22bfb 100644
--- a/site/content/en/latest/tasks/security/oidc.md
+++ b/site/content/en/latest/tasks/security/oidc.md
@@ -134,10 +134,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   oidc:
     provider:
       issuer: "https://accounts.google.com"
@@ -160,10 +160,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: myapp
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
   oidc:
     provider:
       issuer: "https://accounts.google.com"
@@ -238,10 +238,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   oidc:
     provider:
       issuer: "https://accounts.google.com"
@@ -264,10 +264,10 @@ kind: SecurityPolicy
 metadata:
   name: oidc-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   oidc:
     provider:
       issuer: "https://accounts.google.com"
diff --git a/site/content/en/latest/tasks/security/private-key-provider.md b/site/content/en/latest/tasks/security/private-key-provider.md
index cf40a96e9..79f992aa5 100644
--- a/site/content/en/latest/tasks/security/private-key-provider.md
+++ b/site/content/en/latest/tasks/security/private-key-provider.md
@@ -433,7 +433,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
@@ -475,7 +474,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
@@ -520,7 +518,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
@@ -562,7 +559,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   type: JSONPatch
   jsonPatches:
     - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
diff --git a/site/content/en/latest/tasks/security/restrict-ip-access.md b/site/content/en/latest/tasks/security/restrict-ip-access.md
index cfc0fca50..ab8965d79 100644
--- a/site/content/en/latest/tasks/security/restrict-ip-access.md
+++ b/site/content/en/latest/tasks/security/restrict-ip-access.md
@@ -32,8 +32,8 @@ kind: SecurityPolicy
 metadata:
   name: authorization-client-ip
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   authorization:
@@ -57,17 +57,17 @@ kind: SecurityPolicy
 metadata:
   name: authorization-client-ip
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
   authorization:
     defaultAction: Deny
     rules:
-      - action: Allow
-        principal:
-          clientCIDRs:
-            - 10.0.1.0/24
+    - action: Allow
+      principal:
+        clientCIDRs:
+        - 10.0.1.0/24
 ```
 
 {{% /tab %}}
@@ -101,10 +101,10 @@ spec:
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 1
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 EOF
 ```
 
@@ -122,10 +122,10 @@ spec:
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 1
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/latest/tasks/traffic/circuit-breaker.md b/site/content/en/latest/tasks/traffic/circuit-breaker.md
index 99887daba..6a359c5e0 100644
--- a/site/content/en/latest/tasks/traffic/circuit-breaker.md
+++ b/site/content/en/latest/tasks/traffic/circuit-breaker.md
@@ -73,10 +73,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: circuitbreaker-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
@@ -94,10 +94,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: circuitbreaker-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
diff --git a/site/content/en/latest/tasks/traffic/client-traffic-policy.md b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
index a6b4a7f9f..2099ea136 100644
--- a/site/content/en/latest/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
@@ -33,9 +33,9 @@ metadata:
   namespace: default
 spec:
   targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -55,10 +55,10 @@ metadata:
   name: enable-tcp-keepalive-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -212,10 +212,10 @@ metadata:
   name: enable-proxy-protocol-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   enableProxyProtocol: true
 EOF
 ```
@@ -232,10 +232,10 @@ metadata:
   name: enable-proxy-protocol-policy
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   enableProxyProtocol: true
 ```
 
@@ -350,9 +350,9 @@ metadata:
   namespace: default
 spec:
   targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
@@ -371,10 +371,10 @@ metadata:
   name: http-client-ip-detection
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
@@ -500,10 +500,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       requestReceivedTimeout: 2s
@@ -521,10 +521,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       requestReceivedTimeout: 2s
@@ -580,10 +580,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       idleTimeout: 5s
@@ -601,10 +601,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   timeout:
     http:
       idleTimeout: 5s
@@ -645,10 +645,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     bufferLimit: 1024
 EOF
@@ -665,10 +665,10 @@ kind: ClientTrafficPolicy
 metadata:
   name: client-timeout
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     bufferLimit: 1024
 ```
diff --git a/site/content/en/latest/tasks/traffic/connection-limit.md b/site/content/en/latest/tasks/traffic/connection-limit.md
index 21f679e73..9c0e9bbc1 100644
--- a/site/content/en/latest/tasks/traffic/connection-limit.md
+++ b/site/content/en/latest/tasks/traffic/connection-limit.md
@@ -68,10 +68,10 @@ metadata:
   name: connection-limit-ctp
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     connectionLimit:
       value: 5    
@@ -90,10 +90,10 @@ metadata:
   name: connection-limit-ctp
   namespace: default
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
   connection:
     connectionLimit:
       value: 5    
diff --git a/site/content/en/latest/tasks/traffic/fault-injection.md b/site/content/en/latest/tasks/traffic/fault-injection.md
