Repository: envoyproxy/gateway
Pull request #3297 (2024-04-29 04:35:49)

build(deps): bump github/codeql-action from 3.25.1 to 3.25.3
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.1 to 3.25.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.25.3 - 25 Apr 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.1. <a href="https://redirect.github.com/github/codeql-action/pull/2247">#2247</a></li>
<li>Workflows running on <code>macos-latest</code> using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as <code>macos-12</code>. ARM machines with SIP disabled, including the newest <code>macos-latest</code> image, are unsupported for CLI versions before 2.15.1. <a href="https://redirect.github.com/github/codeql-action/pull/2261">#2261</a></li>
</ul>
<h2>3.25.2 - 22 Apr 2024</h2>
<p>No user facing changes.</p>
<h2>3.25.1 - 17 Apr 2024</h2>
<ul>
<li>We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the <code>autobuild</code> <a href="https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes">build mode</a>. <a href="https://redirect.github.com/github/codeql-action/pull/2235">#2235</a></li>
<li>Fix a bug where the <code>init</code> Action would fail if <code>--overwrite</code> was specified in <code>CODEQL_ACTION_EXTRA_OPTIONS</code>. <a href="https://redirect.github.com/github/codeql-action/pull/2245">#2245</a></li>
</ul>
<h2>3.25.0 - 15 Apr 2024</h2>
<ul>
<li>
<p>The deprecated feature for extracting dependencies for a Python analysis has been removed. <a href="https://redirect.github.com/github/codeql-action/pull/2224">#2224</a></p>
<p>As a result, the following inputs and environment variables are now ignored:</p>
<ul>
<li>The <code>setup-python-dependencies</code> input to the <code>init</code> Action</li>
<li>The <code>CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION</code> environment variable</li>
</ul>
<p>We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.</p>
</li>
<li>
<p>Automatically overwrite an existing database if found on the filesystem. <a href="https://redirect.github.com/github/codeql-action/pull/2229">#2229</a></p>
</li>
<li>
<p>Bump the minimum CodeQL bundle version to 2.12.6. <a href="https://redirect.github.com/github/codeql-action/pull/2232">#2232</a></p>
</li>
<li>
<p>A more relevant log message and a diagnostic are now emitted when the <code>file</code> program is not installed on a Linux runner, but is required for Go tracing to succeed. <a href="https://redirect.github.com/github/codeql-action/pull/2234">#2234</a></p>
</li>
</ul>
<h2>3.24.10 - 05 Apr 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.0. <a href="https://redirect.github.com/github/codeql-action/pull/2219">#2219</a></li>
<li>Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. <a href="https://redirect.github.com/github/codeql-action/pull/2220">#2220</a>
<ul>
<li>If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.</li>
<li>Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace <code>github/codeql-action/*@v3</code> by <code>github/codeql-action/*@v3.24.10</code> and <code>github/codeql-action/*@v2</code> by <code>github/codeql-action/*@v2.24.10</code> in your code scanning workflow to ensure you continue using this version of the CodeQL Action.</li>
</ul>
</li>
</ul>
<h2>3.24.9 - 22 Mar 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.16.5. <a href="https://redirect.github.com/github/codeql-action/pull/2203">#2203</a></li>
</ul>
<h2>3.24.8 - 18 Mar 2024</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/github/codeql-action/commit/d39d31e687223d841ef683f52467bd88e9b21c14"><code>d39d31e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2262">#2262</a> from github/update-v3.25.3-ac2f82a1f</li>
<li><a href="https://github.com/github/codeql-action/commit/a7278252c70477c10a79034dae40a279c9a93c81"><code>a727825</code></a> Move changenote to most recent section</li>
<li><a href="https://github.com/github/codeql-action/commit/1efa8597b1a91824d046c53d4c10d77968957df1"><code>1efa859</code></a> Update changelog for v3.25.3</li>
<li><a href="https://github.com/github/codeql-action/commit/ac2f82a1ffdc5b61472756d5f098a9acf079c7bb"><code>ac2f82a</code></a> Log warning if SIP is disabled and CLI version is &lt; 2.15.1 (<a href="https://redirect.github.com/github/codeql-action/issues/2261">#2261</a>)</li>
<li><a href="https://github.com/github/codeql-action/commit/0ad7791640e0365754b29776b989bb8a341a45e9"><code>0ad7791</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2247">#2247</a> from github/update-bundle/codeql-bundle-v2.17.1</li>
<li><a href="https://github.com/github/codeql-action/commit/79d9ee7f07f81f562eade2095cbd714baeda85d8"><code>79d9ee7</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.17.1</li>
<li><a href="https://github.com/github/codeql-action/commit/dbf2b1706b768069fb1bb2dd2d8552be7a9e2a51"><code>dbf2b17</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2255">#2255</a> from github/mergeback/v3.25.2-to-main-8f596b4a</li>
<li><a href="https://github.com/github/codeql-action/commit/ff6a3c42a5824cbebd4b5610db68760f3896540a"><code>ff6a3c4</code></a> Update checked-in dependencies</li>
<li><a href="https://github.com/github/codeql-action/commit/619dc0c4b85a2de48427e29571874d67419d901f"><code>619dc0c</code></a> Update changelog and version after v3.25.2</li>
<li><a href="https://github.com/github/codeql-action/commit/8f596b4ae3cb3c588a5c46780b86dd53fef16c52"><code>8f596b4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2254">#2254</a> from github/update-v3.25.2-4909c1ffb</li>
<li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/c7f9125735019aa87cfc361530512d50ea439c71...d39d31e687223d841ef683f52467bd88e9b21c14">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=3.25.1&new-version=3.25.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

zirain: /retest
zirain: /retest

Patch:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 340072d79..78b0ad99e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@c7f9125735019aa87cfc361530512d50ea439c71  # v3.25.1
+      uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14  # v3.25.3
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@c7f9125735019aa87cfc361530512d50ea439c71  # v3.25.1
+      uses: github/codeql-action/autobuild@d39d31e687223d841ef683f52467bd88e9b21c14  # v3.25.3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@c7f9125735019aa87cfc361530512d50ea439c71  # v3.25.1
+      uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14  # v3.25.3
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/experimental_conformance.yaml b/.github/workflows/experimental_conformance.yaml
index 508f7b589..bebb22823 100644
--- a/.github/workflows/experimental_conformance.yaml
+++ b/.github/workflows/experimental_conformance.yaml
@@ -32,7 +32,7 @@ jobs:
       run: make experimental-conformance
 
     - name: Upload Conformance Report
-      uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba  # v4.3.2
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
       with:
         name: conformance-report-k8s-${{ matrix.version }}
         path: ./test/conformance/conformance-report-k8s-${{ matrix.version }}.yaml
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index dad78e901..20473358d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,13 +33,13 @@ jobs:
         publish_results: true
 
     - name: "Upload artifact"
-      uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba  # v4.3.2
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
       with:
         name: SARIF file
         path: results.sarif
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@c7f9125735019aa87cfc361530512d50ea439c71  # v3.25.1
+      uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14  # v3.25.3
       with:
         sarif_file: results.sarif
diff --git a/api/v1alpha1/ext_proc_types.go b/api/v1alpha1/ext_proc_types.go
index ef5e409d9..85f250c63 100644
--- a/api/v1alpha1/ext_proc_types.go
+++ b/api/v1alpha1/ext_proc_types.go
@@ -45,18 +45,15 @@ type ExtProcProcessingMode struct {
 	Response *ProcessingModeOptions `json:"response,omitempty"`
 }
 
-// +kubebuilder:validation:XValidation:rule="has(self.backendRef) ? (!has(self.backendRef.group) || self.backendRef.group == \"\") : true", message="group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) is supported"
-// +kubebuilder:validation:XValidation:rule="has(self.backendRef) ? (!has(self.backendRef.kind) || self.backendRef.kind == 'Service') : true", message="kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported"
-//
 // ExtProc defines the configuration for External Processing filter.
 type ExtProc struct {
-	// BackendRef defines the configuration of the external processing service
-	BackendRef ExtProcBackendRef `json:"backendRef"`
-
 	// BackendRefs defines the configuration of the external processing service
 	//
-	// +optional
-	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=1
+	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Service kind.",rule="self.all(f, f.kind == 'Service')"
+	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
+	BackendRefs []BackendRef `json:"backendRefs"`
 
 	// MessageTimeout is the timeout for a response to be returned from the external processor
 	// Default: 200ms
@@ -77,13 +74,3 @@ type ExtProc struct {
 	// +optional
 	ProcessingMode *ExtProcProcessingMode `json:"processingMode,omitempty"`
 }
-
-// ExtProcService defines the gRPC External Processing service using the envoy grpc client
-// The processing request and response messages are defined in
-// https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ext_proc/v3/external_processor.proto
-type ExtProcBackendRef struct {
-	// BackendObjectReference references a Kubernetes object that represents the
-	// backend server to which the processing requests will be sent.
-	// Only service Kind is supported for now.
-	gwapiv1.BackendObjectReference `json:",inline"`
-}
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 2dac33193..c3d53f443 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -1641,7 +1641,6 @@ func (in *ExtAuth) DeepCopy() *ExtAuth {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ExtProc) DeepCopyInto(out *ExtProc) {
 	*out = *in
-	in.BackendRef.DeepCopyInto(&out.BackendRef)
 	if in.BackendRefs != nil {
 		in, out := &in.BackendRefs, &out.BackendRefs
 		*out = make([]BackendRef, len(*in))
@@ -1676,22 +1675,6 @@ func (in *ExtProc) DeepCopy() *ExtProc {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ExtProcBackendRef) DeepCopyInto(out *ExtProcBackendRef) {
-	*out = *in
-	in.BackendObjectReference.DeepCopyInto(&out.BackendObjectReference)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtProcBackendRef.
-func (in *ExtProcBackendRef) DeepCopy() *ExtProcBackendRef {
-	if in == nil {
-		return nil
-	}
-	out := new(ExtProcBackendRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ExtProcProcessingMode) DeepCopyInto(out *ExtProcProcessingMode) {
 	*out = *in
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 257cc8372..f8c013541 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -54,83 +54,6 @@ spec:
                   description: ExtProc defines the configuration for External Processing
                     filter.
                   properties:
-                    backendRef:
-                      description: BackendRef defines the configuration of the external
-                        processing service
-                      properties:
-                        group:
-                          default: ""
-                          description: |-
-                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                            When unspecified or empty string, core API group is inferred.
-                          maxLength: 253
-                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                          type: string
-                        kind:
-                          default: Service
-                          description: |-
-                            Kind is the Kubernetes resource kind of the referent. For example
-                            "Service".
-
-
-                            Defaults to "Service" when not specified.
-
-
-                            ExternalName services can refer to CNAME DNS records that may live
-                            outside of the cluster and as such are difficult to reason about in
-                            terms of conformance. They also may not be safe to forward to (see
-                            CVE-2021-25740 for more information). Implementations SHOULD NOT
-                            support ExternalName Services.
-
-
-                            Support: Core (Services with a type other than ExternalName)
-
-
-                            Support: Implementation-specific (Services with type ExternalName)
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                          type: string
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
-                          description: |-
-                            Namespace is the namespace of the backend. When unspecified, the local
-                            namespace is inferred.
-
-
-                            Note that when a namespace different than the local namespace is specified,
-                            a ReferenceGrant object is required in the referent namespace to allow that
-                            namespace's owner to accept the reference. See the ReferenceGrant
-                            documentation for details.
-
-
-                            Support: Core
-                          maxLength: 63
-                          minLength: 1
-                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                          type: string
-                        port:
-                          description: |-
-                            Port specifies the destination port number to use for this resource.
-                            Port is required when the referent is a Kubernetes Service. In this
-                            case, the port number is the service port number, not the target port.
-                            For other resources, destination port might be derived from the referent
-                            resource or this field.
-                          format: int32
-                          maximum: 65535
-                          minimum: 1
-                          type: integer
-                      required:
-                      - name
-                      type: object
-                      x-kubernetes-validations:
-                      - message: Must have port for Service reference
-                        rule: '(size(self.group) == 0 && self.kind == ''Service'')
-                          ? has(self.port) : true'
                     backendRefs:
                       description: BackendRefs defines the configuration of the external
                         processing service
@@ -211,7 +134,14 @@ spec:
                         - message: Must have port for Service reference
                           rule: '(size(self.group) == 0 && self.kind == ''Service'')
                             ? has(self.port) : true'
+                      maxItems: 1
+                      minItems: 1
                       type: array
+                      x-kubernetes-validations:
+                      - message: BackendRefs only supports Service kind.
+                        rule: self.all(f, f.kind == 'Service')
+                      - message: BackendRefs only supports Core group.
+                        rule: self.all(f, f.group == '')
                     failOpen:
                       description: |-
                         FailOpen defines if requests or responses that cannot be processed due to connectivity to the
@@ -257,18 +187,8 @@ spec:
                           type: object
                       type: object
                   required:
-                  - backendRef
+                  - backendRefs
                   type: object
-                  x-kubernetes-validations:
-                  - message: group is invalid, only the core API group (specified
-                      by omitting the group field or setting it to an empty string)
-                      is supported
-                    rule: 'has(self.backendRef) ? (!has(self.backendRef.group) ||
-                      self.backendRef.group == "") : true'
-                  - message: kind is invalid, only Service (specified by omitting
-                      the kind field or setting it to 'Service') is supported
-                    rule: 'has(self.backendRef) ? (!has(self.backendRef.kind) || self.backendRef.kind
-                      == ''Service'') : true'
                 type: array
               targetRef:
                 description: |-
diff --git a/internal/gatewayapi/envoyextensionpolicy.go b/internal/gatewayapi/envoyextensionpolicy.go
index 655d4cb79..edb0dc385 100644
--- a/internal/gatewayapi/envoyextensionpolicy.go
+++ b/internal/gatewayapi/envoyextensionpolicy.go
@@ -10,13 +10,13 @@ import (
 	"fmt"
 	"sort"
 	"strings"
+	"time"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/utils/ptr"
 
