Repository: envoyproxy/gateway
Pull request #3945 (2024-07-24 01:07:10)

chore: bump crd-ref-docs
follow up: https://github.com/elastic/crd-ref-docs/pull/82

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/envoyproxy/gateway/pull/3945?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 67.39%. Comparing base [(`9852333`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/985233391ec7767d70b150b95cd717c9a455145e?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) to head [(`2034ed5`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/2034ed567e6b350d6ae1995cf7406761c8c17c64?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).
> Report is 1 commits behind head on main.

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##             main    #3945   +/-   ##
=======================================
  Coverage   67.39%   67.39%           
=======================================
  Files         183      183           
  Lines       22435    22435           
=======================================
  Hits        15121    15121           
  Misses       6226     6226           
  Partials     1088     1088           
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/envoyproxy/gateway/pull/3945?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).


Patch:
diff --git a/api/v1alpha1/envoyproxy_helpers.go b/api/v1alpha1/envoyproxy_helpers.go
index 3d5016bae..ec69147e6 100644
--- a/api/v1alpha1/envoyproxy_helpers.go
+++ b/api/v1alpha1/envoyproxy_helpers.go
@@ -157,3 +157,8 @@ func DefaultShutdownManagerContainerResourceRequirements() *corev1.ResourceRequi
 		},
 	}
 }
+
+// String returns the string representation of the EnvoyFilter type.
+func (f EnvoyFilter) String() string {
+	return string(f)
+}
diff --git a/api/v1alpha1/envoyproxy_types.go b/api/v1alpha1/envoyproxy_types.go
index 969fe5f05..910c6d150 100644
--- a/api/v1alpha1/envoyproxy_types.go
+++ b/api/v1alpha1/envoyproxy_types.go
@@ -98,13 +98,15 @@ type EnvoyProxySpec struct {
 	// If unspecified, the default filter order is applied.
 	// Default filter order is:
 	//
+	// - envoy.filters.http.health_check
+	//
 	// - envoy.filters.http.fault
 	//
 	// - envoy.filters.http.cors
 	//
 	// - envoy.filters.http.ext_authz
 	//
-	// - envoy.filters.http.basic_authn
+	// - envoy.filters.http.basic_auth
 	//
 	// - envoy.filters.http.oauth2
 	//
@@ -122,6 +124,8 @@ type EnvoyProxySpec struct {
 	//
 	// - envoy.filters.http.router
 	//
+	// Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
+	//
 	// +optional
 	FilterOrder []FilterPosition `json:"filterOrder,omitempty"`
 	// BackendTLS is the TLS configuration for the Envoy proxy to use when connecting to backends.
@@ -168,20 +172,24 @@ type FilterPosition struct {
 }
 
 // EnvoyFilter defines the type of Envoy HTTP filter.
-// +kubebuilder:validation:Enum=envoy.filters.http.cors;envoy.filters.http.ext_authz;envoy.filters.http.basic_authn;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.fault;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.wasm;envoy.filters.http.ext_proc;envoy.filters.http.rbac
+// +kubebuilder:validation:Enum=envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.ext_authz;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit
 type EnvoyFilter string
 
 const (
+	// EnvoyFilterHealthCheck defines the Envoy HTTP health check filter.
+	EnvoyFilterHealthCheck EnvoyFilter = "envoy.filters.http.health_check"
+
 	// EnvoyFilterFault defines the Envoy HTTP fault filter.
 	EnvoyFilterFault EnvoyFilter = "envoy.filters.http.fault"
+
 	// EnvoyFilterCORS defines the Envoy HTTP CORS filter.
 	EnvoyFilterCORS EnvoyFilter = "envoy.filters.http.cors"
 
 	// EnvoyFilterExtAuthz defines the Envoy HTTP external authorization filter.
 	EnvoyFilterExtAuthz EnvoyFilter = "envoy.filters.http.ext_authz"
 
-	// EnvoyFilterBasicAuthn defines the Envoy HTTP basic authentication filter.
-	EnvoyFilterBasicAuthn EnvoyFilter = "envoy.filters.http.basic_authn"
+	// EnvoyFilterBasicAuth defines the Envoy HTTP basic authentication filter.
+	EnvoyFilterBasicAuth EnvoyFilter = "envoy.filters.http.basic_auth"
 
 	// EnvoyFilterOAuth2 defines the Envoy HTTP OAuth2 filter.
 	EnvoyFilterOAuth2 EnvoyFilter = "envoy.filters.http.oauth2"
@@ -195,15 +203,15 @@ const (
 	// EnvoyFilterWasm defines the Envoy HTTP WebAssembly filter.
 	EnvoyFilterWasm EnvoyFilter = "envoy.filters.http.wasm"
 
+	// EnvoyFilterRBAC defines the Envoy RBAC filter.
+	EnvoyFilterRBAC EnvoyFilter = "envoy.filters.http.rbac"
+
 	// EnvoyFilterLocalRateLimit defines the Envoy HTTP local rate limit filter.
 	EnvoyFilterLocalRateLimit EnvoyFilter = "envoy.filters.http.local_ratelimit"
 
 	// EnvoyFilterRateLimit defines the Envoy HTTP rate limit filter.
 	EnvoyFilterRateLimit EnvoyFilter = "envoy.filters.http.ratelimit"
 
-	// EnvoyFilterRBAC defines the Envoy RBAC filter.
-	EnvoyFilterRBAC EnvoyFilter = "envoy.filters.http.rbac"
-
 	// EnvoyFilterRouter defines the Envoy HTTP router filter.
 	EnvoyFilterRouter EnvoyFilter = "envoy.filters.http.router"
 )
diff --git a/api/v1alpha1/securitypolicy_types.go b/api/v1alpha1/securitypolicy_types.go
index 61277ba37..1720d0561 100644
--- a/api/v1alpha1/securitypolicy_types.go
+++ b/api/v1alpha1/securitypolicy_types.go
@@ -74,7 +74,6 @@ type SecurityPolicySpec struct {
 	// Authorization defines the authorization configuration.
 	//
 	// +optional
-	// +notImplementedHide
 	Authorization *Authorization `json:"authorization,omitempty"`
 }
 
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 373325702..74438fea2 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -230,6 +230,9 @@ spec:
                   Default filter order is:
 
 
+                  - envoy.filters.http.health_check
+
+
                   - envoy.filters.http.fault
 
 
@@ -239,7 +242,7 @@ spec:
                   - envoy.filters.http.ext_authz
 
 
-                  - envoy.filters.http.basic_authn
+                  - envoy.filters.http.basic_auth
 
 
                   - envoy.filters.http.oauth2
@@ -264,6 +267,9 @@ spec:
 
 
                   - envoy.filters.http.router
+
+
+                  Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
                 items:
                   description: FilterPosition defines the position of an Envoy HTTP
                     filter in the filter chain.
@@ -273,49 +279,52 @@ spec:
                         After defines the filter that should come after the filter.
                         Only one of Before or After must be set.
                       enum:
+                      - envoy.filters.http.health_check
+                      - envoy.filters.http.fault
                       - envoy.filters.http.cors
                       - envoy.filters.http.ext_authz
-                      - envoy.filters.http.basic_authn
+                      - envoy.filters.http.basic_auth
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
-                      - envoy.filters.http.fault
-                      - envoy.filters.http.local_ratelimit
-                      - envoy.filters.http.ratelimit
-                      - envoy.filters.http.wasm
                       - envoy.filters.http.ext_proc
+                      - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
+                      - envoy.filters.http.local_ratelimit
+                      - envoy.filters.http.ratelimit
                       type: string
                     before:
                       description: |-
                         Before defines the filter that should come before the filter.
                         Only one of Before or After must be set.
                       enum:
+                      - envoy.filters.http.health_check
+                      - envoy.filters.http.fault
                       - envoy.filters.http.cors
                       - envoy.filters.http.ext_authz
-                      - envoy.filters.http.basic_authn
+                      - envoy.filters.http.basic_auth
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
-                      - envoy.filters.http.fault
-                      - envoy.filters.http.local_ratelimit
-                      - envoy.filters.http.ratelimit
-                      - envoy.filters.http.wasm
                       - envoy.filters.http.ext_proc
+                      - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
+                      - envoy.filters.http.local_ratelimit
+                      - envoy.filters.http.ratelimit
                       type: string
                     name:
                       description: Name of the filter.
                       enum:
+                      - envoy.filters.http.health_check
+                      - envoy.filters.http.fault
                       - envoy.filters.http.cors
                       - envoy.filters.http.ext_authz
-                      - envoy.filters.http.basic_authn
+                      - envoy.filters.http.basic_auth
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
-                      - envoy.filters.http.fault
-                      - envoy.filters.http.local_ratelimit
-                      - envoy.filters.http.ratelimit
-                      - envoy.filters.http.wasm
                       - envoy.filters.http.ext_proc
+                      - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
+                      - envoy.filters.http.local_ratelimit
+                      - envoy.filters.http.ratelimit
                       type: string
                   required:
                   - name
diff --git a/examples/extension-server/go.mod b/examples/extension-server/go.mod
index b5ebd93dc..a1c8e2fc4 100644
--- a/examples/extension-server/go.mod
+++ b/examples/extension-server/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/urfave/cli/v2 v2.27.2
 	google.golang.org/grpc v1.65.0
 	google.golang.org/protobuf v1.34.2
-	k8s.io/apimachinery v0.30.2
+	k8s.io/apimachinery v0.30.3
 	sigs.k8s.io/controller-runtime v0.18.4
 	sigs.k8s.io/gateway-api v1.1.0
 )
diff --git a/examples/extension-server/go.sum b/examples/extension-server/go.sum
index 78924f559..e6a6ba81b 100644
--- a/examples/extension-server/go.sum
+++ b/examples/extension-server/go.sum
@@ -118,10 +118,10 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.30.2 h1:+ZhRj+28QT4UOH+BKznu4CBgPWgkXO7XAvMcMl0qKvI=
-k8s.io/api v0.30.2/go.mod h1:ULg5g9JvOev2dG0u2hig4Z7tQ2hHIuS+m8MNZ+X6EmI=
-k8s.io/apimachinery v0.30.2 h1:fEMcnBj6qkzzPGSVsAZtQThU62SmQ4ZymlXRC5yFSCg=
-k8s.io/apimachinery v0.30.2/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
+k8s.io/api v0.30.3 h1:ImHwK9DCsPA9uoU3rVh4QHAHHK5dTSv1nxJUapx8hoQ=
+k8s.io/api v0.30.3/go.mod h1:GPc8jlzoe5JG3pb0KJCSLX5oAFIW3/qNJITlDj8BH04=
+k8s.io/apimachinery v0.30.3 h1:q1laaWCmrszyQuSQCfNB8cFgCuDAoPszKY4ucAjDwHc=
+k8s.io/apimachinery v0.30.3/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0 h1:jgGTlFYnhF1PM1Ax/lAlxUPE+KfCIXHaathvJg1C3ak=
diff --git a/go.mod b/go.mod
index ef8688786..1231fc39e 100644
--- a/go.mod
+++ b/go.mod
@@ -49,12 +49,12 @@ require (
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.15.3
-	k8s.io/api v0.30.2
-	k8s.io/apiextensions-apiserver v0.30.2
-	k8s.io/apimachinery v0.30.2
-	k8s.io/cli-runtime v0.30.2
-	k8s.io/client-go v0.30.2
-	k8s.io/kubectl v0.30.2
+	k8s.io/api v0.30.3
+	k8s.io/apiextensions-apiserver v0.30.3
+	k8s.io/apimachinery v0.30.3
+	k8s.io/cli-runtime v0.30.3
+	k8s.io/client-go v0.30.3
+	k8s.io/kubectl v0.30.3
 	k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0
 	sigs.k8s.io/controller-runtime v0.18.4
 	sigs.k8s.io/gateway-api v1.1.0
@@ -208,9 +208,9 @@ require (
 	google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
-	k8s.io/apiserver v0.30.2 // indirect
+	k8s.io/apiserver v0.30.3 // indirect
 	k8s.io/kubelet v0.30.2 // indirect
-	k8s.io/metrics v0.30.2 // indirect
+	k8s.io/metrics v0.30.3 // indirect
 	oras.land/oras-go v1.2.5 // indirect
 	periph.io/x/host/v3 v3.8.2 // indirect
 )
@@ -285,7 +285,7 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/component-base v0.30.2 // indirect
+	k8s.io/component-base v0.30.3 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20240521193020-835d969ad83a // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
diff --git a/go.sum b/go.sum
index 80536d546..259c15915 100644
--- a/go.sum
+++ b/go.sum
@@ -1820,32 +1820,32 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
 k8s.io/api v0.18.4/go.mod h1:lOIQAKYgai1+vz9J7YcDZwC26Z0zQewYOGWdyIPUUQ4=
-k8s.io/api v0.30.2 h1:+ZhRj+28QT4UOH+BKznu4CBgPWgkXO7XAvMcMl0qKvI=
-k8s.io/api v0.30.2/go.mod h1:ULg5g9JvOev2dG0u2hig4Z7tQ2hHIuS+m8MNZ+X6EmI=
+k8s.io/api v0.30.3 h1:ImHwK9DCsPA9uoU3rVh4QHAHHK5dTSv1nxJUapx8hoQ=
+k8s.io/api v0.30.3/go.mod h1:GPc8jlzoe5JG3pb0KJCSLX5oAFIW3/qNJITlDj8BH04=
 k8s.io/apiextensions-apiserver v0.18.2/go.mod h1:q3faSnRGmYimiocj6cHQ1I3WpLqmDgJFlKL37fC4ZvY=
 k8s.io/apiextensions-apiserver v0.18.4/go.mod h1:NYeyeYq4SIpFlPxSAB6jHPIdvu3hL0pc36wuRChybio=
-k8s.io/apiextensions-apiserver v0.30.2 h1:l7Eue2t6QiLHErfn2vwK4KgF4NeDgjQkCXtEbOocKIE=
-k8s.io/apiextensions-apiserver v0.30.2/go.mod h1:lsJFLYyK40iguuinsb3nt+Sj6CmodSI4ACDLep1rgjw=
+k8s.io/apiextensions-apiserver v0.30.3 h1:oChu5li2vsZHx2IvnGP3ah8Nj3KyqG3kRSaKmijhB9U=
+k8s.io/apiextensions-apiserver v0.30.3/go.mod h1:uhXxYDkMAvl6CJw4lrDN4CPbONkF3+XL9cacCT44kV4=
 k8s.io/apimachinery v0.18.2/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftcA=
 k8s.io/apimachinery v0.18.4/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
-k8s.io/apimachinery v0.30.2 h1:fEMcnBj6qkzzPGSVsAZtQThU62SmQ4ZymlXRC5yFSCg=
-k8s.io/apimachinery v0.30.2/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
+k8s.io/apimachinery v0.30.3 h1:q1laaWCmrszyQuSQCfNB8cFgCuDAoPszKY4ucAjDwHc=
+k8s.io/apimachinery v0.30.3/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
 k8s.io/apiserver v0.18.2/go.mod h1:Xbh066NqrZO8cbsoenCwyDJ1OSi8Ag8I2lezeHxzwzw=
 k8s.io/apiserver v0.18.4/go.mod h1:q+zoFct5ABNnYkGIaGQ3bcbUNdmPyOCoEBcg51LChY8=
-k8s.io/apiserver v0.30.2 h1:ACouHiYl1yFI2VFI3YGM+lvxgy6ir4yK2oLOsLI1/tw=
-k8s.io/apiserver v0.30.2/go.mod h1:BOTdFBIch9Sv0ypSEcUR6ew/NUFGocRFNl72Ra7wTm8=
-k8s.io/cli-runtime v0.30.2 h1:ooM40eEJusbgHNEqnHziN9ZpLN5U4WcQGsdLKVxpkKE=
-k8s.io/cli-runtime v0.30.2/go.mod h1:Y4g/2XezFyTATQUbvV5WaChoUGhojv/jZAtdp5Zkm0A=
+k8s.io/apiserver v0.30.3 h1:QZJndA9k2MjFqpnyYv/PH+9PE0SHhx3hBho4X0vE65g=
+k8s.io/apiserver v0.30.3/go.mod h1:6Oa88y1CZqnzetd2JdepO0UXzQX4ZnOekx2/PtEjrOg=
+k8s.io/cli-runtime v0.30.3 h1:aG69oRzJuP2Q4o8dm+f5WJIX4ZBEwrvdID0+MXyUY6k=
+k8s.io/cli-runtime v0.30.3/go.mod h1:hwrrRdd9P84CXSKzhHxrOivAR9BRnkMt0OeP5mj7X30=
 k8s.io/client-go v0.18.2/go.mod h1:Xcm5wVGXX9HAA2JJ2sSBUn3tCJ+4SVlCbl2MNNv+CIU=
 k8s.io/client-go v0.18.4/go.mod h1:f5sXwL4yAZRkAtzOxRWUhA/N8XzGCb+nPZI8PfobZ9g=
-k8s.io/client-go v0.30.2 h1:sBIVJdojUNPDU/jObC+18tXWcTJVcwyqS9diGdWHk50=
-k8s.io/client-go v0.30.2/go.mod h1:JglKSWULm9xlJLx4KCkfLLQ7XwtlbflV6uFFSHTMgVs=
+k8s.io/client-go v0.30.3 h1:bHrJu3xQZNXIi8/MoxYtZBBWQQXwy16zqJwloXXfD3k=
+k8s.io/client-go v0.30.3/go.mod h1:8d4pf8vYu665/kUbsxWAQ/JDBNWqfFeZnvFiVdmx89U=
 k8s.io/code-generator v0.18.2/go.mod h1:+UHX5rSbxmR8kzS+FAv7um6dtYrZokQvjHpDSYRVkTc=
 k8s.io/code-generator v0.18.4/go.mod h1:TgNEVx9hCyPGpdtCWA34olQYLkh3ok9ar7XfSsr8b6c=
 k8s.io/component-base v0.18.2/go.mod h1:kqLlMuhJNHQ9lz8Z7V5bxUUtjFZnrypArGl58gmDfUM=
 k8s.io/component-base v0.18.4/go.mod h1:7jr/Ef5PGmKwQhyAz/pjByxJbC58mhKAhiaDu0vXfPk=
-k8s.io/component-base v0.30.2 h1:pqGBczYoW1sno8q9ObExUqrYSKhtE5rW3y6gX88GZII=
-k8s.io/component-base v0.30.2/go.mod h1:yQLkQDrkK8J6NtP+MGJOws+/PPeEXNpwFixsUI7h/OE=
+k8s.io/component-base v0.30.3 h1:Ci0UqKWf4oiwy8hr1+E3dsnliKnkMLZMVbWzeorlk7s=
+k8s.io/component-base v0.30.3/go.mod h1:C1SshT3rGPCuNtBs14RmVD2xW0EhRSeLvBh7AGk1quA=
 k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/gengo v0.0.0-20200114144118-36b2048a9120/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
@@ -1858,12 +1858,12 @@ k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c/go.mod h1:GRQhZsXIAJ1xR0C
 k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
 k8s.io/kube-openapi v0.0.0-20240521193020-835d969ad83a h1:zD1uj3Jf+mD4zmA7W+goE5TxDkI7OGJjBNBzq5fJtLA=
 k8s.io/kube-openapi v0.0.0-20240521193020-835d969ad83a/go.mod h1:UxDHUPsUwTOOxSU+oXURfFBcAS6JwiRXTYqYwfuGowc=
-k8s.io/kubectl v0.30.2 h1:cgKNIvsOiufgcs4yjvgkK0+aPCfa8pUwzXdJtkbhsH8=
-k8s.io/kubectl v0.30.2/go.mod h1:rz7GHXaxwnigrqob0lJsiA07Df8RE3n1TSaC2CTeuB4=
+k8s.io/kubectl v0.30.3 h1:YIBBvMdTW0xcDpmrOBzcpUVsn+zOgjMYIu7kAq+yqiI=
+k8s.io/kubectl v0.30.3/go.mod h1:IcR0I9RN2+zzTRUa1BzZCm4oM0NLOawE6RzlDvd1Fpo=
 k8s.io/kubelet v0.30.2 h1:Ck4E/pHndI20IzDXxS57dElhDGASPO5pzXF7BcKfmCY=
 k8s.io/kubelet v0.30.2/go.mod h1:DSwwTbLQmdNkebAU7ypIALR4P9aXZNFwgRmedojUE94=
-k8s.io/metrics v0.30.2 h1:zj4kIPTCfEbY0RHEogpA7QtlItU7xaO11+Gz1zVDxlc=
-k8s.io/metrics v0.30.2/go.mod h1:GpoO5XTy/g8CclVLtgA5WTrr2Cy5vCsqr5Xa/0ETWIk=
+k8s.io/metrics v0.30.3 h1:gKCpte5zykrOmQhZ8qmsxyJslMdiLN+sqbBfIWNpbGM=
+k8s.io/metrics v0.30.3/go.mod h1:W06L2nXRhOwPkFYDJYWdEIS3u6JcJy3ebIPYbndRs6A=
 k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20200603063816-c1c6865ac451/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0 h1:jgGTlFYnhF1PM1Ax/lAlxUPE+KfCIXHaathvJg1C3ak=
diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go
index 6babdfa81..41cb02ce1 100644
--- a/internal/gatewayapi/backendtrafficpolicy.go
+++ b/internal/gatewayapi/backendtrafficpolicy.go
@@ -247,7 +247,8 @@ func resolveBTPolicyGatewayTargetRef(policy *egv1a1.BackendTrafficPolicy, target
 