index 040dc1812..82068c4cf 100644
--- a/site/content/en/latest/tasks/traffic/fault-injection.md
+++ b/site/content/en/latest/tasks/traffic/fault-injection.md
@@ -37,8 +37,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-50-percent-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: foo
   faultInjection:
@@ -51,8 +51,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-delay
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: bar
   faultInjection:
@@ -114,8 +114,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-50-percent-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: foo
   faultInjection:
@@ -128,8 +128,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-delay
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: bar
   faultInjection:
@@ -211,8 +211,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: GRPCRoute
     name: yages
   faultInjection:
@@ -251,8 +251,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: fault-injection-abort
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: GRPCRoute
     name: yages
   faultInjection:
diff --git a/site/content/en/latest/tasks/traffic/global-rate-limit.md b/site/content/en/latest/tasks/traffic/global-rate-limit.md
index 9dd732a81..41286f80e 100644
--- a/site/content/en/latest/tasks/traffic/global-rate-limit.md
+++ b/site/content/en/latest/tasks/traffic/global-rate-limit.md
@@ -235,8 +235,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -264,8 +264,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -453,8 +453,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -482,8 +482,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -654,8 +654,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -679,8 +679,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -810,8 +810,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit 
   rateLimit:
@@ -859,8 +859,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit 
   rateLimit:
@@ -950,8 +950,8 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example
   jwt:
@@ -968,8 +968,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example 
   rateLimit:
@@ -1018,8 +1018,8 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example
   jwt:
@@ -1036,8 +1036,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: example 
   rateLimit:
diff --git a/site/content/en/latest/tasks/traffic/http-request-headers.md b/site/content/en/latest/tasks/traffic/http-request-headers.md
index 9cd60281c..5b73bfaf8 100644
--- a/site/content/en/latest/tasks/traffic/http-request-headers.md
+++ b/site/content/en/latest/tasks/traffic/http-request-headers.md
@@ -442,7 +442,179 @@ spec:
 {{% /tab %}}
 {{< /tabpane >}}
 
+## Early Header Modification
+
+In some cases, it could be necessary to modify headers before the proxy performs any sort of processing, routing or tracing. Envoy Gateway supports this functionality using the [ClientTrafficPolicy][] API.
+
+A ClientTrafficPolicy resource can be attached to a Gateway resource to configure early header modifications for all its routes. In the following example we will demonstrate how early header modification can be configured. 
+
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    filters:
+    - type: RequestHeaderModifier
+      requestHeaderModifier:
+        add:
+          - name: early-added-header
+            value: late
+          - name: early-set-header
+            value: late
+          - name: early-removed-header
+            value: late 
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-early-headers
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  headers:
+    earlyRequestHeaders:
+      add:
+        - name: "early-added-header"
+          value: "early"
+      set:
+        - name: "early-set-header"
+          value: "early"
+      remove:
+        - "early-removed-header"
+EOF
+```
+
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - headers.example
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: backend
+          port: 3000
+          weight: 1
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            add:
+              - name: early-added-header
+                value: late
+              - name: early-set-header
+                value: late
+              - name: early-removed-header
+                value: late
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-early-headers
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  headers:
+    earlyRequestHeaders:
+      add:
+        - name: "early-added-header"
+          value: "early"
+      set:
+        - name: "early-set-header"
+          value: "early"
+      remove:
+        - "early-removed-header"
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
+
+
+Querying `headers.example/get` should result in a `200` response from the example Gateway and the output from the
+example app should indicate that the upstream example app received the following headers:
+- `early-added-header` contains early (ClientTrafficPolicy) and late (RouteFilter) values
+- `early-set-header` contains only early (ClientTrafficPolicy) and late (RouteFilter) values, since the early modification overwritten the client value.
+- `early-removed-header` contains only the late (RouteFilter) value, since the early modification deleted the client value.
+
+```console
+$ curl -vvv --header "Host: headers.example" "http://${GATEWAY_HOST}/get" --header  "early-added-header: client" --header  "early-set-header: client" --header  "early-removed-header: client" 
+...