-	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	gwv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gwv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
@@ -404,48 +404,79 @@ func (t *Translator) buildExtProc(
 	resources *Resources,
 ) (*ir.ExtProc, error) {
 	var (
-		backendRef *gwapiv1.BackendObjectReference
-		ds         *ir.DestinationSetting
-		authority  string
-		err        error
+		ds        *ir.DestinationSetting
+		authority string
+		err       error
 	)
 
-	backendRef = &extProc.BackendRef.BackendObjectReference
+	var dsl []*ir.DestinationSetting
+	for i := range extProc.BackendRefs {
+		if err = t.validateExtServiceBackendReference(
+			&extProc.BackendRefs[i].BackendObjectReference,
+			policyNamespacedName.Namespace,
+			resources); err != nil {
+			return nil, err
+		}
 
-	if err = t.validateExtServiceBackendReference(
-		backendRef,
-		policyNamespacedName.Namespace,
-		resources); err != nil {
-		return nil, err
-	}
+		ds, err = t.processExtServiceDestination(
+			&extProc.BackendRefs[i].BackendObjectReference,
+			policyNamespacedName,
+			egv1a1.KindEnvoyExtensionPolicy,
+			ir.GRPC,
+			resources)
 
-	authority = fmt.Sprintf(
-		"%s.%s:%d",
-		backendRef.Name,
-		NamespaceDerefOr(backendRef.Namespace, policyNamespacedName.Namespace),
-		*backendRef.Port)
+		if err != nil {
+			return nil, err
+		}
 
-	if ds, err = t.processExtServiceDestination(
-		backendRef,
-		policyNamespacedName,
-		egv1a1.KindEnvoyExtensionPolicy,
-		ir.GRPC,
-		resources); err != nil {
-		return nil, err
+		dsl = append(dsl, ds)
 	}
 
 	rd := ir.RouteDestination{
-		Name: irIndexedExtServiceDestinationName(policyNamespacedName, egv1a1.KindEnvoyExtensionPolicy,
-			string(backendRef.Name), extProcIdx),
-		Settings: []*ir.DestinationSetting{ds},
+		Name:     irIndexedExtServiceDestinationName(policyNamespacedName, egv1a1.KindEnvoyExtensionPolicy, extProcIdx),
+		Settings: dsl,
 	}
 
+	authority = fmt.Sprintf(
+		"%s.%s:%d",
+		extProc.BackendRefs[0].Name,
+		NamespaceDerefOr(extProc.BackendRefs[0].Namespace, policyNamespacedName.Namespace),
+		*extProc.BackendRefs[0].Port)
+
 	extProcIR := &ir.ExtProc{
 		Name:        name,
 		Destination: rd,
 		Authority:   authority,
 	}
 
+	if extProc.MessageTimeout != nil {
+		d, err := time.ParseDuration(string(*extProc.MessageTimeout))
+		if err != nil {
+			return nil, fmt.Errorf("invalid ExtProc MessageTimeout value %v", extProc.MessageTimeout)
+		}
+		extProcIR.MessageTimeout = ptr.To(metav1.Duration{Duration: d})
+	}
+
+	if extProc.FailOpen != nil {
+		extProcIR.FailOpen = extProc.FailOpen
+	}
+
+	if extProc.ProcessingMode != nil {
+		if extProc.ProcessingMode.Request != nil {
+			extProcIR.RequestHeaderProcessing = true
+			if extProc.ProcessingMode.Request.Body != nil {
+				extProcIR.RequestBodyProcessingMode = ptr.To(ir.ExtProcBodyProcessingMode(*extProc.ProcessingMode.Request.Body))
+			}
+		}
+
+		if extProc.ProcessingMode.Response != nil {
+			extProcIR.ResponseHeaderProcessing = true
+			if extProc.ProcessingMode.Response.Body != nil {
+				extProcIR.ResponseBodyProcessingMode = ptr.To(ir.ExtProcBodyProcessingMode(*extProc.ProcessingMode.Response.Body))
+			}
+		}
+	}
+
 	return extProcIR, err
 }
 
diff --git a/internal/gatewayapi/ext_service.go b/internal/gatewayapi/ext_service.go
index 6a9a5e225..ec1c77063 100644
--- a/internal/gatewayapi/ext_service.go
+++ b/internal/gatewayapi/ext_service.go
@@ -94,12 +94,11 @@ func (t *Translator) processExtServiceDestination(
 }
 
 // TODO: also refer to extension type, as WASM may also introduce destinations
-func irIndexedExtServiceDestinationName(policyNamespacedName types.NamespacedName, policyKind, service string, idx int) string {
+func irIndexedExtServiceDestinationName(policyNamespacedName types.NamespacedName, policyKind string, idx int) string {
 	return strings.ToLower(fmt.Sprintf(
-		"%s/%s/%s/%d/%s",
+		"%s/%s/%s/%d",
 		policyKind,
 		policyNamespacedName.Namespace,
 		policyNamespacedName.Name,
-		idx,
-		service))
+		idx))
 }
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index e28df915e..337720f7f 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -1909,6 +1909,17 @@ type ConnectionLimit struct {
 	CloseDelay *metav1.Duration `json:"closeDelay,omitempty" yaml:"closeDelay,omitempty"`
 }
 
+type ExtProcBodyProcessingMode egv1a1.ExtProcBodyProcessingMode
+
+const (
+	// ExtProcBodyStreamed sets the streamed body processing mode
+	ExtProcBodyStreamed = ExtProcBodyProcessingMode(egv1a1.StreamedExtProcBodyProcessingMode)
+	// ExtProcBodyBuffered sets the buffered body processing mode
+	ExtProcBodyBuffered = ExtProcBodyProcessingMode(egv1a1.BufferedExtProcBodyProcessingMode)
+	// ExtProcBodyBufferedPartial sets the partial buffered body processing mode
+	ExtProcBodyBufferedPartial = ExtProcBodyProcessingMode(egv1a1.BufferedPartialExtBodyHeaderProcessingMode)
+)
+
 // ExtProc holds the information associated with the ExtProc extensions.
 // +k8s:deepcopy-gen=true
 type ExtProc struct {
@@ -1917,10 +1928,29 @@ type ExtProc struct {
 	Name string `json:"name" yaml:"name"`
 
 	// Destination defines the destination for the gRPC External Processing service.
-	Destination RouteDestination `json:"destination"`
+	Destination RouteDestination `json:"destination" yaml:"destination"`
 
 	// Authority is the hostname:port of the HTTP External Processing service.
-	Authority string `json:"authority"`
+	Authority string `json:"authority" yaml:"authority"`
+
+	// MessageTimeout is the timeout for a response to be returned from the external processor
+	MessageTimeout *metav1.Duration `json:"messageTimeout,omitempty" yaml:"messageTimeout,omitempty"`
+
+	// FailOpen defines if requests or responses that cannot be processed due to connectivity to the
+	// external processor are terminated or passed-through.
+	FailOpen *bool `json:"failOpen,omitempty" yaml:"failOpen,omitempty"`
+
+	// RequestHeaderProcessing Defines if request headers are processed
+	RequestHeaderProcessing bool `json:"requestHeaderProcessing,omitempty" yaml:"requestHeaderProcessing,omitempty"`
+
+	// RequestBodyProcessingMode Defines request body processing
+	RequestBodyProcessingMode *ExtProcBodyProcessingMode `json:"requestBodyProcessingMode,omitempty" yaml:"requestBodyProcessingMode,omitempty"`
+
+	// ResponseHeaderProcessingMode Defines if response headers are processed
+	ResponseHeaderProcessing bool `json:"responseHeaderProcessing,omitempty" yaml:"responseHeaderProcessing,omitempty"`
+
+	// ResponseBodyProcessingMode Defines response body processing
+	ResponseBodyProcessingMode *ExtProcBodyProcessingMode `json:"responseBodyProcessingMode,omitempty" yaml:"responseBodyProcessingMode,omitempty"`
 }
 