 	// Check if another policy targeting the same Gateway exists
 	if gateway.attached {
-		message := "Unable to target Gateway, another BackendTrafficPolicy has already attached to it"
+		message := fmt.Sprintf("Unable to target Gateway %s, another BackendTrafficPolicy has already attached to it",
+			string(target.Name))
 
 		return gateway.GatewayContext, &status.PolicyResolveError{
 			Reason:  gwapiv1a2.PolicyReasonConflicted,
@@ -291,8 +292,8 @@ func resolveBTPolicyRouteTargetRef(policy *egv1a1.BackendTrafficPolicy, target g
 
 	// Check if another policy targeting the same xRoute exists
 	if route.attached {
-		message := fmt.Sprintf("Unable to target %s, another BackendTrafficPolicy has already attached to it",
-			string(target.Kind))
+		message := fmt.Sprintf("Unable to target %s %s, another BackendTrafficPolicy has already attached to it",
+			string(target.Kind), string(target.Name))
 
 		return route.RouteContext, &status.PolicyResolveError{
 			Reason:  gwapiv1a2.PolicyReasonConflicted,
diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go
index 7a25a6613..e7e91dbca 100644
--- a/internal/gatewayapi/clienttrafficpolicy.go
+++ b/internal/gatewayapi/clienttrafficpolicy.go
@@ -110,7 +110,8 @@ func (t *Translator) ProcessClientTrafficPolicies(
 				section := string(*(currTarget.SectionName))
 				s, ok := policyMap[key]
 				if ok && s.Has(section) {
-					message := "Unable to target section, another ClientTrafficPolicy has already attached to it"
+					message := fmt.Sprintf("Unable to target section of %s, another ClientTrafficPolicy has already attached to it",
+						string(currTarget.Name))
 
 					resolveErr = &status.PolicyResolveError{
 						Reason:  gwapiv1a2.PolicyReasonConflicted,
@@ -206,7 +207,8 @@ func (t *Translator) ProcessClientTrafficPolicies(
 				// Check if another policy targeting the same Gateway exists
 				s, ok := policyMap[key]
 				if ok && s.Has(AllSections) {
-					message := "Unable to target Gateway, another ClientTrafficPolicy has already attached to it"
+					message := fmt.Sprintf("Unable to target Gateway %s, another ClientTrafficPolicy has already attached to it",
+						string(currTarget.Name))
 
 					resolveErr = &status.PolicyResolveError{
 						Reason:  gwapiv1a2.PolicyReasonConflicted,
diff --git a/internal/gatewayapi/envoyextensionpolicy.go b/internal/gatewayapi/envoyextensionpolicy.go
index 081e8f641..a0882b2de 100644
--- a/internal/gatewayapi/envoyextensionpolicy.go
+++ b/internal/gatewayapi/envoyextensionpolicy.go
@@ -249,7 +249,8 @@ func resolveEEPolicyGatewayTargetRef(policy *egv1a1.EnvoyExtensionPolicy, target
 
 	// Check if another policy targeting the same Gateway exists
 	if gateway.attached {
-		message := "Unable to target Gateway, another EnvoyExtensionPolicy has already attached to it"
+		message := fmt.Sprintf("Unable to target Gateway %s, another EnvoyExtensionPolicy has already attached to it",
+			string(target.Name))
 
 		return gateway.GatewayContext, &status.PolicyResolveError{
 			Reason:  gwapiv1a2.PolicyReasonConflicted,
@@ -293,8 +294,8 @@ func resolveEEPolicyRouteTargetRef(policy *egv1a1.EnvoyExtensionPolicy, target g
 
 	// Check if another policy targeting the same xRoute exists
 	if route.attached {
-		message := fmt.Sprintf("Unable to target %s, another EnvoyExtensionPolicy has already attached to it",
-			string(target.Kind))
+		message := fmt.Sprintf("Unable to target %s %s, another EnvoyExtensionPolicy has already attached to it",
+			string(target.Kind), string(target.Name))
 
 		return route.RouteContext, &status.PolicyResolveError{
 			Reason:  gwapiv1a2.PolicyReasonConflicted,
diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
index 9a0fefbaf..2aec807c7 100644
--- a/internal/gatewayapi/securitypolicy.go
+++ b/internal/gatewayapi/securitypolicy.go
@@ -279,7 +279,8 @@ func resolveSecurityPolicyGatewayTargetRef(
 
 	// Check if another policy targeting the same Gateway exists
 	if gateway.attached {
-		message := "Unable to target Gateway, another SecurityPolicy has already attached to it"
+		message := fmt.Sprintf("Unable to target Gateway %s, another SecurityPolicy has already attached to it",
+			string(target.Name))
 
 		return gateway.GatewayContext, &status.PolicyResolveError{
 			Reason:  gwapiv1a2.PolicyReasonConflicted,
@@ -331,8 +332,8 @@ func resolveSecurityPolicyRouteTargetRef(
 
 	// Check if another policy targeting the same xRoute exists
 	if route.attached {
-		message := fmt.Sprintf("Unable to target %s, another SecurityPolicy has already attached to it",
-			string(target.Kind))
+		message := fmt.Sprintf("Unable to target %s %s, another SecurityPolicy has already attached to it",
+			string(target.Kind), string(target.Name))
 
 		return route.RouteContext, &status.PolicyResolveError{
 			Reason:  gwapiv1a2.PolicyReasonConflicted,
diff --git a/internal/xds/translator/authorization.go b/internal/xds/translator/authorization.go
index cfafb2725..e3a61b164 100644
--- a/internal/xds/translator/authorization.go
+++ b/internal/xds/translator/authorization.go
@@ -54,7 +54,7 @@ func (*rbac) patchHCM(
 
 	// Return early if filter already exists.
 	for _, f := range mgr.HttpFilters {
-		if f.Name == string(egv1a1.EnvoyFilterRBAC) {
+		if f.Name == egv1a1.EnvoyFilterRBAC.String() {
 			return nil
 		}
 	}
@@ -78,7 +78,7 @@ func buildHCMRBACFilter() (*hcmv3.HttpFilter, error) {
 	}
 
 	return &hcmv3.HttpFilter{
-		Name: string(egv1a1.EnvoyFilterRBAC),
+		Name: egv1a1.EnvoyFilterRBAC.String(),
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: rbacAny,
 		},
@@ -114,7 +114,7 @@ func (*rbac) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	}
 
 	filterCfg := route.GetTypedPerFilterConfig()
-	if _, ok := filterCfg[string(egv1a1.EnvoyFilterRBAC)]; ok {
+	if _, ok := filterCfg[egv1a1.EnvoyFilterRBAC.String()]; ok {
 		// This should not happen since this is the only place where the RBAC
 		// filter is added in a route.
 		return fmt.Errorf("route already contains rbac config: %+v", route)
@@ -257,7 +257,7 @@ func (*rbac) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
 	}
 
-	route.TypedPerFilterConfig[string(egv1a1.EnvoyFilterRBAC)] = routeCfgAny
+	route.TypedPerFilterConfig[egv1a1.EnvoyFilterRBAC.String()] = routeCfgAny
 
 	return nil
 }
diff --git a/internal/xds/translator/basicauth.go b/internal/xds/translator/basicauth.go
index e22febfca..50c493514 100644
--- a/internal/xds/translator/basicauth.go
+++ b/internal/xds/translator/basicauth.go
@@ -15,14 +15,11 @@ import (
 	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
 	"google.golang.org/protobuf/types/known/anypb"
 
+	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/ir"
 	"github.com/envoyproxy/gateway/internal/xds/types"
 )
 
-const (
-	basicAuthFilter = "envoy.filters.http.basic_auth"
-)
-
 func init() {
 	registerHTTPFilter(&basicAuth{})
 }
@@ -40,7 +37,7 @@ func (*basicAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTP
 	if irListener == nil {
 		return errors.New("ir listener is nil")
 	}
-	if hcmContainsFilter(mgr, basicAuthFilter) {
+	if hcmContainsFilter(mgr, egv1a1.EnvoyFilterBasicAuth.String()) {
 		return nil
 	}
 
@@ -92,7 +89,7 @@ func buildHCMBasicAuthFilter(basicAuth *ir.BasicAuth) (*hcmv3.HttpFilter, error)
 	}
 
 	return &hcmv3.HttpFilter{
-		Name: basicAuthFilter,
+		Name: egv1a1.EnvoyFilterBasicAuth.String(),
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: basicAuthAny,
 		},
@@ -124,11 +121,11 @@ func (*basicAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error
 	)
 
 	perFilterCfg = route.GetTypedPerFilterConfig()
-	if _, ok := perFilterCfg[basicAuthFilter]; ok {
+	if _, ok := perFilterCfg[egv1a1.EnvoyFilterBasicAuth.String()]; ok {
 		// This should not happen since this is the only place where the filter
 		// config is added in a route.
 		return fmt.Errorf("route already contains filter config: %s, %+v",
-			basicAuthFilter, route)
+			egv1a1.EnvoyFilterBasicAuth.String(), route)
 	}
 
 	// Overwrite the HCM level filter config with the per route filter config.
@@ -144,7 +141,7 @@ func (*basicAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error
 	if perFilterCfg == nil {
 		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
 	}
-	route.TypedPerFilterConfig[basicAuthFilter] = basicAuthAny
+	route.TypedPerFilterConfig[egv1a1.EnvoyFilterBasicAuth.String()] = basicAuthAny
 
 	return nil
 }
diff --git a/internal/xds/translator/extauth.go b/internal/xds/translator/extauth.go
index 5da500ddf..35ca41e79 100644
--- a/internal/xds/translator/extauth.go
+++ b/internal/xds/translator/extauth.go
@@ -17,14 +17,11 @@ import (
 	"google.golang.org/protobuf/types/known/anypb"
 	"google.golang.org/protobuf/types/known/durationpb"
 
+	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/ir"
 	"github.com/envoyproxy/gateway/internal/xds/types"
 )
 
-const (
-	extAuthFilter = "envoy.filters.http.ext_authz"
-)
-
 func init() {
 	registerHTTPFilter(&extAuth{})
 }
@@ -94,7 +91,7 @@ func buildHCMExtAuthFilter(extAuth *ir.ExtAuth) (*hcmv3.HttpFilter, error) {
 }
 
 func extAuthFilterName(extAuth *ir.ExtAuth) string {
-	return perRouteFilterName(extAuthFilter, extAuth.Name)
+	return perRouteFilterName(egv1a1.EnvoyFilterExtAuthz, extAuth.Name)
 }
 
 func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
diff --git a/internal/xds/translator/extproc.go b/internal/xds/translator/extproc.go
index 2eeeb5855..6f4db53a0 100644
--- a/internal/xds/translator/extproc.go
+++ b/internal/xds/translator/extproc.go
@@ -15,14 +15,11 @@ import (
 	"google.golang.org/protobuf/types/known/anypb"
 	"google.golang.org/protobuf/types/known/durationpb"
 
+	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/ir"
 	"github.com/envoyproxy/gateway/internal/xds/types"
 )
 
-const (
-	extProcFilter = "envoy.filters.http.ext_proc"
-)
-
 func init() {
 	registerHTTPFilter(&extProc{})
 }
@@ -93,7 +90,7 @@ func buildHCMExtProcFilter(extProc ir.ExtProc) (*hcmv3.HttpFilter, error) {
 }
 
 func extProcFilterName(extProc ir.ExtProc) string {
-	return perRouteFilterName(extProcFilter, extProc.Name)
+	return perRouteFilterName(egv1a1.EnvoyFilterExtProc, extProc.Name)
 }
 
 func extProcConfig(extProc ir.ExtProc) *extprocv3.ExternalProcessor {
diff --git a/internal/xds/translator/fault.go b/internal/xds/translator/fault.go
index 43fae199c..e0acbd6c8 100644
--- a/internal/xds/translator/fault.go
+++ b/internal/xds/translator/fault.go
@@ -18,14 +18,11 @@ import (
 	"google.golang.org/protobuf/types/known/anypb"
 	"google.golang.org/protobuf/types/known/durationpb"
 
+	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/ir"
 	"github.com/envoyproxy/gateway/internal/xds/types"
 )
 
-const (
-	faultFilter = "envoy.filters.http.fault"
-)
-
 func init() {
 	registerHTTPFilter(&fault{})
 }
@@ -52,7 +49,7 @@ func (*fault) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPList
 