+> GET /get HTTP/1.1
+> Host: headers.example
+> User-Agent: curl/7.81.0
+> Accept: */*
+> add-header: something
+>
+* Mark bundle as not supporting multiuse
+< HTTP/1.1 200 OK
+< content-type: application/json
+< x-content-type-options: nosniff
+< content-length: 474
+< x-envoy-upstream-service-time: 0
+< server: envoy
+<
+
+ "headers": {
+  "Accept": [
+   "*/*"
+  ],
+  "Early-Added-Header": [
+   "client",
+   "early",
+   "late"
+  ],
+  "Early-Set-Header": [
+   "early",
+   "late"
+  ],
+  "Early-removed-Header": [
+    "late"
+  ]
+...
+```
+
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute/
 [HTTPRoute filters]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteFilter
 [Gateway API documentation]: https://gateway-api.sigs.k8s.io/
 [req_filter]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPHeaderFilter
+[ClientTrafficPolicy]: ../../../api/extension_types#clienttrafficpolicy
diff --git a/site/content/en/latest/tasks/traffic/http-routing.md b/site/content/en/latest/tasks/traffic/http-routing.md
index 705846c6e..0f1f3c688 100644
--- a/site/content/en/latest/tasks/traffic/http-routing.md
+++ b/site/content/en/latest/tasks/traffic/http-routing.md
@@ -140,10 +140,10 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: jwt-claim-routing
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: jwt-claim-routing
   jwt:
     providers:
       - name: example
@@ -208,10 +208,10 @@ kind: SecurityPolicy
 metadata:
   name: jwt-example
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: jwt-claim-routing
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: jwt-claim-routing
   jwt:
     providers:
       - name: example
diff --git a/site/content/en/latest/tasks/traffic/http3.md b/site/content/en/latest/tasks/traffic/http3.md
index cb5034284..a0fb15942 100644
--- a/site/content/en/latest/tasks/traffic/http3.md
+++ b/site/content/en/latest/tasks/traffic/http3.md
@@ -69,10 +69,10 @@ metadata:
   name: enable-http3
 spec:
   http3: {}
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 EOF
 ```
 
@@ -88,10 +88,10 @@ metadata:
   name: enable-http3
 spec:
   http3: {}
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: Gateway
-    name: eg
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/latest/tasks/traffic/local-rate-limit.md b/site/content/en/latest/tasks/traffic/local-rate-limit.md
index a7b920db1..62e369044 100644
--- a/site/content/en/latest/tasks/traffic/local-rate-limit.md
+++ b/site/content/en/latest/tasks/traffic/local-rate-limit.md
@@ -43,8 +43,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -72,8 +72,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -259,8 +259,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
@@ -284,8 +284,8 @@ kind: BackendTrafficPolicy
 metadata:
   name: policy-httproute
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
+  targetRefs:
+  - group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
   rateLimit:
diff --git a/site/content/en/latest/tasks/traffic/retry.md b/site/content/en/latest/tasks/traffic/retry.md
index 25b7e2519..75d151bdf 100644
--- a/site/content/en/latest/tasks/traffic/retry.md
+++ b/site/content/en/latest/tasks/traffic/retry.md
@@ -56,10 +56,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: retry-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   retry:
     numRetries: 5
     perRetry:
@@ -87,10 +87,10 @@ kind: BackendTrafficPolicy
 metadata:
   name: retry-for-route
 spec:
-  targetRef:
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: backend
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
   retry:
     numRetries: 5
     perRetry:
diff --git a/site/content/zh/latest/api/extension_types.md b/site/content/zh/latest/api/extension_types.md
index 99caabc36..0530e4389 100644
--- a/site/content/zh/latest/api/extension_types.md
+++ b/site/content/zh/latest/api/extension_types.md
@@ -68,7 +68,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `logName` | _string_ |  false  | LogName defines the friendly name of the access log to be returned in<br />StreamAccessLogsMessage.Identifier. This allows the access log server<br />to differentiate between different access logs coming from the same Envoy. |
@@ -294,7 +294,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 
@@ -1484,7 +1484,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `messageTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | MessageTimeout is the timeout for a response to be returned from the external processor<br />Default: 200ms |
@@ -1713,7 +1713,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 
@@ -1863,7 +1863,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `path` | _string_ |  true  | Path is the path of the HTTP External Authorization service.<br />If path is specified, the authorization request will be sent to that path,<br />or else the authorization request will be sent to the root path. |
@@ -1962,6 +1962,7 @@ _Appears in:_