 // Wasm holds the information associated with the Wasm extensions.
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index 21f6cdf87..5430ef9ce 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -532,6 +532,26 @@ func (in *ExtAuth) DeepCopy() *ExtAuth {
 func (in *ExtProc) DeepCopyInto(out *ExtProc) {
 	*out = *in
 	in.Destination.DeepCopyInto(&out.Destination)
+	if in.MessageTimeout != nil {
+		in, out := &in.MessageTimeout, &out.MessageTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.FailOpen != nil {
+		in, out := &in.FailOpen, &out.FailOpen
+		*out = new(bool)
+		**out = **in
+	}
+	if in.RequestBodyProcessingMode != nil {
+		in, out := &in.RequestBodyProcessingMode, &out.RequestBodyProcessingMode
+		*out = new(ExtProcBodyProcessingMode)
+		**out = **in
+	}
+	if in.ResponseBodyProcessingMode != nil {
+		in, out := &in.ResponseBodyProcessingMode, &out.ResponseBodyProcessingMode
+		*out = new(ExtProcBodyProcessingMode)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtProc.
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index cf707f079..93ce3fe91 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -1476,38 +1476,40 @@ func (r *gatewayAPIReconciler) processEnvoyExtensionPolicyObjectRefs(
 	for _, policy := range resourceTree.EnvoyExtensionPolicies {
 		// Add the referenced BackendRefs and ReferenceGrants in ExtAuth to Maps for later processing
 		for _, ep := range policy.Spec.ExtProc {
-			backendRef := ep.BackendRef.BackendObjectReference
-
-			backendNamespace := gatewayapi.NamespaceDerefOr(backendRef.Namespace, policy.Namespace)
-			resourceMap.allAssociatedBackendRefs[gwapiv1.BackendObjectReference{
-				Group:     backendRef.Group,
-				Kind:      backendRef.Kind,
-				Namespace: gatewayapi.NamespacePtrV1Alpha2(backendNamespace),
-				Name:      backendRef.Name,
-			}] = struct{}{}
-
-			if backendNamespace != policy.Namespace {
-				from := ObjectKindNamespacedName{
-					kind:      gatewayapi.KindHTTPRoute,
-					namespace: policy.Namespace,
-					name:      policy.Name,
-				}
-				to := ObjectKindNamespacedName{
-					kind:      gatewayapi.KindDerefOr(backendRef.Kind, gatewayapi.KindService),
-					namespace: backendNamespace,
-					name:      string(backendRef.Name),
-				}
-				refGrant, err := r.findReferenceGrant(ctx, from, to)
-				switch {
-				case err != nil:
-					r.log.Error(err, "failed to find ReferenceGrant")
-				case refGrant == nil:
-					r.log.Info("no matching ReferenceGrants found", "from", from.kind,
-						"from namespace", from.namespace, "target", to.kind, "target namespace", to.namespace)
-				default:
-					resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
-					r.log.Info("added ReferenceGrant to resource map", "namespace", refGrant.Namespace,
-						"name", refGrant.Name)
+			for _, br := range ep.BackendRefs {
+				backendRef := br.BackendObjectReference
+
+				backendNamespace := gatewayapi.NamespaceDerefOr(backendRef.Namespace, policy.Namespace)
+				resourceMap.allAssociatedBackendRefs[gwapiv1.BackendObjectReference{
+					Group:     backendRef.Group,
+					Kind:      backendRef.Kind,
+					Namespace: gatewayapi.NamespacePtrV1Alpha2(backendNamespace),
+					Name:      backendRef.Name,
+				}] = struct{}{}
+
+				if backendNamespace != policy.Namespace {
+					from := ObjectKindNamespacedName{
+						kind:      gatewayapi.KindHTTPRoute,
+						namespace: policy.Namespace,
+						name:      policy.Name,
+					}
+					to := ObjectKindNamespacedName{
+						kind:      gatewayapi.KindDerefOr(backendRef.Kind, gatewayapi.KindService),
+						namespace: backendNamespace,
+						name:      string(backendRef.Name),
+					}
+					refGrant, err := r.findReferenceGrant(ctx, from, to)
+					switch {
+					case err != nil:
+						r.log.Error(err, "failed to find ReferenceGrant")
+					case refGrant == nil:
+						r.log.Info("no matching ReferenceGrants found", "from", from.kind,
+							"from namespace", from.namespace, "target", to.kind, "target namespace", to.namespace)
+					default:
+						resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
+						r.log.Info("added ReferenceGrant to resource map", "namespace", refGrant.Namespace,
+							"name", refGrant.Name)
+					}
 				}
 			}
 		}
diff --git a/internal/provider/kubernetes/indexers.go b/internal/provider/kubernetes/indexers.go
index ac1132b31..44526e1e9 100644
--- a/internal/provider/kubernetes/indexers.go
+++ b/internal/provider/kubernetes/indexers.go
@@ -38,7 +38,7 @@ const (
 	configMapCtpIndex                = "configMapCtpIndex"
 	secretCtpIndex                   = "secretCtpIndex"
 	configMapBtlsIndex               = "configMapBtlsIndex"
-	backendEnvoyExtensionPolicyIndex = "backendSecurityPolicyIndex"
+	backendEnvoyExtensionPolicyIndex = "backendEnvoyExtensionPolicyIndex"
 )
 
 func addReferenceGrantIndexers(ctx context.Context, mgr manager.Manager) error {
@@ -535,12 +535,16 @@ func backendEnvoyExtensionPolicyIndexFunc(rawObj client.Object) []string {
 	var ret []string
 
 	for _, ep := range envoyExtensionPolicy.Spec.ExtProc {
-		backendRef := ep.BackendRef.BackendObjectReference
-		ret = append(ret,
-			types.NamespacedName{
-				Namespace: gatewayapi.NamespaceDerefOr(backendRef.Namespace, envoyExtensionPolicy.Namespace),
-				Name:      string(backendRef.Name),
-			}.String())
+
+		for _, br := range ep.BackendRefs {
+			backendRef := br.BackendObjectReference
+			ret = append(ret,
+				types.NamespacedName{
+					Namespace: gatewayapi.NamespaceDerefOr(backendRef.Namespace, envoyExtensionPolicy.Namespace),
+					Name:      string(backendRef.Name),
+				}.String())
+		}
+
 	}
 
 	return ret
diff --git a/internal/xds/translator/extproc.go b/internal/xds/translator/extproc.go
index 7ed060824..c31185211 100644
--- a/internal/xds/translator/extproc.go
+++ b/internal/xds/translator/extproc.go
@@ -12,11 +12,13 @@ import (
 	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	extprocv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_proc/v3"
 	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
-	"github.com/golang/protobuf/ptypes/duration"
-	"google.golang.org/protobuf/types/known/anypb"
 
 	"github.com/envoyproxy/gateway/internal/ir"
 	"github.com/envoyproxy/gateway/internal/xds/types"
+
+	"github.com/golang/protobuf/ptypes/duration"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
 )
 
 const (
@@ -106,6 +108,38 @@ func extProcConfig(extProc ir.ExtProc) *extprocv3.ExternalProcessor {
 				Seconds: defaultExtServiceRequestTimeout,
 			},
 		},
+		ProcessingMode: &extprocv3.ProcessingMode{
+			RequestHeaderMode:   extprocv3.ProcessingMode_SKIP,
+			ResponseHeaderMode:  extprocv3.ProcessingMode_SKIP,
+			RequestBodyMode:     extprocv3.ProcessingMode_NONE,
+			ResponseBodyMode:    extprocv3.ProcessingMode_NONE,
+			RequestTrailerMode:  extprocv3.ProcessingMode_SKIP,
+			ResponseTrailerMode: extprocv3.ProcessingMode_SKIP,
+		},
+	}
+
+	if extProc.FailOpen != nil {
+		config.FailureModeAllow = *extProc.FailOpen
+	}
+
+	if extProc.MessageTimeout != nil {
+		config.MessageTimeout = durationpb.New(extProc.MessageTimeout.Duration)
+	}
+
+	if extProc.RequestBodyProcessingMode != nil {
+		config.ProcessingMode.RequestBodyMode = buildExtProcBodyProcessingMode(extProc.RequestBodyProcessingMode)
+	}
+
+	if extProc.RequestHeaderProcessing {
+		config.ProcessingMode.RequestHeaderMode = extprocv3.ProcessingMode_SEND
+	}
+
+	if extProc.ResponseBodyProcessingMode != nil {
+		config.ProcessingMode.ResponseBodyMode = buildExtProcBodyProcessingMode(extProc.ResponseBodyProcessingMode)
+	}
+
+	if extProc.ResponseHeaderProcessing {
+		config.ProcessingMode.ResponseHeaderMode = extprocv3.ProcessingMode_SEND
 	}
 
 	return config
@@ -173,3 +207,15 @@ func (*extProc) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	}
 	return nil
 }
+
+func buildExtProcBodyProcessingMode(mode *ir.ExtProcBodyProcessingMode) extprocv3.ProcessingMode_BodySendMode {
+	lookup := map[ir.ExtProcBodyProcessingMode]extprocv3.ProcessingMode_BodySendMode{
+		ir.ExtProcBodyBuffered:        extprocv3.ProcessingMode_BUFFERED,
+		ir.ExtProcBodyBufferedPartial: extprocv3.ProcessingMode_BUFFERED_PARTIAL,
+		ir.ExtProcBodyStreamed:        extprocv3.ProcessingMode_STREAMED,
+	}
+	if r, found := lookup[*mode]; found {
+		return r
+	}
+	return extprocv3.ProcessingMode_NONE
+}
diff --git a/internal/xds/translator/translator.go b/internal/xds/translator/translator.go
index 19ab59f85..eaef03e97 100644
--- a/internal/xds/translator/translator.go
+++ b/internal/xds/translator/translator.go
@@ -661,29 +661,6 @@ func processXdsCluster(tCtx *types.ResourceVersionTable, httpRoute *ir.HTTPRoute
 	return nil
 }
 
-// processTLSSocket generates a xDS TransportSocket for a given TLS config.
-// It also adds the necessary secrets to the resource version table.
-func processTLSSocket(tlsConfig *ir.TLSUpstreamConfig, tCtx *types.ResourceVersionTable) (*corev3.TransportSocket, error) {
-	if tlsConfig == nil {
-		return nil, nil
-	}
-	// Create a secret for the CA certificate only if it's not using the system trust store
-	if !tlsConfig.UseSystemTrustStore {
-		CaSecret := buildXdsUpstreamTLSCASecret(tlsConfig)
-		if err := tCtx.AddXdsResource(resourcev3.SecretType, CaSecret); err != nil {
-			return nil, err
-		}
-	}
-
-	// for upstreamTLS , a fixed sni can be used. use auto_sni otherwise
-	// https://www.envoyproxy.io/docs/envoy/latest/faq/configuration/sni#faq-how-to-setup-sni:~:text=For%20clusters%2C%20a,for%20trust%20anchor.
-	tlsSocket, err := buildXdsUpstreamTLSSocketWthCert(tlsConfig)
-	if err != nil {
-		return nil, err
-	}
-	return tlsSocket, nil
-}
-
 // findXdsSecret finds a xds secret with the same name, and returns nil if there is no match.
 func findXdsSecret(tCtx *types.ResourceVersionTable, name string) *tlsv3.Secret {
 	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.SecretType] == nil {
diff --git a/internal/xds/translator/utils.go b/internal/xds/translator/utils.go
index dbcb005ef..b4f60b1ae 100644
--- a/internal/xds/translator/utils.go
+++ b/internal/xds/translator/utils.go
@@ -144,13 +144,6 @@ func createExtServiceXDSCluster(rd *ir.RouteDestination, tCtx *types.ResourceVer
 		endpointType = EndpointTypeStatic
 	}
 
-	if rd.Settings[0].TLS != nil {
-		tSocket, err = processTLSSocket(rd.Settings[0].TLS, tCtx)
-		if err != nil {
-			return err
-		}
-	}
-
 	if err = addXdsCluster(tCtx, &xdsClusterArgs{
 		name:         rd.Name,
 		settings:     rd.Settings,
diff --git a/site/content/en/v1.0.1/tasks/security/oidc.md b/site/content/en/v1.0.1/tasks/security/oidc.md
index 81bdaa882..c11a52bbf 100644
--- a/site/content/en/v1.0.1/tasks/security/oidc.md
+++ b/site/content/en/v1.0.1/tasks/security/oidc.md
@@ -2,9 +2,9 @@
 title: "OIDC Authentication"
 ---
 
-This guide provides instructions for configuring [OpenID Connect (OIDC)][oidc] authentication.
+This task provides instructions for configuring [OpenID Connect (OIDC)][oidc] authentication.
 OpenID Connect (OIDC) is an authentication standard built on top of OAuth 2.0.
-It enables client applications to rely on authentication that is performed by an OpenID Connect Provider (OP)
+It enables EG to rely on authentication that is performed by an OpenID Connect Provider (OP)
 to verify the identity of a user.
 