 	// Return early if the fault filter already exists.
 	for _, existingFilter := range mgr.HttpFilters {
-		if existingFilter.Name == faultFilter {
+		if existingFilter.Name == egv1a1.EnvoyFilterFault.String() {
 			return nil
 		}
 	}
@@ -80,7 +77,7 @@ func buildHCMFaultFilter() (*hcmv3.HttpFilter, error) {
 	}
 
 	return &hcmv3.HttpFilter{
-		Name: faultFilter,
+		Name: egv1a1.EnvoyFilterFault.String(),
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: faultAny,
 		},
diff --git a/internal/xds/translator/httpfilters.go b/internal/xds/translator/httpfilters.go
index 5f3a7949d..ad5789fb6 100644
--- a/internal/xds/translator/httpfilters.go
+++ b/internal/xds/translator/httpfilters.go
@@ -97,31 +97,32 @@ func newOrderedHTTPFilter(filter *hcmv3.HttpFilter) *OrderedHTTPFilter {
 	// Set a rational order for all the filters.
 	// When the fault filter is configured to be at the first, the computation of
 	// the remaining filters is skipped when rejected early
+	// Important: After adding new filter types, don't forget to modify the validation rule of the EnvoyFilter type in the API
 	// TODO (zhaohuabing): remove duplicate filter type constants and replace them with the type constants in the api package
 	switch {
-	case isFilterType(filter, wellknown.HealthCheck):
+	case isFilterType(filter, egv1a1.EnvoyFilterHealthCheck):
 		order = 0
-	case isFilterType(filter, wellknown.Fault):
+	case isFilterType(filter, egv1a1.EnvoyFilterFault):
 		order = 1
-	case isFilterType(filter, wellknown.CORS):
+	case isFilterType(filter, egv1a1.EnvoyFilterCORS):
 		order = 2
-	case isFilterType(filter, extAuthFilter):
+	case isFilterType(filter, egv1a1.EnvoyFilterExtAuthz):
 		order = 3
-	case isFilterType(filter, basicAuthFilter):
+	case isFilterType(filter, egv1a1.EnvoyFilterBasicAuth):
 		order = 4
-	case isFilterType(filter, oauth2Filter):
+	case isFilterType(filter, egv1a1.EnvoyFilterOAuth2):
 		order = 5
-	case isFilterType(filter, jwtAuthn):
+	case isFilterType(filter, egv1a1.EnvoyFilterJWTAuthn):
 		order = 6
-	case isFilterType(filter, extProcFilter):
+	case isFilterType(filter, egv1a1.EnvoyFilterExtProc):
 		order = 7 + mustGetFilterIndex(filter.Name)
-	case isFilterType(filter, wasmFilter):
+	case isFilterType(filter, egv1a1.EnvoyFilterWasm):
 		order = 100 + mustGetFilterIndex(filter.Name)
-	case isFilterType(filter, string(egv1a1.EnvoyFilterRBAC)):
+	case isFilterType(filter, egv1a1.EnvoyFilterRBAC):
 		order = 201
-	case isFilterType(filter, localRateLimitFilter):
+	case isFilterType(filter, egv1a1.EnvoyFilterLocalRateLimit):
 		order = 202
-	case isFilterType(filter, wellknown.HTTPRateLimit):
+	case isFilterType(filter, egv1a1.EnvoyFilterRateLimit):
 		order = 203
 	case isFilterType(filter, wellknown.Router):
 		order = 204
@@ -187,7 +188,7 @@ func sortHTTPFilters(filters []*hcmv3.HttpFilter, filterOrder []egv1a1.FilterPos
 		// The real filter name is a generated name prefixed with the filter type,
 		// for example,"envoy.filters.http.oauth2/securitypolicy/default/policy-for-http-route-1".
 		for element := l.Front(); element != nil; element = element.Next() {
-			if isFilterType(element.Value.(*hcmv3.HttpFilter), filterType) {
+			if isFilterType(element.Value.(*hcmv3.HttpFilter), egv1a1.EnvoyFilter(filterType)) {
 				currentFilters = append(currentFilters, element)
 			}
 		}
@@ -202,7 +203,7 @@ func sortHTTPFilters(filters []*hcmv3.HttpFilter, filterOrder []egv1a1.FilterPos
 		// specified in the `FilterOrder.Before` field.
 		case filterOrder[i].Before != nil:
 			for element := l.Front(); element != nil; element = element.Next() {
-				if isFilterType(element.Value.(*hcmv3.HttpFilter), string(*filterOrder[i].Before)) {
+				if isFilterType(element.Value.(*hcmv3.HttpFilter), *filterOrder[i].Before) {
 					for _, filter := range currentFilters {
 						l.MoveBefore(filter, element)
 					}
@@ -214,7 +215,7 @@ func sortHTTPFilters(filters []*hcmv3.HttpFilter, filterOrder []egv1a1.FilterPos
 		case filterOrder[i].After != nil:
 			var afterFilter *list.Element
 			for element := l.Front(); element != nil; element = element.Next() {
-				if isFilterType(element.Value.(*hcmv3.HttpFilter), string(*filterOrder[i].After)) {
+				if isFilterType(element.Value.(*hcmv3.HttpFilter), *filterOrder[i].After) {
 					afterFilter = element
 				}
 			}
@@ -299,11 +300,11 @@ func patchRouteWithPerRouteConfig(
 }
 
 // isFilterType returns true if the filter is the provided filter type.
-func isFilterType(filter *hcmv3.HttpFilter, filterType string) bool {
+func isFilterType(filter *hcmv3.HttpFilter, filterType egv1a1.EnvoyFilter) bool {
 	// Multiple filters of the same types are added to the HCM filter chain, one for each
 	// route. The filter name is prefixed with the filter type, for example:
 	// "envoy.filters.http.oauth2_first-route".
-	return strings.HasPrefix(filter.Name, filterType)
+	return strings.HasPrefix(filter.Name, string(filterType))
 }
 
 // mustGetFilterIndex returns the index of the filter in its filter type.
diff --git a/internal/xds/translator/jwt.go b/internal/xds/translator/jwt.go
index ee6c52326..4d3a85837 100644
--- a/internal/xds/translator/jwt.go
+++ b/internal/xds/translator/jwt.go
@@ -26,7 +26,6 @@ import (
 )
 
 const (
-	jwtAuthn         = "envoy.filters.http.jwt_authn"
 	envoyTrustBundle = "/etc/ssl/certs/ca-certificates.crt"
 )
 
@@ -55,7 +54,7 @@ func (*jwt) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListen
 
 	// Return early if filter already exists.
 	for _, httpFilter := range mgr.HttpFilters {
-		if httpFilter.Name == jwtAuthn {
+		if httpFilter.Name == egv1a1.EnvoyFilterJWTAuthn.String() {
 			return nil
 		}
 	}
@@ -87,7 +86,7 @@ func buildHCMJWTFilter(irListener *ir.HTTPListener) (*hcmv3.HttpFilter, error) {
 	}
 
 	return &hcmv3.HttpFilter{
-		Name: jwtAuthn,
+		Name: egv1a1.EnvoyFilterJWTAuthn.String(),
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: jwtAuthnAny,
 		},
@@ -235,7 +234,7 @@ func (*jwt) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	}
 
 	filterCfg := route.GetTypedPerFilterConfig()
-	if _, ok := filterCfg[jwtAuthn]; !ok {
+	if _, ok := filterCfg[egv1a1.EnvoyFilterJWTAuthn.String()]; !ok {
 		if !routeContainsJWTAuthn(irRoute) {
 			return nil
 		}
@@ -253,7 +252,7 @@ func (*jwt) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 			route.TypedPerFilterConfig = make(map[string]*anypb.Any)
 		}
 
-		route.TypedPerFilterConfig[jwtAuthn] = routeCfgAny
+		route.TypedPerFilterConfig[egv1a1.EnvoyFilterJWTAuthn.String()] = routeCfgAny
 	}
 
 	return nil
diff --git a/internal/xds/translator/local_ratelimit.go b/internal/xds/translator/local_ratelimit.go
index 231bda44f..1503758df 100644
--- a/internal/xds/translator/local_ratelimit.go
+++ b/internal/xds/translator/local_ratelimit.go
@@ -25,7 +25,6 @@ import (
 )
 
 const (
-	localRateLimitFilter           = "envoy.filters.http.local_ratelimit"
 	localRateLimitFilterStatPrefix = "http_local_rate_limiter"
 	descriptorMaskedRemoteAddress  = "masked_remote_address"
 )
@@ -53,7 +52,7 @@ func (*localRateLimit) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir
 
 	// Return early if filter already exists.
 	for _, httpFilter := range mgr.HttpFilters {
-		if httpFilter.Name == localRateLimitFilter {
+		if httpFilter.Name == egv1a1.EnvoyFilterLocalRateLimit.String() {
 			return nil
 		}
 	}
@@ -71,7 +70,7 @@ func (*localRateLimit) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir
 	// empty filter. The real configuration is done at the route level.
 	// See https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/local_rate_limit_filter
 	filter := &hcmv3.HttpFilter{
-		Name: localRateLimitFilter,
+		Name: egv1a1.EnvoyFilterLocalRateLimit.String(),
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: localRlAny,
 		},
@@ -137,7 +136,7 @@ func (*localRateLimit) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) e
 	routeAction.RateLimits = rateLimits
 
 	filterCfg := route.GetTypedPerFilterConfig()
-	if _, ok := filterCfg[localRateLimitFilter]; ok {
+	if _, ok := filterCfg[egv1a1.EnvoyFilterLocalRateLimit.String()]; ok {
 		// This should not happen since this is the only place where the filter
 		// config is added in a route.
 		return fmt.Errorf(
@@ -185,7 +184,7 @@ func (*localRateLimit) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) e
 		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
 	}
 
-	route.TypedPerFilterConfig[localRateLimitFilter] = localRlAny
+	route.TypedPerFilterConfig[egv1a1.EnvoyFilterLocalRateLimit.String()] = localRlAny
 	return nil
 }
 
diff --git a/internal/xds/translator/oidc.go b/internal/xds/translator/oidc.go
index 340caaf4c..e04b601a2 100644
--- a/internal/xds/translator/oidc.go
+++ b/internal/xds/translator/oidc.go
@@ -20,14 +20,11 @@ import (
 	"google.golang.org/protobuf/types/known/durationpb"
 	"k8s.io/utils/ptr"
 
+	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/ir"
 	"github.com/envoyproxy/gateway/internal/xds/types"
 )
 
-const (
-	oauth2Filter = "envoy.filters.http.oauth2"
-)
-
 func init() {
 	registerHTTPFilter(&oidc{})
 }
@@ -101,7 +98,7 @@ func buildHCMOAuth2Filter(oidc *ir.OIDC) (*hcmv3.HttpFilter, error) {
 }
 
 func oauth2FilterName(oidc *ir.OIDC) string {
-	return perRouteFilterName(oauth2Filter, oidc.Name)
+	return perRouteFilterName(egv1a1.EnvoyFilterOAuth2, oidc.Name)
 }
 
 func oauth2Config(oidc *ir.OIDC) (*oauth2v3.OAuth2, error) {
diff --git a/internal/xds/translator/utils.go b/internal/xds/translator/utils.go
index b4f60b1ae..101481508 100644
--- a/internal/xds/translator/utils.go
+++ b/internal/xds/translator/utils.go
@@ -19,6 +19,7 @@ import (
 	"google.golang.org/protobuf/types/known/anypb"
 	"k8s.io/utils/ptr"
 
+	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/ir"
 	"github.com/envoyproxy/gateway/internal/xds/types"
 )
@@ -115,7 +116,7 @@ func enableFilterOnRoute(route *routev3.Route, filterName string) error {
 }
 
 // perRouteFilterName generates a unique filter name for the provided filterType and configName.
-func perRouteFilterName(filterType, configName string) string {
+func perRouteFilterName(filterType egv1a1.EnvoyFilter, configName string) string {
 	return fmt.Sprintf("%s/%s", filterType, configName)
 }
 
diff --git a/internal/xds/translator/wasm.go b/internal/xds/translator/wasm.go
index 4d6434c95..b8777e380 100644
--- a/internal/xds/translator/wasm.go
+++ b/internal/xds/translator/wasm.go
@@ -17,12 +17,12 @@ import (
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 
+	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/ir"
 	"github.com/envoyproxy/gateway/internal/xds/types"
 )
 
 const (
-	wasmFilter            = "envoy.filters.http.wasm"
 	vmRuntimeV8           = "envoy.wasm.runtime.v8"
 	wasmHTTPServerCluster = "wasm_cluster"
 )
@@ -99,7 +99,7 @@ func buildHCMWasmFilter(wasm ir.Wasm) (*hcmv3.HttpFilter, error) {
 }
 
 func wasmFilterName(wasm ir.Wasm) string {
-	return perRouteFilterName(wasmFilter, wasm.Name)
+	return perRouteFilterName(egv1a1.EnvoyFilterWasm, wasm.Name)
 }
 
 func wasmConfig(wasm ir.Wasm) (*wasmfilterv3.Wasm, error) {
diff --git a/site/content/en/contributions/RELEASING.md b/site/content/en/contributions/RELEASING.md
index de480420c..319bb73d0 100644
--- a/site/content/en/contributions/RELEASING.md
+++ b/site/content/en/contributions/RELEASING.md
@@ -97,34 +97,56 @@ export GITHUB_REMOTE=origin
    1. Create the release notes. Reference previous [release notes][] for additional details. __Note:__  The release
       notes should be an accumulation of the release candidate release notes and any changes since the release
       candidate.
-   2. Create a release announcement. Refer to [PR #635] as an example release announcement.
-   3. Include the release in the compatibility matrix. Refer to [PR #1002] as an example.
-   4. Generate the versioned release docs:
+   1. Create a release announcement. Refer to [PR #635] as an example release announcement.
+   1. Include the release in the compatibility matrix. Refer to [PR #1002] as an example.
+   1. Generate the versioned release docs:
 
-   ``` shell
-      make docs-release TAG=v${MAJOR_VERSION}.${MINOR_VERSION}.0
-   ```
+      ``` shell
+         make docs-release TAG=v${MAJOR_VERSION}.${MINOR_VERSION}.0
+      ```
 
-   5. Update the `Get Started` and `Contributing` button referred link in `site/content/en/_index.md`:
+   1. Update the `Documentation` referred link on the menu in `site/hugo.toml`:
+   
+      **DON'T FORGOT TO MOVE IT UNDER `LATEST`**
 
-   ```shell
-      <a class="btn btn-lg btn-primary me-3 mb-4" href="/v0.5.0">
-      Get Started <i class="fas fa-arrow-alt-circle-right ms-2"></i>
-      </a>
-      <a class="btn btn-lg btn-secondary me-3 mb-4" href="/v0.5.0/contributions">
-      Contributing <i class="fa fa-heartbeat ms-2 "></i>
-      </a>
-   ```
+      ```shell
+      [[menu.main]]
+         name = "Documentation"
+         weight = -101
+         pre = "<i class='fas fa-book pr-2'></i>"
+         url = "/v1.1"
+      ```
 
-   6. Update the `Documentation` referred link on the menu in `site/hugo.toml`:
+   1. Update `site/layouts/shortcodes/helm-version.html` base on latest minor version.
+   
+      ```console
+      {{- $pagePrefix := (index (split $.Page.File.Dir "/") 0) -}}
+      {{- with (eq $pagePrefix "latest") -}}
+      {{- "v0.0.0-latest" -}}
+      {{- end -}}
+      {{- with (strings.HasPrefix $pagePrefix "v1.1") -}}
+      {{- "v1.1.0" -}}
+      {{- end -}}
+      {{- with (strings.HasPrefix $pagePrefix "doc") -}}
+      {{- "v1.1.0" -}}
+      {{- end -}}
+      ```
+
+   1. Update `site/layouts/shortcodes/yaml-version.html` base on latest minor version.
+      
+      ```console
+      {{- $pagePrefix := (index (split $.Page.File.Dir "/") 0) -}}
+      {{- with (eq $pagePrefix "latest") -}}
+      {{- "latest" -}}
+      {{- end -}}
+      {{- with (strings.HasPrefix $pagePrefix "v1.1") -}}
+      {{- "v1.1.0" -}}
+      {{- end -}}
+      {{- with (strings.HasPrefix $pagePrefix "doc") -}}
+      {{- "v1.1.0" -}}
+      {{- end -}}
+      ```
 
-   ```shell
-   [[menu.main]]
-      name = "Documentation"
-      weight = -101
-      pre = "<i class='fas fa-book pr-2'></i>"
-      url = "/v0.5.0"
-   ```
 
 3. Sign, commit, and push your changes to your fork.
 4. Submit a [Pull Request][] to merge the changes into the `main` branch. Do not proceed until all your PRs have merged
@@ -170,7 +192,7 @@ export GITHUB_REMOTE=origin
      git push origin v${MAJOR_VERSION}.${MINOR_VERSION}.0
      ```
 
-9. This will trigger the [release GitHub action][] that generates the release, release artifacts, etc.
+9.  This will trigger the [release GitHub action][] that generates the release, release artifacts, etc.
 10. Confirm that the [release workflow][] completed successfully.
 11. Confirm that the Envoy Gateway [image][] with the correct release tag was published to Docker Hub.
 12. Confirm that the [release][] was created.
diff --git a/site/content/en/docs/api/extension_types.md b/site/content/en/docs/api/extension_types.md
index 4dc4ccd89..02f575507 100644
--- a/site/content/en/docs/api/extension_types.md
+++ b/site/content/en/docs/api/extension_types.md
@@ -923,17 +923,18 @@ _Appears in:_
 
 | Value | Description |
 | ----- | ----------- |
+| `envoy.filters.http.health_check` | EnvoyFilterHealthCheck defines the Envoy HTTP health check filter.<br /> | 
 | `envoy.filters.http.fault` | EnvoyFilterFault defines the Envoy HTTP fault filter.<br /> | 
 | `envoy.filters.http.cors` | EnvoyFilterCORS defines the Envoy HTTP CORS filter.<br /> | 
 | `envoy.filters.http.ext_authz` | EnvoyFilterExtAuthz defines the Envoy HTTP external authorization filter.<br /> | 
-| `envoy.filters.http.basic_authn` | EnvoyFilterBasicAuthn defines the Envoy HTTP basic authentication filter.<br /> | 
+| `envoy.filters.http.basic_auth` | EnvoyFilterBasicAuth defines the Envoy HTTP basic authentication filter.<br /> | 
 | `envoy.filters.http.oauth2` | EnvoyFilterOAuth2 defines the Envoy HTTP OAuth2 filter.<br /> | 
 | `envoy.filters.http.jwt_authn` | EnvoyFilterJWTAuthn defines the Envoy HTTP JWT authentication filter.<br /> | 
 | `envoy.filters.http.ext_proc` | EnvoyFilterExtProc defines the Envoy HTTP external process filter.<br /> | 
 | `envoy.filters.http.wasm` | EnvoyFilterWasm defines the Envoy HTTP WebAssembly filter.<br /> | 
+| `envoy.filters.http.rbac` | EnvoyFilterRBAC defines the Envoy RBAC filter.<br /> | 
 | `envoy.filters.http.local_ratelimit` | EnvoyFilterLocalRateLimit defines the Envoy HTTP local rate limit filter.<br /> | 
 | `envoy.filters.http.ratelimit` | EnvoyFilterRateLimit defines the Envoy HTTP rate limit filter.<br /> | 
-| `envoy.filters.http.rbac` | EnvoyFilterRBAC defines the Envoy RBAC filter.<br /> | 
 | `envoy.filters.http.router` | EnvoyFilterRouter defines the Envoy HTTP router filter.<br /> | 
 