 | `xForwardedClientCert` | _[XForwardedClientCert](#xforwardedclientcert)_ |  false  | XForwardedClientCert configures how Envoy Proxy handle the x-forwarded-client-cert (XFCC) HTTP header.<br /><br />x-forwarded-client-cert (XFCC) is an HTTP header used to forward the certificate<br />information of part or all of the clients or proxies that a request has flowed through,<br />on its way from the client to the server.<br /><br />Envoy proxy may choose to sanitize/append/forward the XFCC header before proxying the request.<br /><br />If not set, the default behavior is sanitizing the XFCC header. |
 | `withUnderscoresAction` | _[WithUnderscoresAction](#withunderscoresaction)_ |  false  | WithUnderscoresAction configures the action to take when an HTTP header with underscores<br />is encountered. The default action is to reject the request. |
 | `preserveXRequestID` | _boolean_ |  false  | PreserveXRequestID configures Envoy to keep the X-Request-ID header if passed for a request that is edge<br />(Edge request is the request from external clients to front Envoy) and not reset it, which is the current Envoy behaviour.<br />It defaults to false. |
+| `earlyRequestHeaders` | _[HTTPHeaderFilter](#httpheaderfilter)_ |  false  | EarlyRequestHeaders defines settings for early request header modification, before envoy performs<br />routing, tracing and built-in header manipulation. |
 
 
 
@@ -2514,7 +2515,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  | Host define the extension service hostname.<br />Deprecated: Use BackendRefs instead. |
@@ -2873,7 +2874,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  | Host define the service hostname.<br />Deprecated: Use BackendRefs instead. |
@@ -3589,7 +3590,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `type` | _[TracingProviderType](#tracingprovidertype)_ |  true  | Type defines the tracing provider type. |
diff --git a/test/e2e/testdata/header-settings.yaml b/test/e2e/testdata/header-settings.yaml
new file mode 100644
index 000000000..dab686f29
--- /dev/null
+++ b/test/e2e/testdata/header-settings.yaml
@@ -0,0 +1,47 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: early-header-modifier-ctp
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: same-namespace
+  headers:
+    earlyRequestHeaders:
+      add:
+        - name: "early-added-header"
+          value: "early"
+      set:
+        - name: "early-set-header"
+          value: "early"
+      remove:
+        - "early-removed-header"
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-with-early-headers
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+    - name: same-namespace
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /early-header
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            add:
+              - name: early-added-header
+                value: late
+              - name: early-set-header
+                value: late
+              - name: early-removed-header
+                value: late
+      backendRefs:
+        - name: infra-backend-v1
+          port: 8080
diff --git a/test/e2e/tests/header_settings.go b/test/e2e/tests/header_settings.go
new file mode 100644
index 000000000..32f0d7310
--- /dev/null
+++ b/test/e2e/tests/header_settings.go
@@ -0,0 +1,75 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+//go:build e2e
+// +build e2e
+
+package tests
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/types"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+
+	"github.com/envoyproxy/gateway/internal/gatewayapi"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, HeaderSettingsTest)
+}
+
+var HeaderSettingsTest = suite.ConformanceTest{
+	ShortName:   "HeaderSettings",
+	Description: "Modify headers before regular processing",
+	Manifests:   []string{"testdata/header-settings.yaml"},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		t.Run("Early header modifications should apply", func(t *testing.T) {
+			ns := "gateway-conformance-infra"
+			routeNN := types.NamespacedName{Name: "http-with-early-headers", Namespace: ns}
+			gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+			gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
+
+			ancestorRef := gwapiv1a2.ParentReference{
+				Group:     gatewayapi.GroupPtr(gwapiv1.GroupName),
+				Kind:      gatewayapi.KindPtr(gatewayapi.KindGateway),
+				Namespace: gatewayapi.NamespacePtr(gwNN.Namespace),
+				Name:      gwapiv1.ObjectName(gwNN.Name),
+			}
+			ClientTrafficPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "early-header-modifier-ctp", Namespace: ns}, suite.ControllerName, ancestorRef)
+
+			expected := http.ExpectedResponse{
+				Request: http.Request{
+					Path: "/early-header",
+					Headers: map[string]string{
+						"early-added-header":   "client",
+						"early-set-header":     "client",
+						"early-removed-header": "client",
+					},
+				},
+				ExpectedRequest: &http.ExpectedRequest{
+					Request: http.Request{
+						Path: "/early-header",
+						Headers: map[string]string{
+							"early-added-header":   "client,early,late", // client, early and late are all added to header
+							"early-set-header":     "early,late",        // early set overwrites client value
+							"early-removed-header": "late",              // removed by early, so only late value exists
+						},
+					},
+				},
+				Response: http.Response{
+					StatusCode: 200,
+				},
+				Namespace: ns,
+			}
+
+			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expected)
+		})
+	},
+}