 Envoy Gateway introduces a new CRD called [SecurityPolicy][SecurityPolicy] that allows the user to configure OIDC
@@ -13,22 +13,23 @@ This instantiated resource can be linked to a [Gateway][Gateway] and [HTTPRoute]
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) guide to install Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
 Before proceeding, you should be able to query the example backend using HTTP.
 
+EG OIDC authentication requires the redirect URL to be HTTPS. Follow the [Secure Gateways](../secure-gateways) guide
+to generate the TLS certificates and update the Gateway configuration to add an HTTPS listener.
+
 Verify the Gateway status:
 
 ```shell
 kubectl get gateway/eg -o yaml
 ```
 
-OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
-the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations. 
-
-This guide demonstrates the configuration of OIDC at the HTTPRoute level.
-
 Let's create an HTTPRoute that represents an application protected by OIDC.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -50,22 +51,54 @@ spec:
 EOF
 ```
 
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: myapp
+spec:
+  parentRefs:
+  - name: eg
+  hostnames: ["www.example.com"]
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /myapp
+    backendRefs:
+    - name: backend
+      port: 3000
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
+
 Verify the HTTPRoute status:
 
 ```shell
 kubectl get httproute/myapp -o yaml
 ```
 
-## Configuration
+## OIDC Authentication for a HTTPRoute
 
-This guide uses Google as the OIDC provider to demonstrate the configuration of OIDC. However, EG works with any OIDC
-providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc.
+OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
+the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations.
+
+This section demonstrates how to configure OIDC authentication for a specific HTTPRoute.
 
 ### Register an OIDC application
 
+This task uses Google as the OIDC provider to demonstrate the configuration of OIDC. However, EG works with any OIDC
+providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc.
+
 Follow the steps in the [Google OIDC documentation][google-oidc] to register an OIDC application. Please make sure the
 redirect URL is set to the one you configured in the SecurityPolicy that you will create in the step below. In this example,
-the redirect URL is `http://www.example.com:8080/myapp/oauth2/callback`.
+the redirect URL is `http://www.example.com:8443/myapp/oauth2/callback`.
 
 After registering the application, you should have the following information:
 * Client ID: The client ID of the OIDC application.
@@ -79,20 +112,22 @@ and the Client Secret must be stored in the key "client-secret".
 Note: please replace the ${CLIENT_SECRET} with the actual Client Secret that you got from the previous step.
 
 ```shell
-$ kubectl create secret generic my-app-client-secret --from-literal=client-secret=${CLIENT_SECRET}
-secret "my-app-client-secret" created
+kubectl create secret generic my-app-client-secret --from-literal=client-secret=${CLIENT_SECRET}
 ```
 
 ### Create a SecurityPolicy
 
-Please notice that the `redirectURL` and `logoutPath` must match the target HTTPRoute. In this example, the target
-HTTPRoute is configured to match the host `www.example.com` and the path `/myapp`, so the `redirectURL` must be prefixed 
-with `http://www.example.com:8080/myapp`, and `logoutPath` must be prefixed with`/myapp`, otherwise the OIDC authentication 
-will fail because the redirect and logout requests will not match the target HTTPRoute and therefore can't be processed 
+**Please notice that the `redirectURL` and `logoutPath` must match the target HTTPRoute.** In this example, the target
+HTTPRoute is configured to match the host `www.example.com` and the path `/myapp`, so the `redirectURL` must be prefixed
+with `https://www.example.com:8443/myapp`, and `logoutPath` must be prefixed with`/myapp`, otherwise the OIDC authentication
+will fail because the redirect and logout requests will not match the target HTTPRoute and therefore can't be processed
 by the OAuth2 filter on that HTTPRoute.
 
 Note: please replace the ${CLIENT_ID} in the below yaml snippet with the actual Client ID that you got from the OIDC provider.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -110,25 +145,53 @@ spec:
     clientID: "${CLIENT_ID}"
     clientSecret:
       name: "my-app-client-secret"
-    redirectURL: "http://www.example.com:8080/myapp/oauth2/callback"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
     logoutPath: "/myapp/logout"
 EOF
 ```
 
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: myapp
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
+
 Verify the SecurityPolicy configuration:
 
 ```shell
 kubectl get securitypolicy/oidc-example -o yaml
 ```
 
-## Testing
+### Testing
 
 Port forward gateway port to localhost:
 
 ```shell
 export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
 
-kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8080:80
+kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8443:443
 ```
 