 
@@ -1387,7 +1388,7 @@ _Appears in:_
 | `extraArgs` | _string array_ |  false  | ExtraArgs defines additional command line options that are provided to Envoy.<br />More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options<br />Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here. |
 | `mergeGateways` | _boolean_ |  false  | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.<br />Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.<br />This means that the port, protocol and hostname tuple must be unique for every listener.<br />If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition. |
 | `shutdown` | _[ShutdownConfig](#shutdownconfig)_ |  false  | Shutdown defines configuration for graceful envoy shutdown process. |
-| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br /><br />- envoy.filters.http.fault<br /><br />- envoy.filters.http.cors<br /><br />- envoy.filters.http.ext_authz<br /><br />- envoy.filters.http.basic_authn<br /><br />- envoy.filters.http.oauth2<br /><br />- envoy.filters.http.jwt_authn<br /><br />- envoy.filters.http.ext_proc<br /><br />- envoy.filters.http.wasm<br /><br />- envoy.filters.http.rbac<br /><br />- envoy.filters.http.local_ratelimit<br /><br />- envoy.filters.http.ratelimit<br /><br />- envoy.filters.http.router |
+| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br /><br />- envoy.filters.http.health_check<br /><br />- envoy.filters.http.fault<br /><br />- envoy.filters.http.cors<br /><br />- envoy.filters.http.ext_authz<br /><br />- envoy.filters.http.basic_auth<br /><br />- envoy.filters.http.oauth2<br /><br />- envoy.filters.http.jwt_authn<br /><br />- envoy.filters.http.ext_proc<br /><br />- envoy.filters.http.wasm<br /><br />- envoy.filters.http.rbac<br /><br />- envoy.filters.http.local_ratelimit<br /><br />- envoy.filters.http.ratelimit<br /><br />- envoy.filters.http.router<br /><br />Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. |
 | `backendTLS` | _[BackendTLSConfig](#backendtlsconfig)_ |  false  | BackendTLS is the TLS configuration for the Envoy proxy to use when connecting to backends.<br />These settings are applied on backends for which TLS policies are specified. |
 
 
@@ -3335,6 +3336,7 @@ _Appears in:_
 | `jwt` | _[JWT](#jwt)_ |  false  | JWT defines the configuration for JSON Web Token (JWT) authentication. |
 | `oidc` | _[OIDC](#oidc)_ |  false  | OIDC defines the configuration for the OpenID Connect (OIDC) authentication. |
 | `extAuth` | _[ExtAuth](#extauth)_ |  false  | ExtAuth defines the configuration for External Authorization. |
+| `authorization` | _[Authorization](#authorization)_ |  false  | Authorization defines the authorization configuration. |
 
 
 #### ServiceExternalTrafficPolicy
diff --git a/site/content/en/docs/boilerplates/o11y_prerequisites.md b/site/content/en/docs/boilerplates/o11y_prerequisites.md
index 58586502f..2d3312894 100644
--- a/site/content/en/docs/boilerplates/o11y_prerequisites.md
+++ b/site/content/en/docs/boilerplates/o11y_prerequisites.md
@@ -10,5 +10,5 @@ By default, the [OpenTelemetry Collector](https://opentelemetry.io/docs/collecto
 Install the add-ons Helm Chart:
 
 ```shell
-helm install eg-addons oci://docker.io/envoyproxy/gateway-addons-helm --version v0.0.0-latest --set opentelemetry-collector.enabled=true -n monitoring --create-namespace
+helm install eg-addons oci://docker.io/envoyproxy/gateway-addons-helm --version {{< helm-version >}} --set opentelemetry-collector.enabled=true -n monitoring --create-namespace
 ```
diff --git a/site/content/en/docs/install/install-helm.md b/site/content/en/docs/install/install-helm.md
index b3468f642..277856b9a 100644
--- a/site/content/en/docs/install/install-helm.md
+++ b/site/content/en/docs/install/install-helm.md
@@ -34,7 +34,7 @@ Refer to the [Developer Guide](../../contributions/develop) to learn more.
 Install the Gateway API CRDs and Envoy Gateway:
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace
 ```
 
 Wait for Envoy Gateway to become available:
@@ -46,7 +46,7 @@ kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for
 Install the GatewayClass, Gateway, HTTPRoute and example app:
 
 ```shell
-kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default
+kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
 ```
 
 **Note**: [`quickstart.yaml`] defines that Envoy Gateway will listen for
@@ -57,7 +57,7 @@ unprivileged port, so that Envoy Gateway doesn't need additional privileges.
 It's important to be aware of this mapping, since you may need to take it into
 consideration when debugging.
 
-[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml
+[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml
 
 ## Helm chart customizations
 
@@ -70,7 +70,7 @@ If you want to know all the available fields inside the values.yaml file, please
 ### Increase the replicas
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --set deployment.replicas=2
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace --set deployment.replicas=2
 ```
 
 ### Change the kubernetesClusterDomain name
@@ -78,7 +78,7 @@ helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest
 If you have installed your cluster with different domain name you can use below command.
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --set kubernetesClusterDomain=<domain name>
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace --set kubernetesClusterDomain=<domain name>
 ```
 
 **Note**: Above are some of the ways we can directly use for customization of our installation. But if you are looking for more complex changes [values.yaml](https://helm.sh/docs/chart_template_guide/values_files/) comes to rescue.
@@ -115,7 +115,7 @@ Here we have made three changes to our values.yaml file. Increase the resources
 You can use the below command to install the envoy gateway using values.yaml file.
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace -f values.yaml
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace -f values.yaml
 ```
 
 ## Open Ports
diff --git a/site/content/en/docs/install/install-yaml.md b/site/content/en/docs/install/install-yaml.md
index c2a4da45f..e675f15fb 100644
--- a/site/content/en/docs/install/install-yaml.md
+++ b/site/content/en/docs/install/install-yaml.md
@@ -31,7 +31,7 @@ Refer to the [Developer Guide](../../contributions/develop) to learn more.
 1. In your terminal, run the following command:
 
     ```shell
-    kubectl apply --server-side -f https://github.com/envoyproxy/gateway/releases/download/latest/install.yaml
+    kubectl apply --server-side -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/install.yaml
     ```
 
 2. Next Steps
diff --git a/site/content/en/docs/tasks/operations/deployment-mode.md b/site/content/en/docs/tasks/operations/deployment-mode.md
index 16b339fe5..c50d65b28 100644
--- a/site/content/en/docs/tasks/operations/deployment-mode.md
+++ b/site/content/en/docs/tasks/operations/deployment-mode.md
@@ -52,7 +52,7 @@ helm install \
 --set config.envoyGateway.provider.kubernetes.watch.type=Namespaces \
 --set config.envoyGateway.provider.kubernetes.watch.namespaces={marketing} \
 eg-marketing oci://docker.io/envoyproxy/gateway-helm \
---version v0.0.0-latest -n marketing --create-namespace
+--version {{< helm-version >}} -n marketing --create-namespace
 ```
 
 Lets create a `GatewayClass` linked to the marketing team's Envoy Gateway controller, and as well other resources linked to it, so the `backend` application operated by this team can be exposed to external clients.
@@ -340,7 +340,7 @@ helm install \
 --set config.envoyGateway.provider.kubernetes.watch.type=Namespaces \
 --set config.envoyGateway.provider.kubernetes.watch.namespaces={product} \
 eg-product oci://docker.io/envoyproxy/gateway-helm \
---version v0.0.0-latest -n product --create-namespace
+--version {{< helm-version >}} -n product --create-namespace
 ```
 
 Lets create a `GatewayClass` linked to the product team's Envoy Gateway controller, and as well other resources linked to it, so the `backend` application operated by this team can be exposed to external clients.
@@ -823,7 +823,7 @@ curl --header "Host: www.merged1.com" http://$GATEWAY_HOST:8080/example
 Install the GatewayClass, Gateway, HTTPRoute and example app from [Quickstart][] example:
 
 ```shell
-kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default
+kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
 ```
 
 Lets create also and additional `Gateway` linked to the GatewayClass and `backend` application from Quickstart example.
diff --git a/site/content/en/docs/tasks/quickstart.md b/site/content/en/docs/tasks/quickstart.md
index 4075eb5d4..03d7b6de8 100644
--- a/site/content/en/docs/tasks/quickstart.md
+++ b/site/content/en/docs/tasks/quickstart.md
@@ -15,12 +15,14 @@ __Note:__ Refer to the [Compatibility Matrix](/news/releases/matrix) for support
 __Note:__ In case your Kubernetes cluster, does not have a LoadBalancer implementation, we recommend installing one
 so the `Gateway` resource has an Address associated with it. We recommend using [MetalLB](https://metallb.universe.tf/installation/).
 
+__Note:__ For Mac user, you need install and run [Docker Mac Net Connect](https://github.com/chipmk/docker-mac-net-connect) to make the Docker network work.
+
 ## Installation
 
 Install the Gateway API CRDs and Envoy Gateway:
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace
 ```
 
 Wait for Envoy Gateway to become available:
@@ -32,7 +34,7 @@ kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for
 Install the GatewayClass, Gateway, HTTPRoute and example app:
 
 ```shell
-kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default
+kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
 ```
 
 **Note**: [`quickstart.yaml`] defines that Envoy Gateway will listen for
@@ -43,7 +45,7 @@ unprivileged port, so that Envoy Gateway doesn't need additional privileges.
 It's important to be aware of this mapping, since you may need to take it into
 consideration when debugging.
 
-[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml
+[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml
 
 ## Testing the Configuration
 
@@ -142,7 +144,7 @@ Use the steps in this section to uninstall everything from the quickstart.
 Delete the GatewayClass, Gateway, HTTPRoute and Example App:
 
 ```shell
-kubectl delete -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml --ignore-not-found=true
+kubectl delete -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml --ignore-not-found=true
 ```
 
 Delete the Gateway API CRDs and Envoy Gateway:
diff --git a/site/content/en/docs/tasks/traffic/circuit-breaker.md b/site/content/en/docs/tasks/traffic/circuit-breaker.md
index 9480a86a2..d36317395 100644
--- a/site/content/en/docs/tasks/traffic/circuit-breaker.md
+++ b/site/content/en/docs/tasks/traffic/circuit-breaker.md
@@ -76,7 +76,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
@@ -98,7 +97,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
diff --git a/site/content/en/docs/tasks/traffic/client-traffic-policy.md b/site/content/en/docs/tasks/traffic/client-traffic-policy.md
index 37d85e5f8..894770116 100644
--- a/site/content/en/docs/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/docs/tasks/traffic/client-traffic-policy.md
@@ -38,7 +38,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -62,7 +61,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -220,7 +218,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   enableProxyProtocol: true
 EOF
 ```
@@ -241,7 +238,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   enableProxyProtocol: true
 ```
 
@@ -359,7 +355,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
@@ -382,7 +377,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
diff --git a/site/content/en/docs/tasks/traffic/connection-limit.md b/site/content/en/docs/tasks/traffic/connection-limit.md
index aac8437dc..55b0e005f 100644
--- a/site/content/en/docs/tasks/traffic/connection-limit.md
+++ b/site/content/en/docs/tasks/traffic/connection-limit.md
@@ -72,7 +72,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   connection:
     connectionLimit:
       value: 5    
@@ -95,7 +94,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   connection:
     connectionLimit:
       value: 5    
diff --git a/site/content/en/docs/tasks/traffic/global-rate-limit.md b/site/content/en/docs/tasks/traffic/global-rate-limit.md
index 3f1bfa4f3..83c618612 100644
--- a/site/content/en/docs/tasks/traffic/global-rate-limit.md
+++ b/site/content/en/docs/tasks/traffic/global-rate-limit.md
@@ -240,7 +240,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -270,7 +269,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -460,7 +458,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -490,7 +487,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -663,7 +659,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -689,7 +684,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -820,8 +814,7 @@ spec:
   targetRef:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
-    name: http-ratelimit 
-    namespace: default
+    name: http-ratelimit
   rateLimit:
     type: Global
     global:
@@ -870,8 +863,7 @@ spec:
   targetRef:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
-    name: http-ratelimit 
-    namespace: default
+    name: http-ratelimit
   rateLimit:
     type: Global
     global:
diff --git a/site/content/en/docs/tasks/traffic/http3.md b/site/content/en/docs/tasks/traffic/http3.md
index af95ab8ba..4fe660ddf 100644
--- a/site/content/en/docs/tasks/traffic/http3.md
+++ b/site/content/en/docs/tasks/traffic/http3.md
@@ -74,7 +74,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
 EOF
 ```
 
@@ -94,7 +93,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/docs/tasks/traffic/local-rate-limit.md b/site/content/en/docs/tasks/traffic/local-rate-limit.md
index 37fb5590a..4284c7e4f 100644
--- a/site/content/en/docs/tasks/traffic/local-rate-limit.md
+++ b/site/content/en/docs/tasks/traffic/local-rate-limit.md
@@ -50,7 +50,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
@@ -80,7 +79,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
@@ -268,7 +266,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
@@ -294,7 +291,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
diff --git a/site/content/en/docs/tasks/traffic/multicluster-service.md b/site/content/en/docs/tasks/traffic/multicluster-service.md
index d0fd7a83f..690fa354b 100644
--- a/site/content/en/docs/tasks/traffic/multicluster-service.md
+++ b/site/content/en/docs/tasks/traffic/multicluster-service.md
@@ -39,7 +39,7 @@ Once the above steps are done and all the pods are up in both the clusters. We a
 Install the Gateway API CRDs and Envoy Gateway in cluster1:
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --kubeconfig output/kubeconfigs/kind-config-cluster1
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace --kubeconfig output/kubeconfigs/kind-config-cluster1
 ```
 
 Wait for Envoy Gateway to become available:
diff --git a/site/content/en/docs/tasks/traffic/retry.md b/site/content/en/docs/tasks/traffic/retry.md
index 4de8f604f..83429f35e 100644
--- a/site/content/en/docs/tasks/traffic/retry.md
+++ b/site/content/en/docs/tasks/traffic/retry.md
@@ -60,7 +60,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   retry:
     numRetries: 5
     perRetry:
@@ -92,7 +91,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   retry:
     numRetries: 5
     perRetry:
diff --git a/site/content/en/v1.1/api/extension_types.md b/site/content/en/v1.1/api/extension_types.md
index 4dc4ccd89..02f575507 100644
--- a/site/content/en/v1.1/api/extension_types.md
+++ b/site/content/en/v1.1/api/extension_types.md
@@ -923,17 +923,18 @@ _Appears in:_
 
 | Value | Description |
 | ----- | ----------- |
+| `envoy.filters.http.health_check` | EnvoyFilterHealthCheck defines the Envoy HTTP health check filter.<br /> | 
 | `envoy.filters.http.fault` | EnvoyFilterFault defines the Envoy HTTP fault filter.<br /> | 
 | `envoy.filters.http.cors` | EnvoyFilterCORS defines the Envoy HTTP CORS filter.<br /> | 
 | `envoy.filters.http.ext_authz` | EnvoyFilterExtAuthz defines the Envoy HTTP external authorization filter.<br /> | 
-| `envoy.filters.http.basic_authn` | EnvoyFilterBasicAuthn defines the Envoy HTTP basic authentication filter.<br /> | 
+| `envoy.filters.http.basic_auth` | EnvoyFilterBasicAuth defines the Envoy HTTP basic authentication filter.<br /> | 
 | `envoy.filters.http.oauth2` | EnvoyFilterOAuth2 defines the Envoy HTTP OAuth2 filter.<br /> | 
 | `envoy.filters.http.jwt_authn` | EnvoyFilterJWTAuthn defines the Envoy HTTP JWT authentication filter.<br /> | 
 | `envoy.filters.http.ext_proc` | EnvoyFilterExtProc defines the Envoy HTTP external process filter.<br /> | 
 | `envoy.filters.http.wasm` | EnvoyFilterWasm defines the Envoy HTTP WebAssembly filter.<br /> | 
+| `envoy.filters.http.rbac` | EnvoyFilterRBAC defines the Envoy RBAC filter.<br /> | 
 | `envoy.filters.http.local_ratelimit` | EnvoyFilterLocalRateLimit defines the Envoy HTTP local rate limit filter.<br /> | 
 | `envoy.filters.http.ratelimit` | EnvoyFilterRateLimit defines the Envoy HTTP rate limit filter.<br /> | 
-| `envoy.filters.http.rbac` | EnvoyFilterRBAC defines the Envoy RBAC filter.<br /> | 
 | `envoy.filters.http.router` | EnvoyFilterRouter defines the Envoy HTTP router filter.<br /> | 
 
 
@@ -1387,7 +1388,7 @@ _Appears in:_
 | `extraArgs` | _string array_ |  false  | ExtraArgs defines additional command line options that are provided to Envoy.<br />More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options<br />Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here. |
 | `mergeGateways` | _boolean_ |  false  | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.<br />Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.<br />This means that the port, protocol and hostname tuple must be unique for every listener.<br />If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition. |
 | `shutdown` | _[ShutdownConfig](#shutdownconfig)_ |  false  | Shutdown defines configuration for graceful envoy shutdown process. |
-| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br /><br />- envoy.filters.http.fault<br /><br />- envoy.filters.http.cors<br /><br />- envoy.filters.http.ext_authz<br /><br />- envoy.filters.http.basic_authn<br /><br />- envoy.filters.http.oauth2<br /><br />- envoy.filters.http.jwt_authn<br /><br />- envoy.filters.http.ext_proc<br /><br />- envoy.filters.http.wasm<br /><br />- envoy.filters.http.rbac<br /><br />- envoy.filters.http.local_ratelimit<br /><br />- envoy.filters.http.ratelimit<br /><br />- envoy.filters.http.router |
+| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br /><br />- envoy.filters.http.health_check<br /><br />- envoy.filters.http.fault<br /><br />- envoy.filters.http.cors<br /><br />- envoy.filters.http.ext_authz<br /><br />- envoy.filters.http.basic_auth<br /><br />- envoy.filters.http.oauth2<br /><br />- envoy.filters.http.jwt_authn<br /><br />- envoy.filters.http.ext_proc<br /><br />- envoy.filters.http.wasm<br /><br />- envoy.filters.http.rbac<br /><br />- envoy.filters.http.local_ratelimit<br /><br />- envoy.filters.http.ratelimit<br /><br />- envoy.filters.http.router<br /><br />Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. |
 | `backendTLS` | _[BackendTLSConfig](#backendtlsconfig)_ |  false  | BackendTLS is the TLS configuration for the Envoy proxy to use when connecting to backends.<br />These settings are applied on backends for which TLS policies are specified. |
 
 
@@ -3335,6 +3336,7 @@ _Appears in:_
 | `jwt` | _[JWT](#jwt)_ |  false  | JWT defines the configuration for JSON Web Token (JWT) authentication. |
 | `oidc` | _[OIDC](#oidc)_ |  false  | OIDC defines the configuration for the OpenID Connect (OIDC) authentication. |
 | `extAuth` | _[ExtAuth](#extauth)_ |  false  | ExtAuth defines the configuration for External Authorization. |
+| `authorization` | _[Authorization](#authorization)_ |  false  | Authorization defines the authorization configuration. |
 
 
 #### ServiceExternalTrafficPolicy
diff --git a/site/content/en/v1.1/boilerplates/o11y_prerequisites.md b/site/content/en/v1.1/boilerplates/o11y_prerequisites.md
index 58586502f..2d3312894 100644
--- a/site/content/en/v1.1/boilerplates/o11y_prerequisites.md
+++ b/site/content/en/v1.1/boilerplates/o11y_prerequisites.md
@@ -10,5 +10,5 @@ By default, the [OpenTelemetry Collector](https://opentelemetry.io/docs/collecto
 Install the add-ons Helm Chart:
 