 Put www.example.com in the /etc/hosts file in your test machine, so we can use this host name to access the gateway from a browser:
@@ -138,12 +201,107 @@ Put www.example.com in the /etc/hosts file in your test machine, so we can use t
 127.0.0.1 www.example.com
 ```
 
-Open a browser and navigate to the `http://www.example.com:8080/myapp` address. You should be redirected to the Google 
+Open a browser and navigate to the `https://www.example.com:8443/myapp` address. You should be redirected to the Google
 login page. After you successfully login, you should see the response from the backend service.
 
+Clean the cookies in the browser and try to access `https://www.example.com:8443/foo` address. You should be able to see
+this page since the path `/foo` is not protected by the OIDC policy.
+
+## OIDC Authentication for a Gateway
+
+OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
+the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations.
+
+This section demonstrates how to configure OIDC authentication for a Gateway.
+
+### Register an OIDC application
+
+If you haven't registered an OIDC application, follow the steps in the previous section to register an OIDC application.
+
+### Create a kubernetes secret
+
+If you haven't created a kubernetes secret, follow the steps in the previous section to create a kubernetes secret.
+
+### Create a SecurityPolicy
+
+Create or update the SecurityPolicy to target the Gateway instead of the HTTPRoute. **Please notice that the `redirectURL`
+and `logoutPath` must match one of the HTTPRoutes associated with the Gateway.** In this example, the target Gateway has
+two HTTPRoutes associated with it, one with the host `www.example.com` and the path `/myapp`, and the other with the host
+`www.example.com` and the path `/`. Either one of the HTTPRoutes can be used to match the `redirectURL` and `logoutPath`.
+
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+EOF
+```
+
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
+
+Verify the SecurityPolicy configuration:
+
+```shell
+kubectl get securitypolicy/oidc-example -o yaml
+```
+
+### Testing
+
+If you haven't done so, follow the steps in the previous section to port forward gateway port to localhost and put
+www.example.com in the /etc/hosts file in your test machine.
+
+Open a browser and navigate to the `https://www.example.com:8443/foo` address. You should be redirected to the Google
+login page. After you successfully login, you should see the response from the backend service.
+
+You can also try to access `https://www.example.com:8443/myapp` address. You should be able to see this page since the
+path `/myapp` is protected by the same OIDC policy.
+
 ## Clean-Up
 
-Follow the steps from the [Quickstart](../../quickstart) guide to uninstall Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../../quickstart) to uninstall Envoy Gateway and the example manifest.
 
 Delete the SecurityPolicy, the secret and the HTTPRoute:
 
@@ -155,10 +313,10 @@ kubectl delete httproute/myapp
 
 ## Next Steps
 
-Checkout the [Developer Guide](../../../contributions/develop) to get involved in the project.
+Checkout the [Developer Guide](../../../../contributions/develop) to get involved in the project.
 
 [oidc]: https://openid.net/connect/
 [google-oidc]: https://developers.google.com/identity/protocols/oauth2/openid-connect
-[SecurityPolicy]: ../../../contributions/design/security-policy
+[SecurityPolicy]: ../../../../contributions/design/security-policy
 [Gateway]: https://gateway-api.sigs.k8s.io/api-types/gateway
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute
diff --git a/site/content/en/v1.0.1/tasks/security/secure-gateways.md b/site/content/en/v1.0.1/tasks/security/secure-gateways.md
index e56a496e0..52bf8c9cb 100644
--- a/site/content/en/v1.0.1/tasks/security/secure-gateways.md
+++ b/site/content/en/v1.0.1/tasks/security/secure-gateways.md
@@ -236,7 +236,7 @@ Lastly, test connectivity using the above [Testing section](#testing).
 
 ## Clean-Up
 
-Follow the steps from the [Quickstart](../../quickstart) to uninstall Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../quickstart) to uninstall Envoy Gateway and the example manifest.
 
 Delete the Secrets:
 
@@ -362,7 +362,7 @@ This sections gives a walkthrough to generate multiple certificates correspondin
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway and the example manifest.
 Before proceeding, you should be able to query the example backend using HTTP.
 
 Follow the steps in the [TLS Certificates](#tls-certificates) section to generate self-signed RSA derived Server certificate and private key, and configure those in the Gateway listener configuration to terminate HTTPS traffic.


Test patch:
diff --git a/.github/workflows/build_and_test.yaml b/.github/workflows/build_and_test.yaml
index f6030a453..94d081ed4 100644
--- a/.github/workflows/build_and_test.yaml
+++ b/.github/workflows/build_and_test.yaml
@@ -70,7 +70,7 @@ jobs:
       run: make build-multiarch PLATFORMS="linux_amd64 linux_arm64"
 
     - name: Upload EG Binaries
-      uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba  # v4.3.2
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
       with:
         name: envoy-gateway
         path: bin/
@@ -86,7 +86,7 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
-      uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d  # v4.1.5
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e  # v4.1.7
       with:
         name: envoy-gateway
         path: bin/
@@ -114,7 +114,7 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
-      uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d  # v4.1.5
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e  # v4.1.7
       with:
         name: envoy-gateway
         path: bin/
@@ -139,7 +139,7 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
-      uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d  # v4.1.5
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e  # v4.1.7
       with:
         name: envoy-gateway
         path: bin/
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.in.yaml
index 0f6d26cf6..6f4ed53ab 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.in.yaml
@@ -26,6 +26,6 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: envoy-gateway
     extProc:
-    - backendRef:
-        name: grpc-backend-4
+    - backendRefs:
+      - name: grpc-backend-4
         port: 4000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
index 1deb8ca6b..a545e5862 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend-4
+    - backendRefs:
+      - name: grpc-backend-4
         port: 4000
     targetRef:
       group: gateway.networking.k8s.io
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml
index ce4ecde37..1d4c61cc7 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml
@@ -86,8 +86,8 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: envoy-gateway
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         port: 9000
 - apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: EnvoyExtensionPolicy
@@ -101,6 +101,6 @@ envoyExtensionPolicies:
       name: httproute-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend-2
+    - backendRefs:
+      - name: grpc-backend-2
         port: 8000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
index 0fd8d36b3..cc9921a6b 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend-2
+    - backendRefs:
+      - name: grpc-backend-2
         port: 8000
     targetRef:
       group: gateway.networking.k8s.io
@@ -38,8 +38,8 @@ envoyExtensionPolicies:
     namespace: envoy-gateway
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         port: 9000
     targetRef:
       group: gateway.networking.k8s.io
@@ -231,7 +231,7 @@ xdsIR:
         extProc:
         - authority: grpc-backend-2.default:8000
           destination:
-            name: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+            name: envoyextensionpolicy/default/policy-for-route-1/0
             settings:
             - protocol: GRPC
               weight: 1
@@ -258,7 +258,7 @@ xdsIR:
         extProc:
         - authority: grpc-backend.envoy-gateway:9000
           destination:
-            name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+            name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
             settings:
             - protocol: GRPC
               weight: 1
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.in.yaml
index 789891273..982d7da84 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.in.yaml
@@ -55,6 +55,6 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         port: 4000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
index 55e0b6618..740230fbf 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         port: 4000
     targetRef:
       group: gateway.networking.k8s.io
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.in.yaml
index b2420abfa..abb0bf365 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.in.yaml
@@ -55,5 +55,5 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
index 05db4b443..50c1a7371 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.in.yaml
index 6d3ec1fdd..71f453ec9 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.in.yaml
@@ -55,7 +55,7 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 9000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
index c4ad278a6..f62b31daa 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 9000
     targetRef:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.in.yaml
index eff5a17ef..b58eeee09 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.in.yaml
@@ -46,7 +46,7 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 9000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
index 7155bfe72..3ea2c40f4 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
@@ -7,8 +7,8 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 9000
     targetRef:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml
index 21c6fab45..fb3d3cab1 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml
@@ -201,10 +201,17 @@ envoyExtensionPolicies:
       name: gateway-1
       namespace: default
     extProc:
-    - backendRef:
-        Name: grpc-backend
+    - backendRefs:
+      - Name: grpc-backend
         Namespace: envoy-gateway
         Port: 8000
+      processingMode:
+        request:
+          body: Buffered
+        response:
+          body: Streamed
+      messageTimeout: 5s
+      failOpen: true
 - apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: EnvoyExtensionPolicy
   metadata:
@@ -217,6 +224,9 @@ envoyExtensionPolicies:
       name: httproute-1
       namespace: default
     extProc:
-    - backendRef:
-        Name: grpc-backend-2
+    - backendRefs:
+      - Name: grpc-backend-2
         Port: 9000
+      processingMode:
+        request: {}
+        response: {}
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
index c8eb952e5..e33b83f0e 100755
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
@@ -73,9 +73,12 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend-2
+    - backendRefs:
+      - name: grpc-backend-2
         port: 9000
+      processingMode:
+        request: {}
+        response: {}
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
@@ -104,10 +107,17 @@ envoyExtensionPolicies:
     namespace: default
   spec:
     extProc:
-    - backendRef:
-        name: grpc-backend
+    - backendRefs:
+      - name: grpc-backend
         namespace: envoy-gateway
         port: 8000
+      failOpen: true
+      messageTimeout: 5s
+      processingMode:
+        request:
+          body: Buffered
+        response:
+          body: Streamed
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
@@ -298,7 +308,7 @@ xdsIR:
         extProc:
         - authority: grpc-backend-2.default:9000
           destination:
-            name: envoyextensionpolicy/default/policy-for-http-route/0/grpc-backend-2
+            name: envoyextensionpolicy/default/policy-for-http-route/0
             settings:
             - addressType: IP
               endpoints:
@@ -312,6 +322,8 @@ xdsIR:
                 sni: grpc-backend-2
               weight: 1
           name: envoyextensionpolicy/default/policy-for-http-route/0
+          requestHeaderProcessing: true
+          responseHeaderProcessing: true
         hostname: www.foo.com
         isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
@@ -334,7 +346,7 @@ xdsIR:
         extProc:
         - authority: grpc-backend.envoy-gateway:8000
           destination:
-            name: envoyextensionpolicy/default/policy-for-gateway/0/grpc-backend
+            name: envoyextensionpolicy/default/policy-for-gateway/0
             settings:
             - addressType: IP
               protocol: GRPC
@@ -344,7 +356,13 @@ xdsIR:
                   name: policy-btls-grpc/default-ca
                 sni: grpc-backend
               weight: 1
+          failOpen: true
+          messageTimeout: 5s
           name: envoyextensionpolicy/default/policy-for-gateway/0
+          requestBodyProcessingMode: Buffered
+          requestHeaderProcessing: true
+          responseBodyProcessingMode: Streamed
+          responseHeaderProcessing: true
         hostname: www.bar.com
         isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml
new file mode 100644
index 000000000..a278b45a9
--- /dev/null
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml
@@ -0,0 +1,192 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: /foo
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: /bar
+      backendRefs:
+      - name: service-1
+        port: 8080
+services:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: envoy-gateway
+    name: grpc-backend
+  spec:
+    ports:
+    - port: 8000
+      name: grpc
+      protocol: TCP
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: default
+    name: grpc-backend-2
+  spec:
+    ports:
+    - port: 9000
+      name: grpc
+      protocol: TCP
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: grpc-backend
+  addressType: IPv4
+  ports:
+  - name: http
+    protocol: TCP
+    port: 8000
+  endpoints:
+  - addresses:
+    - 7.7.7.7
+    conditions:
+      ready: true
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend-2
+    namespace: default
+    labels:
+      kubernetes.io/service-name: grpc-backend-2
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 9000
+  endpoints:
+  - addresses:
+    - 8.8.8.8
+    conditions:
+      ready: true
+referenceGrants:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: ReferenceGrant
+  metadata:
+    namespace: envoy-gateway
+    name: referencegrant-1
+  spec:
+    from:
+    - group: gateway.envoyproxy.io
+      kind: SecurityPolicy
+      namespace: default
+    - group: gateway.networking.k8s.io
+      kind: BackendTLSPolicy
+      namespace: default
+    to:
+    - group: ''
+      kind: Service
+configMaps:
+- apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: ca-cmap
+    namespace: default
+  data:
+    ca.crt: |
+      -----BEGIN CERTIFICATE-----
+      MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+      BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+      MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+      A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+      1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+      yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+      kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+      Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+      ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+      bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+      6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+      BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+      2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+      i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+      A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+      d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+      3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+      -----END CERTIFICATE-----
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    name: policy-btls-grpc
+    namespace: default
+  spec:
+    targetRef:
+      group: ''
+      kind: Service
+      name: grpc-backend
+      namespace: envoy-gateway
+      sectionName: "8000"
+    tls:
+      caCertRefs:
+      - name: ca-cmap
+        group: ''
+        kind: ConfigMap
+      hostname: grpc-backend
+envoyExtensionPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    extProc:
+    - backendRefs:
+      - Name: grpc-backend
+        Namespace: envoy-gateway
+        Port: 8000
+      - Name: grpc-backend-2
+        Port: 9000
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
new file mode 100755
index 000000000..a26a321d6
--- /dev/null
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
@@ -0,0 +1,277 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls-grpc
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: grpc-backend
+      namespace: envoy-gateway
+      sectionName: "8000"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: grpc-backend
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.envoyproxy.io
+        kind: EnvoyExtensionPolicy
+        name: policy-for-http-route
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+envoyExtensionPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    extProc:
+    - backendRefs:
+      - name: grpc-backend
+        namespace: envoy-gateway
+        port: 8000
+      - name: grpc-backend-2
+        port: 9000
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: default
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extProc:
+        - authority: grpc-backend.envoy-gateway:8000
+          destination:
+            name: envoyextensionpolicy/default/policy-for-http-route/0
+            settings:
+            - addressType: IP
+              protocol: GRPC
+              tls:
+                caCertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls-grpc/default-ca
+                sni: grpc-backend
+              weight: 1
+            - addressType: IP
+              endpoints:
+              - host: 8.8.8.8
+                port: 9000
+              protocol: GRPC
+              weight: 1
+          name: envoyextensionpolicy/default/policy-for-http-route/0
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/internal/provider/kubernetes/predicates_test.go b/internal/provider/kubernetes/predicates_test.go
index e9f24d6e5..b23ebb41d 100644
--- a/internal/provider/kubernetes/predicates_test.go
+++ b/internal/provider/kubernetes/predicates_test.go
@@ -530,9 +530,11 @@ func TestValidateServiceForReconcile(t *testing.T) {
 						},
 						ExtProc: []v1alpha1.ExtProc{
 							{
-								BackendRef: v1alpha1.ExtProcBackendRef{
-									BackendObjectReference: gwapiv1.BackendObjectReference{
-										Name: "ext-proc-service",
+								BackendRefs: []v1alpha1.BackendRef{
+									{
+										BackendObjectReference: gwapiv1.BackendObjectReference{
+											Name: "ext-proc-service",
+										},
 									},
 								},
 							},
@@ -559,9 +561,11 @@ func TestValidateServiceForReconcile(t *testing.T) {
 						},
 						ExtProc: []v1alpha1.ExtProc{
 							{
-								BackendRef: v1alpha1.ExtProcBackendRef{
-									BackendObjectReference: gwapiv1.BackendObjectReference{
-										Name: "ext-proc-service",
+								BackendRefs: []v1alpha1.BackendRef{
+									{
+										BackendObjectReference: gwapiv1.BackendObjectReference{
+											Name: "ext-proc-service",
+										},
 									},
 								},
 							},
diff --git a/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml b/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml
index 170f1a3f2..90fd06748 100644
--- a/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/ext-proc.yaml
@@ -21,22 +21,30 @@ http:
                   port: 8080
               protocol: HTTP
               weight: 1
-        envoyExtensionFeatures:
-          extProc:
-            - name: envoyextensionpolicy/default/policy-for-route-2/0
-              authority: grpc-backend-4.default:4000
-              destination:
-                name: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
-                settings:
-                  - protocol: GRPC
-                    weight: 1
-            - name: envoyextensionpolicy/default/policy-for-route-1/0
-              authority: grpc-backend-2.default:8000
-              destination:
-                name: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
-                settings:
-                  - protocol: GRPC
-                    weight: 1
+        extProc:
+          - name: envoyextensionpolicy/default/policy-for-route-2/0
+            failOpen: true
+            messageTimeout: 5s
+            requestHeaderProcessing: true
+            requestBodyProcessingMode: Buffered
+            responseBodyProcessingMode: Streamed
+            authority: grpc-backend-4.default:4000
+            destination:
+              name: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+              settings:
+                - protocol: GRPC
+                  weight: 1
+          - name: envoyextensionpolicy/default/policy-for-route-1/0
+            failOpen: true
+            messageTimeout: 5s
+            responseHeaderProcessing: true
+            requestBodyProcessingMode: BufferedPartial
+            authority: grpc-backend-2.default:8000
+            destination:
+              name: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+              settings:
+                - protocol: GRPC
+                  weight: 1
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
@@ -56,22 +64,23 @@ http:
                   port: 8080
               protocol: HTTP
               weight: 1
-        envoyExtensionFeatures:
-          extProc:
-            - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0
-              authority: grpc-backend-3.envoy-gateway:3000
-              destination:
-                name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
-                settings:
-                  - protocol: GRPC
-                    weight: 1
-            - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
-              authority: grpc-backend.envoy-gateway:9000
-              destination:
-                name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
-                settings:
-                  - protocol: GRPC
-                    weight: 1
+        extProc:
+          - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0
+            authority: grpc-backend-3.envoy-gateway:3000
+            destination:
+              name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+              settings:
+                - protocol: GRPC
+                  weight: 1
+          - name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
+            failOpen: false
+            messageTimeout: 15s
+            authority: grpc-backend.envoy-gateway:9000
+            destination:
+              name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+              settings:
+                - protocol: GRPC
+                  weight: 1
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.clusters.yaml
index 6a277bb94..08b38495e 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.clusters.yaml
@@ -32,3 +32,91 @@
   outlierDetection: {}
   perConnectionBufferLimitBytes: 32768
   type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+  lbPolicy: LEAST_REQUEST
+  name: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+  lbPolicy: LEAST_REQUEST
+  name: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+  lbPolicy: LEAST_REQUEST
+  name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+  lbPolicy: LEAST_REQUEST
+  name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.endpoints.yaml
index 05442a9a1..4ec680ce7 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.endpoints.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.endpoints.yaml
@@ -22,3 +22,23 @@
     loadBalancingWeight: 1
     locality:
       region: httproute/default/httproute-2/rule/0/backend/0
+- clusterName: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+  endpoints:
+  - loadBalancingWeight: 1
+    locality:
+      region: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4/backend/0
+- clusterName: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+  endpoints:
+  - loadBalancingWeight: 1
+    locality:
+      region: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2/backend/0
+- clusterName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+  endpoints:
+  - loadBalancingWeight: 1
+    locality:
+      region: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3/backend/0
+- clusterName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+  endpoints:
+  - loadBalancingWeight: 1
+    locality:
+      region: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend/backend/0
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml
index a593a50af..f82244796 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.listeners.yaml
@@ -14,6 +14,70 @@
           initialStreamWindowSize: 65536
           maxConcurrentStreams: 100
         httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-2/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            failureModeAllow: true
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend-4.default:4000
+                clusterName: envoyextensionpolicy/default/policy-for-route-2/0/grpc-backend-4
+              timeout: 10s
+            messageTimeout: 5s
+            processingMode:
+              requestBodyMode: BUFFERED
+              requestHeaderMode: SEND
+              requestTrailerMode: SKIP
+              responseBodyMode: STREAMED
+              responseHeaderMode: SKIP
+              responseTrailerMode: SKIP
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-1/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            failureModeAllow: true
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend-2.default:8000
+                clusterName: envoyextensionpolicy/default/policy-for-route-1/0/grpc-backend-2
+              timeout: 10s
+            messageTimeout: 5s
+            processingMode:
+              requestBodyMode: BUFFERED_PARTIAL
+              requestHeaderMode: SKIP
+              requestTrailerMode: SKIP
+              responseHeaderMode: SEND
+              responseTrailerMode: SKIP
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend-3.envoy-gateway:3000
+                clusterName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0/grpc-backend-3
+              timeout: 10s
+            processingMode:
+              requestHeaderMode: SKIP
+              requestTrailerMode: SKIP
+              responseHeaderMode: SKIP
+              responseTrailerMode: SKIP
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend.envoy-gateway:9000
+                clusterName: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0/grpc-backend
+              timeout: 10s
+            messageTimeout: 15s
+            processingMode:
+              requestHeaderMode: SKIP
+              requestTrailerMode: SKIP
+              responseHeaderMode: SKIP
+              responseTrailerMode: SKIP
         - name: envoy.filters.http.router
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml
index a7002b63f..0daf1919c 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc.routes.yaml
@@ -12,6 +12,13 @@
         cluster: httproute/default/httproute-1/rule/0
         upgradeConfigs:
         - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-1/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-route-2/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
     - match:
         pathSeparatedPrefix: /bar
       name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
@@ -19,3 +26,10 @@
         cluster: httproute/default/httproute-2/rule/0
         upgradeConfigs:
         - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+        envoy.filters.http.ext_proc/envoyextensionpolicy/envoy-gateway/policy-for-gateway-2/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 72dbebba4..d485100ea 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -1210,33 +1210,12 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[ExtProcBackendRef](#extprocbackendref)_ |  true  | BackendRef defines the configuration of the external processing service |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs defines the configuration of the external processing service |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  true  | BackendRefs defines the configuration of the external processing service |
 | `messageTimeout` | _[Duration](#duration)_ |  false  | MessageTimeout is the timeout for a response to be returned from the external processor<br />Default: 200ms |
 | `failOpen` | _boolean_ |  false  | FailOpen defines if requests or responses that cannot be processed due to connectivity to the<br />external processor are terminated or passed-through.<br />Default: false |
 | `processingMode` | _[ExtProcProcessingMode](#extprocprocessingmode)_ |  false  | ProcessingMode defines how request and response body is processed<br />Default: header and body are not sent to the external processor |
 
 
-#### ExtProcBackendRef
-
-
-
-ExtProcService defines the gRPC External Processing service using the envoy grpc client
-The processing request and response messages are defined in
-https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ext_proc/v3/external_processor.proto
-
-_Appears in:_
-- [ExtProc](#extproc)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `group` | _[Group](#group)_ |  false  | Group is the group of the referent. For example, "gateway.networking.k8s.io".<br />When unspecified or empty string, core API group is inferred. |
-| `kind` | _[Kind](#kind)_ |  false  | Kind is the Kubernetes resource kind of the referent. For example<br />"Service".<br /><br />Defaults to "Service" when not specified.<br /><br />ExternalName services can refer to CNAME DNS records that may live<br />outside of the cluster and as such are difficult to reason about in<br />terms of conformance. They also may not be safe to forward to (see<br />CVE-2021-25740 for more information). Implementations SHOULD NOT<br />support ExternalName Services.<br /><br />Support: Core (Services with a type other than ExternalName)<br /><br />Support: Implementation-specific (Services with type ExternalName) |
-| `name` | _[ObjectName](#objectname)_ |  true  | Name is the name of the referent. |
-| `namespace` | _[Namespace](#namespace)_ |  false  | Namespace is the namespace of the backend. When unspecified, the local<br />namespace is inferred.<br /><br />Note that when a namespace different than the local namespace is specified,<br />a ReferenceGrant object is required in the referent namespace to allow that<br />namespace's owner to accept the reference. See the ReferenceGrant<br />documentation for details.<br /><br />Support: Core |
-| `port` | _[PortNumber](#portnumber)_ |  false  | Port specifies the destination port number to use for this resource.<br />Port is required when the referent is a Kubernetes Service. In this<br />case, the port number is the service port number, not the target port.<br />For other resources, destination port might be derived from the referent<br />resource or this field. |
-
-
 #### ExtProcBodyProcessingMode
 
 _Underlying type:_ _string_
diff --git a/site/content/en/latest/tasks/security/oidc.md b/site/content/en/latest/tasks/security/oidc.md
index 0360ccd49..ac7d6d60b 100644
--- a/site/content/en/latest/tasks/security/oidc.md
+++ b/site/content/en/latest/tasks/security/oidc.md
@@ -4,7 +4,7 @@ title: "OIDC Authentication"
 
 This task provides instructions for configuring [OpenID Connect (OIDC)][oidc] authentication.
 OpenID Connect (OIDC) is an authentication standard built on top of OAuth 2.0.
-It enables client applications to rely on authentication that is performed by an OpenID Connect Provider (OP)
+It enables EG to rely on authentication that is performed by an OpenID Connect Provider (OP)
 to verify the identity of a user.
 
 Envoy Gateway introduces a new CRD called [SecurityPolicy][SecurityPolicy] that allows the user to configure OIDC
@@ -16,17 +16,15 @@ This instantiated resource can be linked to a [Gateway][Gateway] and [HTTPRoute]
 Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
 Before proceeding, you should be able to query the example backend using HTTP.
 
+EG OIDC authentication requires the redirect URL to be HTTPS. Follow the [Secure Gateways](../secure-gateways) guide
+to generate the TLS certificates and update the Gateway configuration to add an HTTPS listener.
+
 Verify the Gateway status:
 
 ```shell
 kubectl get gateway/eg -o yaml
 ```
 
-OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
-the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations. 
-
-This task demonstrates the configuration of OIDC at the HTTPRoute level.
-
 Let's create an HTTPRoute that represents an application protected by OIDC.
 
 {{< tabpane text=true >}}
@@ -86,16 +84,21 @@ Verify the HTTPRoute status:
 kubectl get httproute/myapp -o yaml
 ```
 
-## Configuration
+## OIDC Authentication for a HTTPRoute
 
-This task uses Google as the OIDC provider to demonstrate the configuration of OIDC. However, EG works with any OIDC
-providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc.
+OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with 
+the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations.
+
+This section demonstrates how to configure OIDC authentication for a specific HTTPRoute.
 
 ### Register an OIDC application
 
+This task uses Google as the OIDC provider to demonstrate the configuration of OIDC. However, EG works with any OIDC
+providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc.
+
 Follow the steps in the [Google OIDC documentation][google-oidc] to register an OIDC application. Please make sure the
 redirect URL is set to the one you configured in the SecurityPolicy that you will create in the step below. In this example,
-the redirect URL is `http://www.example.com:8080/myapp/oauth2/callback`.
+the redirect URL is `http://www.example.com:8443/myapp/oauth2/callback`.
 
 After registering the application, you should have the following information:
 * Client ID: The client ID of the OIDC application.
@@ -109,15 +112,14 @@ and the Client Secret must be stored in the key "client-secret".
 Note: please replace the ${CLIENT_SECRET} with the actual Client Secret that you got from the previous step.
 
 ```shell
-$ kubectl create secret generic my-app-client-secret --from-literal=client-secret=${CLIENT_SECRET}
-secret "my-app-client-secret" created
+kubectl create secret generic my-app-client-secret --from-literal=client-secret=${CLIENT_SECRET}
 ```
 
 ### Create a SecurityPolicy
 
-Please notice that the `redirectURL` and `logoutPath` must match the target HTTPRoute. In this example, the target
+**Please notice that the `redirectURL` and `logoutPath` must match the target HTTPRoute.** In this example, the target
 HTTPRoute is configured to match the host `www.example.com` and the path `/myapp`, so the `redirectURL` must be prefixed 
-with `http://www.example.com:8080/myapp`, and `logoutPath` must be prefixed with`/myapp`, otherwise the OIDC authentication 
+with `https://www.example.com:8443/myapp`, and `logoutPath` must be prefixed with`/myapp`, otherwise the OIDC authentication 
 will fail because the redirect and logout requests will not match the target HTTPRoute and therefore can't be processed 
 by the OAuth2 filter on that HTTPRoute.
 