 ```shell
-helm install eg-addons oci://docker.io/envoyproxy/gateway-addons-helm --version v0.0.0-latest --set opentelemetry-collector.enabled=true -n monitoring --create-namespace
+helm install eg-addons oci://docker.io/envoyproxy/gateway-addons-helm --version {{< helm-version >}} --set opentelemetry-collector.enabled=true -n monitoring --create-namespace
 ```
diff --git a/site/content/en/v1.1/install/install-helm.md b/site/content/en/v1.1/install/install-helm.md
index b3468f642..277856b9a 100644
--- a/site/content/en/v1.1/install/install-helm.md
+++ b/site/content/en/v1.1/install/install-helm.md
@@ -34,7 +34,7 @@ Refer to the [Developer Guide](../../contributions/develop) to learn more.
 Install the Gateway API CRDs and Envoy Gateway:
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace
 ```
 
 Wait for Envoy Gateway to become available:
@@ -46,7 +46,7 @@ kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for
 Install the GatewayClass, Gateway, HTTPRoute and example app:
 
 ```shell
-kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default
+kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
 ```
 
 **Note**: [`quickstart.yaml`] defines that Envoy Gateway will listen for
@@ -57,7 +57,7 @@ unprivileged port, so that Envoy Gateway doesn't need additional privileges.
 It's important to be aware of this mapping, since you may need to take it into
 consideration when debugging.
 
-[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml
+[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml
 
 ## Helm chart customizations
 
@@ -70,7 +70,7 @@ If you want to know all the available fields inside the values.yaml file, please
 ### Increase the replicas
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --set deployment.replicas=2
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace --set deployment.replicas=2
 ```
 
 ### Change the kubernetesClusterDomain name
@@ -78,7 +78,7 @@ helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest
 If you have installed your cluster with different domain name you can use below command.
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --set kubernetesClusterDomain=<domain name>
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace --set kubernetesClusterDomain=<domain name>
 ```
 
 **Note**: Above are some of the ways we can directly use for customization of our installation. But if you are looking for more complex changes [values.yaml](https://helm.sh/docs/chart_template_guide/values_files/) comes to rescue.
@@ -115,7 +115,7 @@ Here we have made three changes to our values.yaml file. Increase the resources
 You can use the below command to install the envoy gateway using values.yaml file.
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace -f values.yaml
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace -f values.yaml
 ```
 
 ## Open Ports
diff --git a/site/content/en/v1.1/install/install-yaml.md b/site/content/en/v1.1/install/install-yaml.md
index c2a4da45f..e675f15fb 100644
--- a/site/content/en/v1.1/install/install-yaml.md
+++ b/site/content/en/v1.1/install/install-yaml.md
@@ -31,7 +31,7 @@ Refer to the [Developer Guide](../../contributions/develop) to learn more.
 1. In your terminal, run the following command:
 
     ```shell
-    kubectl apply --server-side -f https://github.com/envoyproxy/gateway/releases/download/latest/install.yaml
+    kubectl apply --server-side -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/install.yaml
     ```
 
 2. Next Steps
diff --git a/site/content/en/v1.1/tasks/operations/deployment-mode.md b/site/content/en/v1.1/tasks/operations/deployment-mode.md
index 16b339fe5..c50d65b28 100644
--- a/site/content/en/v1.1/tasks/operations/deployment-mode.md
+++ b/site/content/en/v1.1/tasks/operations/deployment-mode.md
@@ -52,7 +52,7 @@ helm install \
 --set config.envoyGateway.provider.kubernetes.watch.type=Namespaces \
 --set config.envoyGateway.provider.kubernetes.watch.namespaces={marketing} \
 eg-marketing oci://docker.io/envoyproxy/gateway-helm \
---version v0.0.0-latest -n marketing --create-namespace
+--version {{< helm-version >}} -n marketing --create-namespace
 ```
 
 Lets create a `GatewayClass` linked to the marketing team's Envoy Gateway controller, and as well other resources linked to it, so the `backend` application operated by this team can be exposed to external clients.
@@ -340,7 +340,7 @@ helm install \
 --set config.envoyGateway.provider.kubernetes.watch.type=Namespaces \
 --set config.envoyGateway.provider.kubernetes.watch.namespaces={product} \
 eg-product oci://docker.io/envoyproxy/gateway-helm \
---version v0.0.0-latest -n product --create-namespace
+--version {{< helm-version >}} -n product --create-namespace
 ```
 
 Lets create a `GatewayClass` linked to the product team's Envoy Gateway controller, and as well other resources linked to it, so the `backend` application operated by this team can be exposed to external clients.
@@ -823,7 +823,7 @@ curl --header "Host: www.merged1.com" http://$GATEWAY_HOST:8080/example
 Install the GatewayClass, Gateway, HTTPRoute and example app from [Quickstart][] example:
 
 ```shell
-kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default
+kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
 ```
 
 Lets create also and additional `Gateway` linked to the GatewayClass and `backend` application from Quickstart example.
diff --git a/site/content/en/v1.1/tasks/quickstart.md b/site/content/en/v1.1/tasks/quickstart.md
index 4075eb5d4..03d7b6de8 100644
--- a/site/content/en/v1.1/tasks/quickstart.md
+++ b/site/content/en/v1.1/tasks/quickstart.md
@@ -15,12 +15,14 @@ __Note:__ Refer to the [Compatibility Matrix](/news/releases/matrix) for support
 __Note:__ In case your Kubernetes cluster, does not have a LoadBalancer implementation, we recommend installing one
 so the `Gateway` resource has an Address associated with it. We recommend using [MetalLB](https://metallb.universe.tf/installation/).
 
+__Note:__ For Mac user, you need install and run [Docker Mac Net Connect](https://github.com/chipmk/docker-mac-net-connect) to make the Docker network work.
+
 ## Installation
 
 Install the Gateway API CRDs and Envoy Gateway:
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace
 ```
 
 Wait for Envoy Gateway to become available:
@@ -32,7 +34,7 @@ kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for
 Install the GatewayClass, Gateway, HTTPRoute and example app:
 
 ```shell
-kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default
+kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
 ```
 
 **Note**: [`quickstart.yaml`] defines that Envoy Gateway will listen for
@@ -43,7 +45,7 @@ unprivileged port, so that Envoy Gateway doesn't need additional privileges.
 It's important to be aware of this mapping, since you may need to take it into
 consideration when debugging.
 
-[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml
+[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml
 
 ## Testing the Configuration
 
@@ -142,7 +144,7 @@ Use the steps in this section to uninstall everything from the quickstart.
 Delete the GatewayClass, Gateway, HTTPRoute and Example App:
 
 ```shell
-kubectl delete -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml --ignore-not-found=true
+kubectl delete -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml --ignore-not-found=true
 ```
 
 Delete the Gateway API CRDs and Envoy Gateway:
diff --git a/site/content/en/v1.1/tasks/traffic/circuit-breaker.md b/site/content/en/v1.1/tasks/traffic/circuit-breaker.md
index 9480a86a2..d36317395 100644
--- a/site/content/en/v1.1/tasks/traffic/circuit-breaker.md
+++ b/site/content/en/v1.1/tasks/traffic/circuit-breaker.md
@@ -76,7 +76,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
@@ -98,7 +97,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
diff --git a/site/content/en/v1.1/tasks/traffic/client-traffic-policy.md b/site/content/en/v1.1/tasks/traffic/client-traffic-policy.md
index 37d85e5f8..894770116 100644
--- a/site/content/en/v1.1/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/v1.1/tasks/traffic/client-traffic-policy.md
@@ -38,7 +38,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -62,7 +61,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -220,7 +218,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   enableProxyProtocol: true
 EOF
 ```
@@ -241,7 +238,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   enableProxyProtocol: true
 ```
 
@@ -359,7 +355,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
@@ -382,7 +377,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
diff --git a/site/content/en/v1.1/tasks/traffic/connection-limit.md b/site/content/en/v1.1/tasks/traffic/connection-limit.md
index aac8437dc..55b0e005f 100644
--- a/site/content/en/v1.1/tasks/traffic/connection-limit.md
+++ b/site/content/en/v1.1/tasks/traffic/connection-limit.md
@@ -72,7 +72,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   connection:
     connectionLimit:
       value: 5    
@@ -95,7 +94,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   connection:
     connectionLimit:
       value: 5    
diff --git a/site/content/en/v1.1/tasks/traffic/global-rate-limit.md b/site/content/en/v1.1/tasks/traffic/global-rate-limit.md
index 3f1bfa4f3..83c618612 100644
--- a/site/content/en/v1.1/tasks/traffic/global-rate-limit.md
+++ b/site/content/en/v1.1/tasks/traffic/global-rate-limit.md
@@ -240,7 +240,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -270,7 +269,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -460,7 +458,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -490,7 +487,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -663,7 +659,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -689,7 +684,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -820,8 +814,7 @@ spec:
   targetRef:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
-    name: http-ratelimit 
-    namespace: default
+    name: http-ratelimit
   rateLimit:
     type: Global
     global:
@@ -870,8 +863,7 @@ spec:
   targetRef:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
-    name: http-ratelimit 
-    namespace: default
+    name: http-ratelimit
   rateLimit:
     type: Global
     global:
diff --git a/site/content/en/v1.1/tasks/traffic/http3.md b/site/content/en/v1.1/tasks/traffic/http3.md
index af95ab8ba..4fe660ddf 100644
--- a/site/content/en/v1.1/tasks/traffic/http3.md
+++ b/site/content/en/v1.1/tasks/traffic/http3.md
@@ -74,7 +74,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
 EOF
 ```
 
@@ -94,7 +93,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/v1.1/tasks/traffic/local-rate-limit.md b/site/content/en/v1.1/tasks/traffic/local-rate-limit.md
index 37fb5590a..4284c7e4f 100644
--- a/site/content/en/v1.1/tasks/traffic/local-rate-limit.md
+++ b/site/content/en/v1.1/tasks/traffic/local-rate-limit.md
@@ -50,7 +50,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
@@ -80,7 +79,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
@@ -268,7 +266,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
@@ -294,7 +291,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
diff --git a/site/content/en/v1.1/tasks/traffic/multicluster-service.md b/site/content/en/v1.1/tasks/traffic/multicluster-service.md
index d0fd7a83f..690fa354b 100644
--- a/site/content/en/v1.1/tasks/traffic/multicluster-service.md
+++ b/site/content/en/v1.1/tasks/traffic/multicluster-service.md
@@ -39,7 +39,7 @@ Once the above steps are done and all the pods are up in both the clusters. We a
 Install the Gateway API CRDs and Envoy Gateway in cluster1:
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --kubeconfig output/kubeconfigs/kind-config-cluster1
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace --kubeconfig output/kubeconfigs/kind-config-cluster1
 ```
 
 Wait for Envoy Gateway to become available:
diff --git a/site/content/en/v1.1/tasks/traffic/retry.md b/site/content/en/v1.1/tasks/traffic/retry.md
index 4de8f604f..83429f35e 100644
--- a/site/content/en/v1.1/tasks/traffic/retry.md
+++ b/site/content/en/v1.1/tasks/traffic/retry.md
@@ -60,7 +60,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   retry:
     numRetries: 5
     perRetry:
@@ -92,7 +91,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   retry:
     numRetries: 5
     perRetry:
diff --git a/site/hugo.toml b/site/hugo.toml
index 01c5f3aca..fe0678c3d 100644
--- a/site/hugo.toml
+++ b/site/hugo.toml
@@ -277,6 +277,10 @@ enable = true
   version = "latest"
   url = "/latest"
 
+[[params.versions]]
+  version = "v1.1"
+  url = "/v1.1"
+
 [[params.versions]]
   version = "v1.0"
   url = "/docs"
@@ -300,7 +304,3 @@ enable = true
 [[params.versions]]
   version = "v0.2"
   url = "/v0.2"
-
-[[params.versions]]
-  version = "v1.1"
-  url = "/v1.1"
diff --git a/site/layouts/shortcodes/helm-version.html b/site/layouts/shortcodes/helm-version.html
new file mode 100644
index 000000000..a9b2eb0c7
--- /dev/null
+++ b/site/layouts/shortcodes/helm-version.html
@@ -0,0 +1,10 @@
+{{- $pagePrefix := (index (split $.Page.File.Dir "/") 0) -}}
+{{- with (eq $pagePrefix "latest") -}}
+{{- "v0.0.0-latest" -}}
+{{- end -}}
+{{- with (strings.HasPrefix $pagePrefix "v1.1") -}}
+{{- "v1.1.0" -}}
+{{- end -}}
+{{- with (strings.HasPrefix $pagePrefix "doc") -}}
+{{- "v1.1.0" -}}
+{{- end -}}
\ No newline at end of file
diff --git a/site/layouts/shortcodes/yaml-version.html b/site/layouts/shortcodes/yaml-version.html
new file mode 100644
index 000000000..12b243e12
--- /dev/null
+++ b/site/layouts/shortcodes/yaml-version.html
@@ -0,0 +1,10 @@
+{{- $pagePrefix := (index (split $.Page.File.Dir "/") 0) -}}
+{{- with (eq $pagePrefix "latest") -}}
+{{- "latest" -}}
+{{- end -}}
+{{- with (strings.HasPrefix $pagePrefix "v1.1") -}}
+{{- "v1.1.0" -}}
+{{- end -}}
+{{- with (strings.HasPrefix $pagePrefix "doc") -}}
+{{- "v1.1.0" -}}
+{{- end -}}
\ No newline at end of file
diff --git a/tools/crd-ref-docs/config.yaml b/tools/crd-ref-docs/config.yaml
index f1920e2e2..f63d53b2b 100644
--- a/tools/crd-ref-docs/config.yaml
+++ b/tools/crd-ref-docs/config.yaml
@@ -31,7 +31,3 @@ render:
     - name: PolicyStatus
       package: sigs.k8s.io/gateway-api/apis/v1alpha2
       link: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.PolicyStatus
-    - name: JSON
-      package: k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1
-      link: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#json-v1-apiextensions-k8s-io
-
diff --git a/tools/make/docs.mk b/tools/make/docs.mk
index 9ceb9f73d..d6c6b4d82 100644
--- a/tools/make/docs.mk
+++ b/tools/make/docs.mk
@@ -108,13 +108,7 @@ docs-release-gen:
 	$(eval DOC_VERSION := $(shell cat VERSION | cut -d "." -f 1,2))
 	@$(call log, "Added Release Doc: site/content/en/$(DOC_VERSION)")
 	cp -r site/content/en/latest/ site/content/en/$(DOC_VERSION)/
-	@for DOC in $(shell ls site/content/en/latest/user); do \
-		cp site/content/en/$(TAG)/user/$$DOC $(OUTPUT_DIR)/$$DOC ; \
-		cat $(OUTPUT_DIR)/$$DOC | sed "s;v0.0.0-latest;$(TAG);g" | sed "s;latest;$(TAG);g" > $(OUTPUT_DIR)/$(TAG)-$$DOC ; \
-		mv $(OUTPUT_DIR)/$(TAG)-$$DOC site/content/en/$(TAG)/user/$$DOC ; \
-		$(call log, "Updated: site/content/en/$(TAG)/user/$$DOC") ; \
-	done
-
+	@echo "" >> site/hugo.toml
 	@echo '[[params.versions]]' >> site/hugo.toml
 	@echo '  version = "$(DOC_VERSION)"' >> site/hugo.toml
 	@echo '  url = "/$(DOC_VERSION)"' >> site/hugo.toml
diff --git a/tools/src/crd-ref-docs/go.mod b/tools/src/crd-ref-docs/go.mod
index e6ce178a9..a664f856e 100644
--- a/tools/src/crd-ref-docs/go.mod
+++ b/tools/src/crd-ref-docs/go.mod
@@ -2,7 +2,7 @@ module local
 
 go 1.22.5
 
-require github.com/elastic/crd-ref-docs v0.0.13-0.20240413123740-ea9fcaa0230f
+require github.com/elastic/crd-ref-docs v0.0.13-0.20240723135120-56876bccac3a
 
 require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
diff --git a/tools/src/crd-ref-docs/go.sum b/tools/src/crd-ref-docs/go.sum
index 7dc3f5d0b..2c129e265 100644
--- a/tools/src/crd-ref-docs/go.sum
+++ b/tools/src/crd-ref-docs/go.sum
@@ -10,6 +10,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/elastic/crd-ref-docs v0.0.13-0.20240413123740-ea9fcaa0230f h1:cE1CF4Bfi+9gvaNz35jOsp3tFJVm/mFr88szZ41FG8Q=
 github.com/elastic/crd-ref-docs v0.0.13-0.20240413123740-ea9fcaa0230f/go.mod h1:X83mMBdJt05heJUYiS3T0yJ/JkCuliuhSUNav5Gjo/U=
+github.com/elastic/crd-ref-docs v0.0.13-0.20240723135120-56876bccac3a h1:+sHMdth53bKHbct/BqfYIhYXGKhIZJDv2PhS9Gfw8xg=
+github.com/elastic/crd-ref-docs v0.0.13-0.20240723135120-56876bccac3a/go.mod h1:X83mMBdJt05heJUYiS3T0yJ/JkCuliuhSUNav5Gjo/U=
 github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
 github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=