@@ -143,7 +145,7 @@ spec:
     clientID: "${CLIENT_ID}"
     clientSecret:
       name: "my-app-client-secret"
-    redirectURL: "http://www.example.com:8080/myapp/oauth2/callback"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
     logoutPath: "/myapp/logout"
 EOF
 ```
@@ -169,7 +171,7 @@ spec:
     clientID: "${CLIENT_ID}"
     clientSecret:
       name: "my-app-client-secret"
-    redirectURL: "http://www.example.com:8080/myapp/oauth2/callback"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
     logoutPath: "/myapp/logout"
 ```
 
@@ -182,14 +184,14 @@ Verify the SecurityPolicy configuration:
 kubectl get securitypolicy/oidc-example -o yaml
 ```
 
-## Testing
+### Testing
 
 Port forward gateway port to localhost:
 
 ```shell
 export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
 
-kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8080:80
+kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8443:443
 ```
 
 Put www.example.com in the /etc/hosts file in your test machine, so we can use this host name to access the gateway from a browser:
@@ -199,9 +201,104 @@ Put www.example.com in the /etc/hosts file in your test machine, so we can use t
 127.0.0.1 www.example.com
 ```
 
-Open a browser and navigate to the `http://www.example.com:8080/myapp` address. You should be redirected to the Google 
+Open a browser and navigate to the `https://www.example.com:8443/myapp` address. You should be redirected to the Google 
+login page. After you successfully login, you should see the response from the backend service. 
+
+Clean the cookies in the browser and try to access `https://www.example.com:8443/foo` address. You should be able to see
+this page since the path `/foo` is not protected by the OIDC policy.
+
+## OIDC Authentication for a Gateway
+
+OIDC can be configured at the Gateway level to authenticate all the HTTPRoutes that are associated with the Gateway with
+the same OIDC configuration, or at the HTTPRoute level to authenticate each HTTPRoute with different OIDC configurations.
+
+This section demonstrates how to configure OIDC authentication for a Gateway.
+
+### Register an OIDC application
+
+If you haven't registered an OIDC application, follow the steps in the previous section to register an OIDC application.
+
+### Create a kubernetes secret
+
+If you haven't created a kubernetes secret, follow the steps in the previous section to create a kubernetes secret.
+
+### Create a SecurityPolicy
+
+Create or update the SecurityPolicy to target the Gateway instead of the HTTPRoute. **Please notice that the `redirectURL` 
+and `logoutPath` must match one of the HTTPRoutes associated with the Gateway.** In this example, the target Gateway has 
+two HTTPRoutes associated with it, one with the host `www.example.com` and the path `/myapp`, and the other with the host
+`www.example.com` and the path `/`. Either one of the HTTPRoutes can be used to match the `redirectURL` and `logoutPath`.
+
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+EOF
+```
+
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "https://www.example.com:8443/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
+
+Verify the SecurityPolicy configuration:
+
+```shell
+kubectl get securitypolicy/oidc-example -o yaml
+```
+
+### Testing
+
+If you haven't done so, follow the steps in the previous section to port forward gateway port to localhost and put
+www.example.com in the /etc/hosts file in your test machine.
+
+Open a browser and navigate to the `https://www.example.com:8443/foo` address. You should be redirected to the Google
 login page. After you successfully login, you should see the response from the backend service.
 
+You can also try to access `https://www.example.com:8443/myapp` address. You should be able to see this page since the
+path `/myapp` is protected by the same OIDC policy.
+
 ## Clean-Up
 
 Follow the steps from the [Quickstart](../../quickstart) to uninstall Envoy Gateway and the example manifest.
@@ -216,10 +313,10 @@ kubectl delete httproute/myapp
 
 ## Next Steps
 
-Checkout the [Developer Guide](../../../contributions/develop) to get involved in the project.
+Checkout the [Developer Guide](../../../../contributions/develop) to get involved in the project.
 
 [oidc]: https://openid.net/connect/
 [google-oidc]: https://developers.google.com/identity/protocols/oauth2/openid-connect
-[SecurityPolicy]: ../../../contributions/design/security-policy
+[SecurityPolicy]: ../../../../contributions/design/security-policy
 [Gateway]: https://gateway-api.sigs.k8s.io/api-types/gateway
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute
diff --git a/site/content/en/latest/tasks/security/secure-gateways.md b/site/content/en/latest/tasks/security/secure-gateways.md
index e57b12363..92f685705 100644
--- a/site/content/en/latest/tasks/security/secure-gateways.md
+++ b/site/content/en/latest/tasks/security/secure-gateways.md
@@ -297,7 +297,7 @@ Lastly, test connectivity using the above [Testing section](#testing).
 
 ## Clean-Up
 
-Follow the steps from the [Quickstart](../../quickstart) to uninstall Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../quickstart) to uninstall Envoy Gateway and the example manifest.
 
 Delete the Secrets:
 
@@ -423,7 +423,7 @@ This sections gives a walkthrough to generate multiple certificates correspondin
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
+Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway and the example manifest.
 Before proceeding, you should be able to query the example backend using HTTP.
 
 Follow the steps in the [TLS Certificates](#tls-certificates) section to generate self-signed RSA derived Server certificate and private key, and configure those in the Gateway listener configuration to terminate HTTPS traffic.
diff --git a/test/cel-validation/envoyextensionpolicy_test.go b/test/cel-validation/envoyextensionpolicy_test.go
index 67200306a..efad71d74 100644
--- a/test/cel-validation/envoyextensionpolicy_test.go
+++ b/test/cel-validation/envoyextensionpolicy_test.go
@@ -162,10 +162,12 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
 					ExtProc: []egv1a1.ExtProc{
 						{
-							BackendRef: egv1a1.ExtProcBackendRef{
-								BackendObjectReference: gwapiv1.BackendObjectReference{
-									Name: "grpc-proc-service",
-									Port: ptr.To(gwapiv1.PortNumber(80)),
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Name: "grpc-proc-service",
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
 								},
 							},
 						},
@@ -187,11 +189,13 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
 					ExtProc: []egv1a1.ExtProc{
 						{
-							BackendRef: egv1a1.ExtProcBackendRef{
-								BackendObjectReference: gwapiv1.BackendObjectReference{
-									Group: ptr.To(gwapiv1.Group("unsupported")),
-									Name:  "grpc-proc-service",
-									Port:  ptr.To(gwapiv1.PortNumber(80)),
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Group: ptr.To(gwapiv1.Group("unsupported")),
+										Name:  "grpc-proc-service",
+										Port:  ptr.To(gwapiv1.PortNumber(80)),
+									},
 								},
 							},
 						},
@@ -205,7 +209,7 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"spec.extProc[0]: Invalid value: \"object\": group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) is supported"},
+			wantErrors: []string{" spec.extProc[0].backendRefs: Invalid value: \"array\": BackendRefs only supports Core group."},
 		},
 		{
 			desc: "ExtProc with invalid BackendRef Kind",
@@ -213,11 +217,13 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
 					ExtProc: []egv1a1.ExtProc{
 						{
-							BackendRef: egv1a1.ExtProcBackendRef{
-								BackendObjectReference: gwapiv1.BackendObjectReference{
-									Kind: ptr.To(gwapiv1.Kind("unsupported")),
-									Name: "grpc-proc-service",
-									Port: ptr.To(gwapiv1.PortNumber(80)),
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Kind: ptr.To(gwapiv1.Kind("unsupported")),
+										Name: "grpc-proc-service",
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
 								},
 							},
 						},
@@ -231,7 +237,7 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"spec.extProc[0]: Invalid value: \"object\": kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported"},
+			wantErrors: []string{"spec.extProc[0].backendRefs: Invalid value: \"array\": BackendRefs only supports Service kind."},
 		},
 		{
 			desc: "ExtProc with invalid fields",
@@ -239,10 +245,12 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
 					ExtProc: []egv1a1.ExtProc{
 						{
-							BackendRef: egv1a1.ExtProcBackendRef{
-								BackendObjectReference: gwapiv1.BackendObjectReference{
-									Name: "grpc-proc-service",
-									Port: ptr.To(gwapiv1.PortNumber(80)),
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Name: "grpc-proc-service",
+										Port: ptr.To(gwapiv1.PortNumber(80)),
+									},
 								},
 							},
 							ProcessingMode: &egv1a1.ExtProcProcessingMode{
diff --git a/test/e2e/e2e_test.go b/test/e2e/e2e_test.go
index 46e0fb30b..3159f0bd2 100644
--- a/test/e2e/e2e_test.go
+++ b/test/e2e/e2e_test.go
@@ -51,6 +51,9 @@ func TestE2E(t *testing.T) {
 		CleanupBaseResources: *flags.CleanupBaseResources,
 		FS:                   &Manifests,
 		RunTest:              *flags.RunTest,
+		SkipTests: []string{
+			tests.ClientTimeoutTest.ShortName, // https://github.com/envoyproxy/gateway/issues/2720
+		},
 	})
 
 	cSuite.Setup(t)
diff --git a/test/e2e/merge_gateways/merge_gateways_test.go b/test/e2e/merge_gateways/merge_gateways_test.go
index 30e82aa6c..9c056875c 100644
--- a/test/e2e/merge_gateways/merge_gateways_test.go
+++ b/test/e2e/merge_gateways/merge_gateways_test.go
@@ -52,14 +52,16 @@ func TestMergeGateways(t *testing.T) {
 		Debug:                *flags.ShowDebug,
 		CleanupBaseResources: *flags.CleanupBaseResources,
 		RunTest:              *flags.RunTest,
+		SkipTests: []string{
+			tests.MergeGatewaysTest.ShortName, // https://github.com/envoyproxy/gateway/issues/3290
+		},
 	})
 
 	// Setting up the necessary arguments for the suite instead of calling Suite.Setup method again,
 	// since this test suite reuse the base resources of previous test suite.
 	cSuite.Applier.FS = e2e.Manifests
 	cSuite.Applier.GatewayClass = *flags.GatewayClassName
-	cSuite.ControllerName = kubernetes.GWCMustHaveAcceptedConditionTrue(t,
-		cSuite.Client, cSuite.TimeoutConfig, cSuite.GatewayClassName)
+	cSuite.ControllerName = kubernetes.GWCMustHaveAcceptedConditionTrue(t, cSuite.Client, cSuite.TimeoutConfig, cSuite.GatewayClassName)
 
 	t.Logf("Running %d MergeGateways tests", len(tests.MergeGatewaysTests))
 	cSuite.Run(t, tests.MergeGatewaysTests)
diff --git a/test/e2e/testdata/ext-proc-envoyextensionpolicy.yaml b/test/e2e/testdata/ext-proc-envoyextensionpolicy.yaml
index 5119ac22c..e88657fee 100644
--- a/test/e2e/testdata/ext-proc-envoyextensionpolicy.yaml
+++ b/test/e2e/testdata/ext-proc-envoyextensionpolicy.yaml
@@ -20,7 +20,7 @@ spec:
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: http-without-ext-proc
+  name: http-without-procmode
   namespace: gateway-conformance-infra
 spec:
   parentRefs:
@@ -46,8 +46,27 @@ spec:
     kind: HTTPRoute
     name: http-with-ext-proc
   extProc:
-  - backendRef:
-      name: grpc-ext-proc
+  - backendRefs:
+    - name: grpc-ext-proc
+      namespace: gateway-conformance-infra
+      port: 9002
+    processingMode:
+      request: {}
+      response: {}
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyExtensionPolicy
+metadata:
+  name: ext-proc-no-procmode-test
+  namespace: gateway-conformance-infra
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: http-without-procmode
+  extProc:
+  - backendRefs:
+    - name: grpc-ext-proc
       namespace: gateway-conformance-infra
       port: 9002
 ---
diff --git a/test/e2e/testdata/ext-proc-service.yaml b/test/e2e/testdata/ext-proc-service.yaml
index 594cf14ed..665779e96 100644
--- a/test/e2e/testdata/ext-proc-service.yaml
+++ b/test/e2e/testdata/ext-proc-service.yaml
@@ -8,74 +8,73 @@ data:
   go.mod: |
     module github.com/envoyproxy/gateway
 