Test patch:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
index b998fb86e..1a054712d 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
@@ -44,8 +44,8 @@ backendTrafficPolicies:
         namespace: envoy-gateway
       conditions:
       - lastTransitionTime: null
-        message: Unable to target HTTPRoute, another BackendTrafficPolicy has already
-          attached to it
+        message: Unable to target HTTPRoute httproute-1, another BackendTrafficPolicy
+          has already attached to it
         reason: Conflicted
         status: "False"
         type: Accepted
@@ -152,8 +152,8 @@ backendTrafficPolicies:
         namespace: envoy-gateway
       conditions:
       - lastTransitionTime: null
-        message: Unable to target Gateway, another BackendTrafficPolicy has already
-          attached to it
+        message: Unable to target Gateway gateway-1, another BackendTrafficPolicy
+          has already attached to it
         reason: Conflicted
         status: "False"
         type: Accepted
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
index ba86d22b1..f4fcac968 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
@@ -75,8 +75,8 @@ clientTrafficPolicies:
         sectionName: https
       conditions:
       - lastTransitionTime: null
-        message: Unable to target section, another ClientTrafficPolicy has already
-          attached to it
+        message: Unable to target section of gateway-2, another ClientTrafficPolicy
+          has already attached to it
         reason: Conflicted
         status: "False"
         type: Accepted
@@ -153,8 +153,8 @@ clientTrafficPolicies:
         namespace: envoy-gateway
       conditions:
       - lastTransitionTime: null
-        message: Unable to target Gateway, another ClientTrafficPolicy has already
-          attached to it
+        message: Unable to target Gateway gateway-1, another ClientTrafficPolicy has
+          already attached to it
         reason: Conflicted
         status: "False"
         type: Accepted
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
index 0c4264fd4..f4cc57f95 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
@@ -44,8 +44,8 @@ envoyExtensionPolicies:
         namespace: envoy-gateway
       conditions:
       - lastTransitionTime: null
-        message: Unable to target HTTPRoute, another EnvoyExtensionPolicy has already
-          attached to it
+        message: Unable to target HTTPRoute httproute-1, another EnvoyExtensionPolicy
+          has already attached to it
         reason: Conflicted
         status: "False"
         type: Accepted
@@ -152,8 +152,8 @@ envoyExtensionPolicies:
         namespace: envoy-gateway
       conditions:
       - lastTransitionTime: null
-        message: Unable to target Gateway, another EnvoyExtensionPolicy has already
-          attached to it
+        message: Unable to target Gateway gateway-1, another EnvoyExtensionPolicy
+          has already attached to it
         reason: Conflicted
         status: "False"
         type: Accepted
diff --git a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
index 33fcb6a5e..607330a82 100644
--- a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
@@ -286,8 +286,8 @@ securityPolicies:
         namespace: envoy-gateway
       conditions:
       - lastTransitionTime: null
-        message: Unable to target HTTPRoute, another SecurityPolicy has already attached
-          to it
+        message: Unable to target HTTPRoute httproute-1, another SecurityPolicy has
+          already attached to it
         reason: Conflicted
         status: "False"
         type: Accepted
@@ -381,8 +381,8 @@ securityPolicies:
         namespace: envoy-gateway
       conditions:
       - lastTransitionTime: null
-        message: Unable to target Gateway, another SecurityPolicy has already attached
-          to it
+        message: Unable to target Gateway gateway-1, another SecurityPolicy has already
+          attached to it
         reason: Conflicted
         status: "False"
         type: Accepted
diff --git a/internal/xds/translator/httpfilters_test.go b/internal/xds/translator/httpfilters_test.go
index 275ad2eb9..22caadc25 100644
--- a/internal/xds/translator/httpfilters_test.go
+++ b/internal/xds/translator/httpfilters_test.go
@@ -26,60 +26,60 @@ func Test_sortHTTPFilters(t *testing.T) {
 		{
 			name: "sort filters",
 			filters: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Router),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
 				httpFilterForTest(wellknown.HealthCheck),
 			},
 			want: []*hcmv3.HttpFilter{
 				httpFilterForTest(wellknown.HealthCheck),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(wellknown.Router),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
 			},
 		},
 		{
 			name: "custom filter order-singleton filter",
 			filters: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Router),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
 			},
 			filterOrder: []egv1a1.FilterPosition{
 				{
@@ -92,41 +92,41 @@ func Test_sortHTTPFilters(t *testing.T) {
 				},
 			},
 			want: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wellknown.Router),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
 			},
 		},
 		{
 			name: "custom filter order-singleton-before-multipleton",
 			filters: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Router),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
 			},
 			filterOrder: []egv1a1.FilterPosition{
 				{
@@ -135,41 +135,41 @@ func Test_sortHTTPFilters(t *testing.T) {
 				},
 			},
 			want: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wellknown.Router),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
 			},
 		},
 		{
 			name: "custom filter order-singleton-after-multipleton",
 			filters: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Router),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
 			},
 			filterOrder: []egv1a1.FilterPosition{
 				{
@@ -178,41 +178,41 @@ func Test_sortHTTPFilters(t *testing.T) {
 				},
 			},
 			want: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(wellknown.Router),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
 			},
 		},
 		{
 			name: "custom filter order-multipleton-before-singleton",
 			filters: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Router),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
 			},
 			filterOrder: []egv1a1.FilterPosition{
 				{
@@ -221,41 +221,41 @@ func Test_sortHTTPFilters(t *testing.T) {
 				},
 			},
 			want: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(wellknown.Router),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
 			},
 		},
 		{
 			name: "custom filter order-multipleton-after-singleton",
 			filters: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Router),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
 			},
 			filterOrder: []egv1a1.FilterPosition{
 				{
@@ -264,41 +264,41 @@ func Test_sortHTTPFilters(t *testing.T) {
 				},
 			},
 			want: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.Router),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
 			},
 		},
 		{
 			name: "custom filter order-multipleton-before-multipleton",
 			filters: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Router),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
 			},
 			filterOrder: []egv1a1.FilterPosition{
 				{
@@ -307,41 +307,41 @@ func Test_sortHTTPFilters(t *testing.T) {
 				},
 			},
 			want: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(wellknown.Router),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
 			},
 		},
 		{
 			name: "custom filter order-multipleton-after-multipleton",
 			filters: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Router),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
 			},
 			filterOrder: []egv1a1.FilterPosition{
 				{
@@ -350,41 +350,41 @@ func Test_sortHTTPFilters(t *testing.T) {
 				},
 			},
 			want: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(wellknown.Router),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
 			},
 		},
 		{
 			name: "custom filter order-complex-ordering",
 			filters: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Router),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
 			},
 			filterOrder: []egv1a1.FilterPosition{
 				{
@@ -405,21 +405,21 @@ func Test_sortHTTPFilters(t *testing.T) {
 				},
 			},
 			want: []*hcmv3.HttpFilter{
-				httpFilterForTest(wellknown.Fault),
-				httpFilterForTest(wellknown.CORS),
-				httpFilterForTest(localRateLimitFilter),
-				httpFilterForTest(extAuthFilter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(basicAuthFilter),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(extProcFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
-				httpFilterForTest(wasmFilter + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
-				httpFilterForTest(oauth2Filter + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(jwtAuthn),
-				httpFilterForTest(string(egv1a1.EnvoyFilterRBAC) + "/securitypolicy/default/policy-for-http-route-1"),
-				httpFilterForTest(wellknown.HTTPRateLimit),
-				httpFilterForTest(wellknown.Router),
+				httpFilterForTest(egv1a1.EnvoyFilterFault),
+				httpFilterForTest(egv1a1.EnvoyFilterCORS),
+				httpFilterForTest(egv1a1.EnvoyFilterLocalRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterExtAuthz + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterBasicAuth),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterExtProc + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/0"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/1"),
+				httpFilterForTest(egv1a1.EnvoyFilterWasm + "/envoyextensionpolicy/default/policy-for-http-route-1/2"),
+				httpFilterForTest(egv1a1.EnvoyFilterOAuth2 + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterJWTAuthn),
+				httpFilterForTest(egv1a1.EnvoyFilterRBAC + "/securitypolicy/default/policy-for-http-route-1"),
+				httpFilterForTest(egv1a1.EnvoyFilterRateLimit),
+				httpFilterForTest(egv1a1.EnvoyFilterRouter),
 			},
 		},
 	}
@@ -431,8 +431,8 @@ func Test_sortHTTPFilters(t *testing.T) {
 	}
 }
 
-func httpFilterForTest(name string) *hcmv3.HttpFilter {
+func httpFilterForTest(name egv1a1.EnvoyFilter) *hcmv3.HttpFilter {
 	return &hcmv3.HttpFilter{
-		Name: name,
+		Name: string(name),
 	}
 }
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 4dc4ccd89..9a2cd961a 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -288,7 +288,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `bufferLimit` | _[Quantity](#quantity)_ |  false  | BufferLimit Soft limit on size of the cluster’s connections read and write buffers.<br />If unspecified, an implementation defined default is applied (32768 bytes).<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note: that when the suffix is not provided, the value is interpreted as bytes. |
+| `bufferLimit` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | BufferLimit Soft limit on size of the cluster’s connections read and write buffers.<br />If unspecified, an implementation defined default is applied (32768 bytes).<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note: that when the suffix is not provided, the value is interpreted as bytes. |
 
 
 #### BackendEndpoint
@@ -473,7 +473,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `users` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ |  true  | The Kubernetes secret which contains the username-password pairs in<br />htpasswd format, used to verify user credentials in the "Authorization"<br />header.<br /><br />This is an Opaque secret. The username-password pairs should be stored in<br />the key ".htpasswd". As the key name indicates, the value needs to be the<br />htpasswd format, for example: "user1:{SHA}hashed_user1_password".<br />Right now, only SHA hash algorithm is supported.<br />Reference to https://httpd.apache.org/docs/2.4/programs/htpasswd.html<br />for more details.<br /><br />Note: The secret must be in the same namespace as the SecurityPolicy. |
+| `users` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ |  true  | The Kubernetes secret which contains the username-password pairs in<br />htpasswd format, used to verify user credentials in the "Authorization"<br />header.<br /><br />This is an Opaque secret. The username-password pairs should be stored in<br />the key ".htpasswd". As the key name indicates, the value needs to be the<br />htpasswd format, for example: "user1:\{SHA\}hashed_user1_password".<br />Right now, only SHA hash algorithm is supported.<br />Reference to https://httpd.apache.org/docs/2.4/programs/htpasswd.html<br />for more details.<br /><br />Note: The secret must be in the same namespace as the SecurityPolicy. |
 
 
 #### BootstrapType
@@ -567,7 +567,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `connectionLimit` | _[ConnectionLimit](#connectionlimit)_ |  false  | ConnectionLimit defines limits related to connections |
-| `bufferLimit` | _[Quantity](#quantity)_ |  false  | BufferLimit provides configuration for the maximum buffer size in bytes for each incoming connection.<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note that when the suffix is not provided, the value is interpreted as bytes.<br />Default: 32768 bytes. |
+| `bufferLimit` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | BufferLimit provides configuration for the maximum buffer size in bytes for each incoming connection.<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note that when the suffix is not provided, the value is interpreted as bytes.<br />Default: 32768 bytes. |
 
 
 #### ClientIPDetectionSettings
@@ -923,17 +923,18 @@ _Appears in:_
 
 | Value | Description |
 | ----- | ----------- |
+| `envoy.filters.http.health_check` | EnvoyFilterHealthCheck defines the Envoy HTTP health check filter.<br /> | 
 | `envoy.filters.http.fault` | EnvoyFilterFault defines the Envoy HTTP fault filter.<br /> | 
 | `envoy.filters.http.cors` | EnvoyFilterCORS defines the Envoy HTTP CORS filter.<br /> | 
 | `envoy.filters.http.ext_authz` | EnvoyFilterExtAuthz defines the Envoy HTTP external authorization filter.<br /> | 
-| `envoy.filters.http.basic_authn` | EnvoyFilterBasicAuthn defines the Envoy HTTP basic authentication filter.<br /> | 
+| `envoy.filters.http.basic_auth` | EnvoyFilterBasicAuth defines the Envoy HTTP basic authentication filter.<br /> | 
 | `envoy.filters.http.oauth2` | EnvoyFilterOAuth2 defines the Envoy HTTP OAuth2 filter.<br /> | 
 | `envoy.filters.http.jwt_authn` | EnvoyFilterJWTAuthn defines the Envoy HTTP JWT authentication filter.<br /> | 
 | `envoy.filters.http.ext_proc` | EnvoyFilterExtProc defines the Envoy HTTP external process filter.<br /> | 
 | `envoy.filters.http.wasm` | EnvoyFilterWasm defines the Envoy HTTP WebAssembly filter.<br /> | 
+| `envoy.filters.http.rbac` | EnvoyFilterRBAC defines the Envoy RBAC filter.<br /> | 
 | `envoy.filters.http.local_ratelimit` | EnvoyFilterLocalRateLimit defines the Envoy HTTP local rate limit filter.<br /> | 
 | `envoy.filters.http.ratelimit` | EnvoyFilterRateLimit defines the Envoy HTTP rate limit filter.<br /> | 
-| `envoy.filters.http.rbac` | EnvoyFilterRBAC defines the Envoy RBAC filter.<br /> | 
 | `envoy.filters.http.router` | EnvoyFilterRouter defines the Envoy HTTP router filter.<br /> | 
 
 
@@ -1387,7 +1388,7 @@ _Appears in:_
 | `extraArgs` | _string array_ |  false  | ExtraArgs defines additional command line options that are provided to Envoy.<br />More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options<br />Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here. |
 | `mergeGateways` | _boolean_ |  false  | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.<br />Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.<br />This means that the port, protocol and hostname tuple must be unique for every listener.<br />If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition. |
 | `shutdown` | _[ShutdownConfig](#shutdownconfig)_ |  false  | Shutdown defines configuration for graceful envoy shutdown process. |
-| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br /><br />- envoy.filters.http.fault<br /><br />- envoy.filters.http.cors<br /><br />- envoy.filters.http.ext_authz<br /><br />- envoy.filters.http.basic_authn<br /><br />- envoy.filters.http.oauth2<br /><br />- envoy.filters.http.jwt_authn<br /><br />- envoy.filters.http.ext_proc<br /><br />- envoy.filters.http.wasm<br /><br />- envoy.filters.http.rbac<br /><br />- envoy.filters.http.local_ratelimit<br /><br />- envoy.filters.http.ratelimit<br /><br />- envoy.filters.http.router |
+| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br /><br />- envoy.filters.http.health_check<br /><br />- envoy.filters.http.fault<br /><br />- envoy.filters.http.cors<br /><br />- envoy.filters.http.ext_authz<br /><br />- envoy.filters.http.basic_auth<br /><br />- envoy.filters.http.oauth2<br /><br />- envoy.filters.http.jwt_authn<br /><br />- envoy.filters.http.ext_proc<br /><br />- envoy.filters.http.wasm<br /><br />- envoy.filters.http.rbac<br /><br />- envoy.filters.http.local_ratelimit<br /><br />- envoy.filters.http.ratelimit<br /><br />- envoy.filters.http.router<br /><br />Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. |
 | `backendTLS` | _[BackendTLSConfig](#backendtlsconfig)_ |  false  | BackendTLS is the TLS configuration for the Envoy proxy to use when connecting to backends.<br />These settings are applied on backends for which TLS policies are specified. |
 
 
@@ -1779,8 +1780,8 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `initialStreamWindowSize` | _[Quantity](#quantity)_ |  false  | InitialStreamWindowSize sets the initial window size for HTTP/2 streams.<br />If not set, the default value is 64 KiB(64*1024). |
-| `initialConnectionWindowSize` | _[Quantity](#quantity)_ |  false  | InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.<br />If not set, the default value is 1 MiB. |
+| `initialStreamWindowSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | InitialStreamWindowSize sets the initial window size for HTTP/2 streams.<br />If not set, the default value is 64 KiB(64*1024). |
+| `initialConnectionWindowSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.<br />If not set, the default value is 1 MiB. |
 | `maxConcurrentStreams` | _integer_ |  false  | MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.<br />If not set, the default value is 100. |
 
 
@@ -1883,7 +1884,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `url` | _string_ |  true  | URL is the URL containing the Wasm code. |
-| `sha256` | _string_ |  false  | SHA256 checksum that will be used to verify the Wasm code.<br /><br />If not specified, Envoy Gateway will not verify the downloaded Wasm code.<br />kubebuilder:validation:Pattern=`^[a-f0-9]{64}$` |
+| `sha256` | _string_ |  false  | SHA256 checksum that will be used to verify the Wasm code.<br /><br />If not specified, Envoy Gateway will not verify the downloaded Wasm code.<br />kubebuilder:validation:Pattern=`^[a-f0-9]\{64\}$` |
 