-    go 1.21
+    go 1.22
 
     require (
-    	github.com/envoyproxy/go-control-plane v0.12.0
+    	github.com/envoyproxy/go-control-plane v0.12.1-0.20240322155512-db0b36a50fa8
     	google.golang.org/grpc v1.62.1
     )
 
     require (
-    	github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa // indirect
-    	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
-    	github.com/golang/protobuf v1.5.3 // indirect
-    	golang.org/x/net v0.20.0 // indirect
-    	golang.org/x/sys v0.16.0 // indirect
-    	golang.org/x/text v0.14.0 // indirect
-    	google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 // indirect
-    	google.golang.org/protobuf v1.32.0 // indirect
+        github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa // indirect
+        github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
+        github.com/golang/protobuf v1.5.4 // indirect
+        github.com/planetscale/vtprotobuf v0.5.1-0.20231212170721-e7d721933795 // indirect
+        golang.org/x/net v0.20.0 // indirect
+        golang.org/x/sys v0.16.0 // indirect
+        golang.org/x/text v0.14.0 // indirect
+        google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 // indirect
+        google.golang.org/protobuf v1.33.0 // indirect
     )
   go.sum: |
     github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=
     github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
-    github.com/envoyproxy/go-control-plane v0.12.0 h1:4X+VP1GHd1Mhj6IB5mMeGbLCleqxjletLK6K0rbxyZI=
-    github.com/envoyproxy/go-control-plane v0.12.0/go.mod h1:ZBTaoJ23lqITozF0M6G4/IragXCQKCnYbmlmtHvwRG0=
+    github.com/envoyproxy/go-control-plane v0.12.1-0.20240322155512-db0b36a50fa8 h1:Zghtu+wdlGvrmutCyhU9Ew5ozU18PVpxP+zGSgyUpFs=
+    github.com/envoyproxy/go-control-plane v0.12.1-0.20240322155512-db0b36a50fa8/go.mod h1:YtsM9q/kVkKyvmemY+BF/ZK7I93OWsx4uk4Do2Mr/OA=
     github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
     github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
-    github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-    github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-    github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-    github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+    github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+    github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
     github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
     github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+    github.com/planetscale/vtprotobuf v0.5.1-0.20231212170721-e7d721933795 h1:pH+U6pJP0BhxqQ4njBUjOg0++WMMvv3eByWzB+oATBY=
+    github.com/planetscale/vtprotobuf v0.5.1-0.20231212170721-e7d721933795/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
     golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
     golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
     golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
     golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
     golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
     golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-    golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
     google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 h1:AjyfHzEPEFp/NpvfN5g+KDla3EMojjhRVZc1i7cj+oM=
     google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
     google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=
     google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
-    google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-    google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-    google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
-    google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+    google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+    google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
   main.go: |
     package main
 
     import (
-        "context"
-        "crypto/tls"
-        "crypto/x509"
-        "flag"
-        "fmt"
-        "google.golang.org/grpc/credentials"
-        "io"
-        "log"
-        "net"
-        "net/http"
-        "os"
-        "strings"
-
-        envoy_api_v3_core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
-        envoy_service_proc_v3 "github.com/envoyproxy/go-control-plane/envoy/service/ext_proc/v3"
-
-        "google.golang.org/grpc"
-        "google.golang.org/grpc/codes"
-        "google.golang.org/grpc/status"
+    	"context"
+    	"crypto/tls"
+    	"crypto/x509"
+    	"flag"
+    	"fmt"
+    	"io"
+    	"log"
+    	"net"
+    	"net/http"
+    	"os"
+    	"strings"
+
+    	"google.golang.org/grpc/credentials"
+
+    	envoy_api_v3_core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+    	envoy_service_proc_v3 "github.com/envoyproxy/go-control-plane/envoy/service/ext_proc/v3"
+
+    	"google.golang.org/grpc"
+    	"google.golang.org/grpc/codes"
+    	"google.golang.org/grpc/status"
     )
 
     type extProcServer struct{}
@@ -103,7 +102,6 @@ data:
 
     	envoy_service_proc_v3.RegisterExternalProcessorServer(gs, &extProcServer{})
 
-
     	go func() {
     		err = gs.Serve(lis)
     		if err != nil {
@@ -227,13 +225,23 @@ data:
     		resp := &envoy_service_proc_v3.ProcessingResponse{}
     		switch v := req.Request.(type) {
     		case *envoy_service_proc_v3.ProcessingRequest_RequestHeaders:
+    			xrch := ""
+    			if v.RequestHeaders != nil {
+    				hdrs := v.RequestHeaders.Headers.GetHeaders()
+    				for _, hdr := range hdrs {
+    					if hdr.Key == "x-request-client-header" {
+    						xrch = string(hdr.RawValue)
+    					}
+    				}
+    			}
+
     			rhq := &envoy_service_proc_v3.HeadersResponse{
     				Response: &envoy_service_proc_v3.CommonResponse{
     					HeaderMutation: &envoy_service_proc_v3.HeaderMutation{
     						SetHeaders: []*envoy_api_v3_core.HeaderValueOption{
     							{
     								Header: &envoy_api_v3_core.HeaderValue{
-    									Key: "x-request-ext-processed",
+    									Key:      "x-request-ext-processed",
     									RawValue: []byte("true"),
     								},
     							},
@@ -242,6 +250,23 @@ data:
     				},
     			}
 
+    			if xrch != "" {
+    				rhq.Response.HeaderMutation.SetHeaders = append(rhq.Response.HeaderMutation.SetHeaders,
+    					&envoy_api_v3_core.HeaderValueOption{
+    						Header: &envoy_api_v3_core.HeaderValue{
+    							Key:      "x-request-client-header",
+    							RawValue: []byte("mutated"),
+    						},
+    					})
+    				rhq.Response.HeaderMutation.SetHeaders = append(rhq.Response.HeaderMutation.SetHeaders,
+    					&envoy_api_v3_core.HeaderValueOption{
+    						Header: &envoy_api_v3_core.HeaderValue{
+    							Key:      "x-request-client-header-received",
+    							RawValue: []byte(xrch),
+    						},
+    					})
+    			}
+
     			resp = &envoy_service_proc_v3.ProcessingResponse{
     				Response: &envoy_service_proc_v3.ProcessingResponse_RequestHeaders{
     					RequestHeaders: rhq,
@@ -255,7 +280,7 @@ data:
     						SetHeaders: []*envoy_api_v3_core.HeaderValueOption{
     							{
     								Header: &envoy_api_v3_core.HeaderValue{
-    									Key: "x-response-ext-processed",
+    									Key:      "x-response-ext-processed",
     									RawValue: []byte("true"),
     								},
     							},
@@ -352,7 +377,7 @@ spec:
             - sh
             - "-c"
             - "cp -a /app /app-live && cd /app-live && go  run . --certPath=/app-live/certs/ "
-          image: golang:1.21.3-alpine
+          image: golang:1.22.1-alpine
           ports:
             - containerPort: 8000
           volumeMounts:
diff --git a/test/e2e/tests/ext_proc.go b/test/e2e/tests/ext_proc.go
index aa9978e92..eb069380b 100644
--- a/test/e2e/tests/ext_proc.go
+++ b/test/e2e/tests/ext_proc.go
@@ -26,10 +26,10 @@ func init() {
 	ConformanceTests = append(ConformanceTests, ExtProcTest)
 }
 
-// ExtProcTest tests ExtProcs authentication for an http route with ExtProcs configured.
+// ExtProcTest tests ExtProc authentication for an http route with ExtProc configured.
 var ExtProcTest = suite.ConformanceTest{
-	ShortName:   "ExtProcs",
-	Description: "Test ExtProcs service that adds request and response headers",
+	ShortName:   "ExtProc",
+	Description: "Test ExtProc service that adds request and response headers",
 	Manifests:   []string{"testdata/ext-proc-service.yaml", "testdata/ext-proc-envoyextensionpolicy.yaml"},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
 		t.Run("http route with ext proc", func(t *testing.T) {
@@ -56,19 +56,25 @@ var ExtProcTest = suite.ConformanceTest{
 					Host: "www.example.com",
 					Path: "/processor",
 					Headers: map[string]string{
-						"x-request-ext-processed": "true", // header added by ext-processor to request
+						"x-request-ext-processed":          "true",     // header added by ext-processor to backend-bound request
+						"x-request-client-header-received": "original", // this is the original client header preserved by ext-proc in a new header
+						"x-request-client-header":          "mutated",  // this is the mutated value expected to reach upstream
 					},
 				},
 				Response: http.Response{
 					StatusCode: 200,
 					Headers: map[string]string{
-						"x-response-ext-processed": "true", // header added by ext-processor to request
+						"x-response-ext-processed": "true", // header added by ext-processor to client-bound response
 					},
 				},
 				Namespace: ns,
 			}
 
 			req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
+
+			// add a request header that will be mutated by ext-proc
+			req.Headers["x-request-client-header"] = []string{"original"}
+
 			cReq, cResp, err := suite.RoundTripper.CaptureRoundTrip(req)
 			if err != nil {
 				t.Errorf("failed to get expected response: %v", err)
@@ -79,9 +85,9 @@ var ExtProcTest = suite.ConformanceTest{
 			}
 		})
 
-		t.Run("http route without ext proc", func(t *testing.T) {
+		t.Run("http route without proc mode", func(t *testing.T) {
 			ns := "gateway-conformance-infra"
-			routeNN := types.NamespacedName{Name: "http-with-ext-proc", Namespace: ns}
+			routeNN := types.NamespacedName{Name: "http-without-procmode", Namespace: ns}
 			gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
 			gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
 
@@ -91,7 +97,7 @@ var ExtProcTest = suite.ConformanceTest{
 				Namespace: gatewayapi.NamespacePtr(gwNN.Namespace),
 				Name:      gwv1.ObjectName(gwNN.Name),
 			}
-			EnvoyExtensionPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "ext-proc-test", Namespace: ns}, suite.ControllerName, ancestorRef)
+			EnvoyExtensionPolicyMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "ext-proc-no-procmode-test", Namespace: ns}, suite.ControllerName, ancestorRef)
 
 			podReady := corev1.PodCondition{Type: corev1.PodReady, Status: corev1.ConditionTrue}
 
@@ -102,6 +108,9 @@ var ExtProcTest = suite.ConformanceTest{
 				Request: http.Request{
 					Host: "www.example.com",
 					Path: "/no-processor",
+					Headers: map[string]string{
+						"x-request-client-header": "original",
+					},
 				},
 				Response: http.Response{
 					StatusCode:    200,
@@ -111,6 +120,10 @@ var ExtProcTest = suite.ConformanceTest{
 			}
 
 			req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
+
+			// add a request header that will be mutated by ext-proc if the request headers are sent
+			req.Headers["x-request-client-header"] = []string{"original"}
+
 			cReq, cResp, err := suite.RoundTripper.CaptureRoundTrip(req)
 			if err != nil {
 				t.Errorf("failed to get expected response: %v", err)
diff --git a/test/e2e/upgrade/eg_upgrade_test.go b/test/e2e/upgrade/eg_upgrade_test.go
index a1be622cb..6ad83b14b 100644
--- a/test/e2e/upgrade/eg_upgrade_test.go
+++ b/test/e2e/upgrade/eg_upgrade_test.go
@@ -52,6 +52,9 @@ func TestEGUpgrade(t *testing.T) {
 		CleanupBaseResources: *flags.CleanupBaseResources,
 		FS:                   &e2e.Manifests,
 		RunTest:              *flags.RunTest,
+		SkipTests: []string{
+			tests.EnvoyShutdownTest.ShortName, // https://github.com/envoyproxy/gateway/issues/3262
+		},
 	})
 
 	cSuite.Setup(t)