 
 #### Header
@@ -2012,7 +2013,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `url` | _string_ |  true  | URL is the URL of the OCI image.<br />URL can be in the format of `registry/image:tag` or `registry/image@sha256:digest`. |
-| `sha256` | _string_ |  false  | SHA256 checksum that will be used to verify the OCI image.<br /><br />It must match the digest of the OCI image.<br /><br />If not specified, Envoy Gateway will not verify the downloaded OCI image.<br />kubebuilder:validation:Pattern=`^[a-f0-9]{64}$` |
+| `sha256` | _string_ |  false  | SHA256 checksum that will be used to verify the OCI image.<br /><br />It must match the digest of the OCI image.<br /><br />If not specified, Envoy Gateway will not verify the downloaded OCI image.<br />kubebuilder:validation:Pattern=`^[a-f0-9]\{64\}$` |
 | `pullSecretRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ |  false  | PullSecretRef is a reference to the secret containing the credentials to pull the image.<br />Only support Kubernetes Secret resource from the same namespace. |
 
 
@@ -2104,7 +2105,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `name` | _string_ |  true  | Name is the HTTP header name to retrieve the token |
-| `valuePrefix` | _string_ |  false  | ValuePrefix is the prefix that should be stripped before extracting the token.<br />The format would be used by Envoy like "{ValuePrefix}<TOKEN>".<br />For example, "Authorization: Bearer <TOKEN>", then the ValuePrefix="Bearer " with a space at the end. |
+| `valuePrefix` | _string_ |  false  | ValuePrefix is the prefix that should be stripped before extracting the token.<br />The format would be used by Envoy like "\{ValuePrefix\}<TOKEN>".<br />For example, "Authorization: Bearer <TOKEN>", then the ValuePrefix="Bearer " with a space at the end. |
 
 
 #### JWTProvider
@@ -3335,6 +3336,7 @@ _Appears in:_
 | `jwt` | _[JWT](#jwt)_ |  false  | JWT defines the configuration for JSON Web Token (JWT) authentication. |
 | `oidc` | _[OIDC](#oidc)_ |  false  | OIDC defines the configuration for the OpenID Connect (OIDC) authentication. |
 | `extAuth` | _[ExtAuth](#extauth)_ |  false  | ExtAuth defines the configuration for External Authorization. |
+| `authorization` | _[Authorization](#authorization)_ |  false  | Authorization defines the authorization configuration. |
 
 
 #### ServiceExternalTrafficPolicy
diff --git a/site/content/en/latest/boilerplates/o11y_prerequisites.md b/site/content/en/latest/boilerplates/o11y_prerequisites.md
index 58586502f..2d3312894 100644
--- a/site/content/en/latest/boilerplates/o11y_prerequisites.md
+++ b/site/content/en/latest/boilerplates/o11y_prerequisites.md
@@ -10,5 +10,5 @@ By default, the [OpenTelemetry Collector](https://opentelemetry.io/docs/collecto
 Install the add-ons Helm Chart:
 
 ```shell
-helm install eg-addons oci://docker.io/envoyproxy/gateway-addons-helm --version v0.0.0-latest --set opentelemetry-collector.enabled=true -n monitoring --create-namespace
+helm install eg-addons oci://docker.io/envoyproxy/gateway-addons-helm --version {{< helm-version >}} --set opentelemetry-collector.enabled=true -n monitoring --create-namespace
 ```
diff --git a/site/content/en/latest/boilerplates/prerequisites.md b/site/content/en/latest/boilerplates/prerequisites.md
new file mode 100644
index 000000000..064238e4d
--- /dev/null
+++ b/site/content/en/latest/boilerplates/prerequisites.md
@@ -0,0 +1,24 @@
+---
+---
+
+Follow the steps from the [Quickstart](../tasks/quickstart) task to install Envoy Gateway and the example manifest.
+Before proceeding, you should be able to query the example backend using HTTP.
+
+Verify the Gateway status:
+
+{{< tabpane text=true >}}
+{{% tab header="kubectl" %}}
+
+```shell
+kubectl get gateway/eg -o yaml
+```
+
+{{% /tab %}}
+{{% tab header="egctl (experimental)" %}}
+
+```shell
+egctl x status gateway -v
+```
+
+{{% /tab %}}
+{{< /tabpane >}}
diff --git a/site/content/en/latest/install/install-helm.md b/site/content/en/latest/install/install-helm.md
index b3468f642..277856b9a 100644
--- a/site/content/en/latest/install/install-helm.md
+++ b/site/content/en/latest/install/install-helm.md
@@ -34,7 +34,7 @@ Refer to the [Developer Guide](../../contributions/develop) to learn more.
 Install the Gateway API CRDs and Envoy Gateway:
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace
 ```
 
 Wait for Envoy Gateway to become available:
@@ -46,7 +46,7 @@ kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for
 Install the GatewayClass, Gateway, HTTPRoute and example app:
 
 ```shell
-kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default
+kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
 ```
 
 **Note**: [`quickstart.yaml`] defines that Envoy Gateway will listen for
@@ -57,7 +57,7 @@ unprivileged port, so that Envoy Gateway doesn't need additional privileges.
 It's important to be aware of this mapping, since you may need to take it into
 consideration when debugging.
 
-[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml
+[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml
 
 ## Helm chart customizations
 
@@ -70,7 +70,7 @@ If you want to know all the available fields inside the values.yaml file, please
 ### Increase the replicas
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --set deployment.replicas=2
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace --set deployment.replicas=2
 ```
 
 ### Change the kubernetesClusterDomain name
@@ -78,7 +78,7 @@ helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest
 If you have installed your cluster with different domain name you can use below command.
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --set kubernetesClusterDomain=<domain name>
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace --set kubernetesClusterDomain=<domain name>
 ```
 
 **Note**: Above are some of the ways we can directly use for customization of our installation. But if you are looking for more complex changes [values.yaml](https://helm.sh/docs/chart_template_guide/values_files/) comes to rescue.
@@ -115,7 +115,7 @@ Here we have made three changes to our values.yaml file. Increase the resources
 You can use the below command to install the envoy gateway using values.yaml file.
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace -f values.yaml
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace -f values.yaml
 ```
 
 ## Open Ports
diff --git a/site/content/en/latest/install/install-yaml.md b/site/content/en/latest/install/install-yaml.md
index c2a4da45f..e675f15fb 100644
--- a/site/content/en/latest/install/install-yaml.md
+++ b/site/content/en/latest/install/install-yaml.md
@@ -31,7 +31,7 @@ Refer to the [Developer Guide](../../contributions/develop) to learn more.
 1. In your terminal, run the following command:
 
     ```shell
-    kubectl apply --server-side -f https://github.com/envoyproxy/gateway/releases/download/latest/install.yaml
+    kubectl apply --server-side -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/install.yaml
     ```
 
 2. Next Steps
diff --git a/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md b/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
index ff819754d..9626dc937 100644
--- a/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
+++ b/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
@@ -22,8 +22,7 @@ not exposed by Envoy Gateway APIs today.
 
 ### Prerequisites
 
-* Follow the steps from the [Quickstart](../../quickstart) task to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ### Enable EnvoyPatchPolicy
 
diff --git a/site/content/en/latest/tasks/extensibility/ext-proc.md b/site/content/en/latest/tasks/extensibility/ext-proc.md
index 9028447ab..f6b8b5c74 100644
--- a/site/content/en/latest/tasks/extensibility/ext-proc.md
+++ b/site/content/en/latest/tasks/extensibility/ext-proc.md
@@ -12,14 +12,7 @@ This instantiated resource can be linked to a [Gateway][Gateway] and [HTTPRoute]
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
-
-Verify the Gateway status:
-
-```shell
-kubectl get gateway/eg -o yaml
-```
+{{< boilerplate prerequisites >}}
 
 ## GRPC External Processing Service
 
diff --git a/site/content/en/latest/tasks/extensibility/extension-server.md b/site/content/en/latest/tasks/extensibility/extension-server.md
index 7d67c23f6..922f0de7c 100644
--- a/site/content/en/latest/tasks/extensibility/extension-server.md
+++ b/site/content/en/latest/tasks/extensibility/extension-server.md
@@ -37,8 +37,7 @@ Authentication.
 
 ### Prerequisites
 
-* Follow the steps from the [Quickstart](../quickstart) task to install Envoy Gateway and the example manifest.
-  Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ### Build and run the example Extension Server
 
diff --git a/site/content/en/latest/tasks/extensibility/wasm.md b/site/content/en/latest/tasks/extensibility/wasm.md
index d973de779..6cb3d1092 100644
--- a/site/content/en/latest/tasks/extensibility/wasm.md
+++ b/site/content/en/latest/tasks/extensibility/wasm.md
@@ -12,14 +12,7 @@ This instantiated resource can be linked to a [Gateway][Gateway] and [HTTPRoute]
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
-
-Verify the Gateway status:
-
-```shell
-kubectl get gateway/eg -o yaml
-```
+{{< boilerplate prerequisites >}}
 
 ## Configuration
 
diff --git a/site/content/en/latest/tasks/observability/gateway-api-metrics.md b/site/content/en/latest/tasks/observability/gateway-api-metrics.md
index bd9e5b893..bf799616a 100644
--- a/site/content/en/latest/tasks/observability/gateway-api-metrics.md
+++ b/site/content/en/latest/tasks/observability/gateway-api-metrics.md
@@ -7,8 +7,7 @@ The project also provides example dashboard for visualising the metrics using Gr
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 Run the following commands to install the metrics stack, with the Gateway API State Metrics configuration, on your kubernetes cluster:
 
diff --git a/site/content/en/latest/tasks/operations/customize-envoyproxy.md b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
index 562237bfc..bfcc3d6e0 100644
--- a/site/content/en/latest/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
@@ -8,8 +8,7 @@ Service. To learn more about GatewayClass and ParametersRef, please refer to [Ga
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 Before you start, you need to add `ParametersRef` in GatewayClass, and refer to EnvoyProxy Config:
 
diff --git a/site/content/en/latest/tasks/operations/deployment-mode.md b/site/content/en/latest/tasks/operations/deployment-mode.md
index 16b339fe5..c50d65b28 100644
--- a/site/content/en/latest/tasks/operations/deployment-mode.md
+++ b/site/content/en/latest/tasks/operations/deployment-mode.md
@@ -52,7 +52,7 @@ helm install \
 --set config.envoyGateway.provider.kubernetes.watch.type=Namespaces \
 --set config.envoyGateway.provider.kubernetes.watch.namespaces={marketing} \
 eg-marketing oci://docker.io/envoyproxy/gateway-helm \
---version v0.0.0-latest -n marketing --create-namespace
+--version {{< helm-version >}} -n marketing --create-namespace
 ```
 
 Lets create a `GatewayClass` linked to the marketing team's Envoy Gateway controller, and as well other resources linked to it, so the `backend` application operated by this team can be exposed to external clients.
@@ -340,7 +340,7 @@ helm install \
 --set config.envoyGateway.provider.kubernetes.watch.type=Namespaces \
 --set config.envoyGateway.provider.kubernetes.watch.namespaces={product} \
 eg-product oci://docker.io/envoyproxy/gateway-helm \
---version v0.0.0-latest -n product --create-namespace
+--version {{< helm-version >}} -n product --create-namespace
 ```
 
 Lets create a `GatewayClass` linked to the product team's Envoy Gateway controller, and as well other resources linked to it, so the `backend` application operated by this team can be exposed to external clients.
@@ -823,7 +823,7 @@ curl --header "Host: www.merged1.com" http://$GATEWAY_HOST:8080/example
 Install the GatewayClass, Gateway, HTTPRoute and example app from [Quickstart][] example:
 
 ```shell
-kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default
+kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
 ```
 
 Lets create also and additional `Gateway` linked to the GatewayClass and `backend` application from Quickstart example.
diff --git a/site/content/en/latest/tasks/operations/egctl.md b/site/content/en/latest/tasks/operations/egctl.md
index ac1f13d7a..36c1f9979 100644
--- a/site/content/en/latest/tasks/operations/egctl.md
+++ b/site/content/en/latest/tasks/operations/egctl.md
@@ -4,8 +4,6 @@ title: "Use egctl"
 
 `egctl` is a command line tool to provide additional functionality for Envoy Gateway users.
 
-
-
 ## egctl experimental translate
 
 This subcommand allows users to translate from an input configuration type to an output configuration type.
diff --git a/site/content/en/latest/tasks/quickstart.md b/site/content/en/latest/tasks/quickstart.md
index 4075eb5d4..03d7b6de8 100644
--- a/site/content/en/latest/tasks/quickstart.md
+++ b/site/content/en/latest/tasks/quickstart.md
@@ -15,12 +15,14 @@ __Note:__ Refer to the [Compatibility Matrix](/news/releases/matrix) for support
 __Note:__ In case your Kubernetes cluster, does not have a LoadBalancer implementation, we recommend installing one
 so the `Gateway` resource has an Address associated with it. We recommend using [MetalLB](https://metallb.universe.tf/installation/).
 
+__Note:__ For Mac user, you need install and run [Docker Mac Net Connect](https://github.com/chipmk/docker-mac-net-connect) to make the Docker network work.
+
 ## Installation
 
 Install the Gateway API CRDs and Envoy Gateway:
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace
 ```
 
 Wait for Envoy Gateway to become available:
@@ -32,7 +34,7 @@ kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for
 Install the GatewayClass, Gateway, HTTPRoute and example app:
 
 ```shell
-kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default
+kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml -n default
 ```
 
 **Note**: [`quickstart.yaml`] defines that Envoy Gateway will listen for
@@ -43,7 +45,7 @@ unprivileged port, so that Envoy Gateway doesn't need additional privileges.
 It's important to be aware of this mapping, since you may need to take it into
 consideration when debugging.
 
-[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml
+[`quickstart.yaml`]: https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml
 
 ## Testing the Configuration
 
@@ -142,7 +144,7 @@ Use the steps in this section to uninstall everything from the quickstart.
 Delete the GatewayClass, Gateway, HTTPRoute and Example App:
 
 ```shell
-kubectl delete -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml --ignore-not-found=true
+kubectl delete -f https://github.com/envoyproxy/gateway/releases/download/{{< yaml-version >}}/quickstart.yaml --ignore-not-found=true
 ```
 
 Delete the Gateway API CRDs and Envoy Gateway:
diff --git a/site/content/en/latest/tasks/security/backend-tls.md b/site/content/en/latest/tasks/security/backend-tls.md
index 53e9ccbd4..c30777f69 100644
--- a/site/content/en/latest/tasks/security/backend-tls.md
+++ b/site/content/en/latest/tasks/security/backend-tls.md
@@ -13,7 +13,7 @@ Envoy Gateway supports the Gateway-API defined [BackendTLSPolicy][].
 
 ## Installation
 
-Follow the steps from the [Quickstart][] to install Envoy Gateway and the example manifest.
+{{< boilerplate prerequisites >}}
 
 ## TLS Certificates
 
@@ -385,6 +385,5 @@ The TLS version is now TLS1.3, as configured in the EnvoyProxy resource. The TLS
  }
 ```
 
-[Quickstart]: ../quickstart
 [BackendTLSPolicy]: https://gateway-api.sigs.k8s.io/api-types/backendtlspolicy/
-[EnvoyProxy]: ../../api/extension_types#envoyproxy
\ No newline at end of file
+[EnvoyProxy]: ../../api/extension_types#envoyproxy
diff --git a/site/content/en/latest/tasks/security/basic-auth.md b/site/content/en/latest/tasks/security/basic-auth.md
index 956963b6d..79e481560 100644
--- a/site/content/en/latest/tasks/security/basic-auth.md
+++ b/site/content/en/latest/tasks/security/basic-auth.md
@@ -12,8 +12,7 @@ This instantiated resource can be linked to a [Gateway][Gateway], [HTTPRoute][HT
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Configuration
 
diff --git a/site/content/en/latest/tasks/security/cors.md b/site/content/en/latest/tasks/security/cors.md
index cfbe979cd..129e318cc 100644
--- a/site/content/en/latest/tasks/security/cors.md
+++ b/site/content/en/latest/tasks/security/cors.md
@@ -11,8 +11,7 @@ This instantiated resource can be linked to a [Gateway][Gateway], [HTTPRoute][HT
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Configuration
 
diff --git a/site/content/en/latest/tasks/security/ext-auth.md b/site/content/en/latest/tasks/security/ext-auth.md
index 5fc733211..e0f30e031 100644
--- a/site/content/en/latest/tasks/security/ext-auth.md
+++ b/site/content/en/latest/tasks/security/ext-auth.md
@@ -13,14 +13,7 @@ This instantiated resource can be linked to a [Gateway][Gateway] and [HTTPRoute]
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
-
-Verify the Gateway status:
-
-```shell
-kubectl get gateway/eg -o yaml
-```
+{{< boilerplate prerequisites >}}
 
 ## HTTP External Authorization Service
 
diff --git a/site/content/en/latest/tasks/security/jwt-authentication.md b/site/content/en/latest/tasks/security/jwt-authentication.md
index 8b1604038..0468d572f 100644
--- a/site/content/en/latest/tasks/security/jwt-authentication.md
+++ b/site/content/en/latest/tasks/security/jwt-authentication.md
@@ -11,9 +11,9 @@ This instantiated resource can be linked to a [Gateway][Gateway], [HTTPRoute][HT
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway and the example manifest.
+{{< boilerplate prerequisites >}}
+
 For GRPC - follow the steps from the [GRPC Routing](../traffic/grpc-routing) example.
-Before proceeding, you should be able to query the example backend using HTTP or GRPC.
 
 ## Configuration
 
diff --git a/site/content/en/latest/tasks/security/mutual-tls.md b/site/content/en/latest/tasks/security/mutual-tls.md
index 64f471ba1..4eed29a1c 100644
--- a/site/content/en/latest/tasks/security/mutual-tls.md
+++ b/site/content/en/latest/tasks/security/mutual-tls.md
@@ -11,8 +11,7 @@ This task uses a self-signed CA, so it should be used for testing and demonstrat
 
 ## Installation
 
-Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## TLS Certificates
 
diff --git a/site/content/en/latest/tasks/security/oidc.md b/site/content/en/latest/tasks/security/oidc.md
index ac7d6d60b..f7890b5d1 100644
--- a/site/content/en/latest/tasks/security/oidc.md
+++ b/site/content/en/latest/tasks/security/oidc.md
@@ -13,8 +13,7 @@ This instantiated resource can be linked to a [Gateway][Gateway] and [HTTPRoute]
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 EG OIDC authentication requires the redirect URL to be HTTPS. Follow the [Secure Gateways](../secure-gateways) guide
 to generate the TLS certificates and update the Gateway configuration to add an HTTPS listener.
diff --git a/site/content/en/latest/tasks/security/restrict-ip-access.md b/site/content/en/latest/tasks/security/restrict-ip-access.md
index ba6af1182..cfc0fca50 100644
--- a/site/content/en/latest/tasks/security/restrict-ip-access.md
+++ b/site/content/en/latest/tasks/security/restrict-ip-access.md
@@ -10,8 +10,7 @@ This instantiated resource can be linked to a [Gateway][Gateway], [HTTPRoute][HT
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Configuration
 
diff --git a/site/content/en/latest/tasks/security/secure-gateways.md b/site/content/en/latest/tasks/security/secure-gateways.md
index af5e92241..f0e5c8c26 100644
--- a/site/content/en/latest/tasks/security/secure-gateways.md
+++ b/site/content/en/latest/tasks/security/secure-gateways.md
@@ -11,8 +11,7 @@ This task uses a self-signed CA, so it should be used for testing and demonstrat
 
 ## Installation
 
-Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## TLS Certificates
 
diff --git a/site/content/en/latest/tasks/security/tls-cert-manager.md b/site/content/en/latest/tasks/security/tls-cert-manager.md
index d51fa469e..997a7ef25 100644
--- a/site/content/en/latest/tasks/security/tls-cert-manager.md
+++ b/site/content/en/latest/tasks/security/tls-cert-manager.md
@@ -18,8 +18,7 @@ Changing to the Let's Encrypt production environment is straight-forward after t
 
 ## Installation
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Deploying cert-manager
 
diff --git a/site/content/en/latest/tasks/security/tls-passthrough.md b/site/content/en/latest/tasks/security/tls-passthrough.md
index 4f9665d67..47e379335 100644
--- a/site/content/en/latest/tasks/security/tls-passthrough.md
+++ b/site/content/en/latest/tasks/security/tls-passthrough.md
@@ -12,8 +12,7 @@ to terminate the TLS connection, while the Gateway routes the requests to the ap
 
 ## Installation
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## TLS Certificates
 
diff --git a/site/content/en/latest/tasks/security/tls-termination.md b/site/content/en/latest/tasks/security/tls-termination.md
index e4534dd57..1100b0469 100644
--- a/site/content/en/latest/tasks/security/tls-termination.md
+++ b/site/content/en/latest/tasks/security/tls-termination.md
@@ -11,9 +11,10 @@ This task uses a self-signed CA, so it should be used for testing and demonstrat
 
 ## Installation
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway.
+{{< boilerplate prerequisites >}}
 
 ## TLS Certificates
+
 Generate the certificates and keys used by the Gateway to terminate client TLS connections.
 
 Create a root certificate and private key to sign certificates:
diff --git a/site/content/en/latest/tasks/traffic/backend.md b/site/content/en/latest/tasks/traffic/backend.md
index 02de7161f..0f2ade4da 100644
--- a/site/content/en/latest/tasks/traffic/backend.md
+++ b/site/content/en/latest/tasks/traffic/backend.md
@@ -36,8 +36,7 @@ Envoy Gateway does not manage the lifecycle of unix domain sockets referenced by
 
 ### Prerequisites
 
-* Follow the steps from the [Quickstart](../../quickstart) task to install Envoy Gateway and the example manifest.
-  Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ### Enable Backend
 
diff --git a/site/content/en/latest/tasks/traffic/circuit-breaker.md b/site/content/en/latest/tasks/traffic/circuit-breaker.md
index 9480a86a2..99887daba 100644
--- a/site/content/en/latest/tasks/traffic/circuit-breaker.md
+++ b/site/content/en/latest/tasks/traffic/circuit-breaker.md
@@ -20,9 +20,10 @@ This instantiated resource can be linked to a [Gateway][], [HTTPRoute][] or [GRP
 
 ### Install Envoy Gateway
 
-* Follow the installation step from the [Quickstart](../../quickstart) to install Envoy Gateway and sample resources.
+{{< boilerplate prerequisites >}}
 
 ### Install the hey load testing tool
+
 * The `hey` CLI will be used to generate load and measure response times. Follow the installation instruction from the [Hey project] docs.   
 
 ## Test and customize circuit breaker settings
@@ -76,7 +77,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
@@ -98,7 +98,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   circuitBreaker:
     maxPendingRequests: 0
     maxParallelRequests: 10
diff --git a/site/content/en/latest/tasks/traffic/client-traffic-policy.md b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
index 37d85e5f8..a6b4a7f9f 100644
--- a/site/content/en/latest/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
@@ -4,7 +4,6 @@ title: "Client Traffic Policy"
 
 This task explains the usage of the [ClientTrafficPolicy][] API.
 
-
 ## Introduction
 
 The [ClientTrafficPolicy][] API allows system administrators to configure
@@ -18,8 +17,7 @@ This API was added as a new policy attachment resource that can be applied to Ga
 
 ### Prerequisites
 
-* Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ### Support TCP keepalive for downstream client
 
@@ -38,7 +36,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -62,7 +59,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   tcpKeepalive:
     idleTime: 20m
     interval: 60s
@@ -220,7 +216,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   enableProxyProtocol: true
 EOF
 ```
@@ -241,7 +236,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   enableProxyProtocol: true
 ```
 
@@ -359,7 +353,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
@@ -382,7 +375,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 2
diff --git a/site/content/en/latest/tasks/traffic/connection-limit.md b/site/content/en/latest/tasks/traffic/connection-limit.md
index aac8437dc..21f679e73 100644
--- a/site/content/en/latest/tasks/traffic/connection-limit.md
+++ b/site/content/en/latest/tasks/traffic/connection-limit.md
@@ -25,10 +25,10 @@ When a [Client Traffic Policy][] is attached to a gateway, the connection limit
 
 ### Install Envoy Gateway
 
-* Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the HTTPRoute example manifest.
-  Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ### Install the hey load testing tool
+
 * The `hey` CLI will be used to generate load and measure response times. Follow the installation instruction from the [Hey project] docs.
 
 ## Test and customize connection limit settings
@@ -72,7 +72,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   connection:
     connectionLimit:
       value: 5    
@@ -95,7 +94,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
   connection:
     connectionLimit:
       value: 5    
diff --git a/site/content/en/latest/tasks/traffic/fault-injection.md b/site/content/en/latest/tasks/traffic/fault-injection.md
index d4f536dbb..040dc1812 100644
--- a/site/content/en/latest/tasks/traffic/fault-injection.md
+++ b/site/content/en/latest/tasks/traffic/fault-injection.md
@@ -13,11 +13,12 @@ This instantiated resource can be linked to a [Gateway][], [HTTPRoute][] or [GRP
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
+{{< boilerplate prerequisites >}}
+
 For GRPC - follow the steps from the [GRPC Routing](../grpc-routing) example.
-Before proceeding, you should be able to query the example backend using HTTP or GRPC.
 
 ### Install the hey load testing tool
+
 * The `hey` CLI will be used to generate load and measure response times. Follow the installation instruction from the [Hey project] docs.
 
 ## Configuration
diff --git a/site/content/en/latest/tasks/traffic/gateway-address.md b/site/content/en/latest/tasks/traffic/gateway-address.md
index bd87726c1..f49d7f99e 100644
--- a/site/content/en/latest/tasks/traffic/gateway-address.md
+++ b/site/content/en/latest/tasks/traffic/gateway-address.md
@@ -10,7 +10,7 @@ Depending on the Service Type, the addresses of gateway can be used as:
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
+{{< boilerplate prerequisites >}}
 
 ## External IPs
 
diff --git a/site/content/en/latest/tasks/traffic/global-rate-limit.md b/site/content/en/latest/tasks/traffic/global-rate-limit.md
index 3f1bfa4f3..9dd732a81 100644
--- a/site/content/en/latest/tasks/traffic/global-rate-limit.md
+++ b/site/content/en/latest/tasks/traffic/global-rate-limit.md
@@ -27,8 +27,7 @@ has its own 100r/s rate limit bucket.
 
 ### Install Envoy Gateway
 
-* Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the HTTPRoute example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ### Install Redis
 
@@ -240,7 +239,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -270,7 +268,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -460,7 +457,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -490,7 +486,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -663,7 +658,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -689,7 +683,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -821,7 +814,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit 
-    namespace: default
   rateLimit:
     type: Global
     global:
@@ -871,7 +863,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit 
-    namespace: default
   rateLimit:
     type: Global
     global:
diff --git a/site/content/en/latest/tasks/traffic/grpc-routing.md b/site/content/en/latest/tasks/traffic/grpc-routing.md
index 7c41b54c8..15f10601b 100644
--- a/site/content/en/latest/tasks/traffic/grpc-routing.md
+++ b/site/content/en/latest/tasks/traffic/grpc-routing.md
@@ -7,8 +7,7 @@ To learn more about gRPC routing, refer to the [Gateway API documentation][].
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Installation
 
diff --git a/site/content/en/latest/tasks/traffic/http-redirect.md b/site/content/en/latest/tasks/traffic/http-redirect.md
index b3177e892..49ccd59ee 100644
--- a/site/content/en/latest/tasks/traffic/http-redirect.md
+++ b/site/content/en/latest/tasks/traffic/http-redirect.md
@@ -9,8 +9,7 @@ learn more about HTTP routing, refer to the [Gateway API documentation][].
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTPS.
+{{< boilerplate prerequisites >}}
 
 ## Redirects
 
diff --git a/site/content/en/latest/tasks/traffic/http-request-headers.md b/site/content/en/latest/tasks/traffic/http-request-headers.md
index 7bc709c49..9cd60281c 100644
--- a/site/content/en/latest/tasks/traffic/http-request-headers.md
+++ b/site/content/en/latest/tasks/traffic/http-request-headers.md
@@ -14,8 +14,7 @@ client.
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Adding Request Headers
 
diff --git a/site/content/en/latest/tasks/traffic/http-request-mirroring.md b/site/content/en/latest/tasks/traffic/http-request-mirroring.md
index f22ef51da..5c1c80656 100644
--- a/site/content/en/latest/tasks/traffic/http-request-mirroring.md
+++ b/site/content/en/latest/tasks/traffic/http-request-mirroring.md
@@ -6,10 +6,9 @@ The [HTTPRoute][] resource allows one or more [backendRefs][] to be provided. Re
 
 When requests are made to a `HTTPRoute` that uses a `HTTPRequestMirrorFilter`, the response will never come from the `backendRef` defined in the filter. Responses from the mirror `backendRef` are always ignored.
 
-## Installation
+## Prerequisites
 
-Follow the steps from the [Quickstart][] to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Mirroring the Traffic
 
@@ -440,7 +439,6 @@ spec:
 Error from server: error when creating "STDIN": admission webhook "validate.gateway.networking.k8s.io" denied the request: spec.rules[0].filters: Invalid value: "RequestMirror": cannot be used multiple times in the same rule
 ```
 
-[Quickstart]: ../../quickstart/
 [Traffic Splitting]: ../http-traffic-splitting/
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute/
 [backendRefs]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.BackendRef
diff --git a/site/content/en/latest/tasks/traffic/http-response-headers.md b/site/content/en/latest/tasks/traffic/http-response-headers.md
index 60121674b..b1588e87a 100644
--- a/site/content/en/latest/tasks/traffic/http-response-headers.md
+++ b/site/content/en/latest/tasks/traffic/http-response-headers.md
@@ -12,8 +12,7 @@ upstream service.
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Adding Response Headers
 
diff --git a/site/content/en/latest/tasks/traffic/http-routing.md b/site/content/en/latest/tasks/traffic/http-routing.md
index aba57adc9..705846c6e 100644
--- a/site/content/en/latest/tasks/traffic/http-routing.md
+++ b/site/content/en/latest/tasks/traffic/http-routing.md
@@ -9,8 +9,7 @@ Services. To learn more about HTTP routing, refer to the [Gateway API documentat
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Installation
 
diff --git a/site/content/en/latest/tasks/traffic/http-timeouts.md b/site/content/en/latest/tasks/traffic/http-timeouts.md
index 1eb9beabb..4fb264204 100644
--- a/site/content/en/latest/tasks/traffic/http-timeouts.md
+++ b/site/content/en/latest/tasks/traffic/http-timeouts.md
@@ -12,10 +12,9 @@ The [HTTPRouteTimeouts][] supports two kinds of timeouts:
 
 __Note:__  The Request duration must be >= BackendRequest duration
 
-## Installation
+## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Verification
 
diff --git a/site/content/en/latest/tasks/traffic/http-traffic-splitting.md b/site/content/en/latest/tasks/traffic/http-traffic-splitting.md
index 06e4a2365..2f3dbdf6e 100644
--- a/site/content/en/latest/tasks/traffic/http-traffic-splitting.md
+++ b/site/content/en/latest/tasks/traffic/http-traffic-splitting.md
@@ -6,10 +6,9 @@ The [HTTPRoute][] resource allows one or more [backendRefs][] to be provided. Re
 if they match the rules of the HTTPRoute. If an invalid backendRef is configured, then HTTP responses will be returned
 with status code `500` for all requests that would have been sent to that backend.
 
-## Installation
+## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Single backendRef
 
diff --git a/site/content/en/latest/tasks/traffic/http-urlrewrite.md b/site/content/en/latest/tasks/traffic/http-urlrewrite.md
index 0ebb7595c..67915f93f 100644
--- a/site/content/en/latest/tasks/traffic/http-urlrewrite.md
+++ b/site/content/en/latest/tasks/traffic/http-urlrewrite.md
@@ -7,8 +7,7 @@ used on a Route rule. This MUST NOT be used on the same Route rule as a HTTPRequ
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Rewrite URL Prefix Path
 
diff --git a/site/content/en/latest/tasks/traffic/http3.md b/site/content/en/latest/tasks/traffic/http3.md
index af95ab8ba..cb5034284 100644
--- a/site/content/en/latest/tasks/traffic/http3.md
+++ b/site/content/en/latest/tasks/traffic/http3.md
@@ -11,8 +11,7 @@ This task uses a self-signed CA, so it should be used for testing and demonstrat
 
 ## Installation
 
-Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## TLS Certificates
 
@@ -74,7 +73,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
 EOF
 ```
 
@@ -94,7 +92,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: Gateway
     name: eg
-    namespace: default
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/latest/tasks/traffic/load-balancing.md b/site/content/en/latest/tasks/traffic/load-balancing.md
index 90a816e7b..b8bdff01a 100644
--- a/site/content/en/latest/tasks/traffic/load-balancing.md
+++ b/site/content/en/latest/tasks/traffic/load-balancing.md
@@ -17,8 +17,9 @@ This instantiated resource can be linked to a [Gateway][], [HTTPRoute][] or [GRP
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+### Install Envoy Gateway
+
+{{< boilerplate prerequisites >}}
 
 For better testing the load balancer, you can add more hosts in upstream cluster by increasing the replicas of one deployment:
 
diff --git a/site/content/en/latest/tasks/traffic/local-rate-limit.md b/site/content/en/latest/tasks/traffic/local-rate-limit.md
index 37fb5590a..a7b920db1 100644
--- a/site/content/en/latest/tasks/traffic/local-rate-limit.md
+++ b/site/content/en/latest/tasks/traffic/local-rate-limit.md
@@ -26,10 +26,7 @@ has its own 100r/s rate limit bucket.
 
 ## Prerequisites
 
-### Install Envoy Gateway
-
-* Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the HTTPRoute example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Rate Limit Specific User 
 
@@ -50,7 +47,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
@@ -80,7 +76,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
@@ -268,7 +263,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
@@ -294,7 +288,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: http-ratelimit
-    namespace: default
   rateLimit:
     type: Local
     local:
diff --git a/site/content/en/latest/tasks/traffic/multicluster-service.md b/site/content/en/latest/tasks/traffic/multicluster-service.md
index d0fd7a83f..690fa354b 100644
--- a/site/content/en/latest/tasks/traffic/multicluster-service.md
+++ b/site/content/en/latest/tasks/traffic/multicluster-service.md
@@ -39,7 +39,7 @@ Once the above steps are done and all the pods are up in both the clusters. We a
 Install the Gateway API CRDs and Envoy Gateway in cluster1:
 
 ```shell
-helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --kubeconfig output/kubeconfigs/kind-config-cluster1
+helm install eg oci://docker.io/envoyproxy/gateway-helm --version {{< helm-version >}} -n envoy-gateway-system --create-namespace --kubeconfig output/kubeconfigs/kind-config-cluster1
 ```
 
 Wait for Envoy Gateway to become available:
diff --git a/site/content/en/latest/tasks/traffic/retry.md b/site/content/en/latest/tasks/traffic/retry.md
index 4de8f604f..25b7e2519 100644
--- a/site/content/en/latest/tasks/traffic/retry.md
+++ b/site/content/en/latest/tasks/traffic/retry.md
@@ -15,7 +15,7 @@ Envoy Gateway introduces a new CRD called [BackendTrafficPolicy](../../../api/ex
 
 ## Prerequisites
 
-Follow the installation step from the [Quickstart](../../quickstart) to install Envoy Gateway and sample resources.
+{{< boilerplate prerequisites >}}
 
 ## Test and customize retry settings
 
@@ -60,7 +60,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   retry:
     numRetries: 5
     perRetry:
@@ -92,7 +91,6 @@ spec:
     group: gateway.networking.k8s.io
     kind: HTTPRoute
     name: backend
-    namespace: default
   retry:
     numRetries: 5
     perRetry:
diff --git a/site/content/en/latest/tasks/traffic/tcp-routing.md b/site/content/en/latest/tasks/traffic/tcp-routing.md
index d36f145e2..0befbd014 100644
--- a/site/content/en/latest/tasks/traffic/tcp-routing.md
+++ b/site/content/en/latest/tasks/traffic/tcp-routing.md
@@ -6,10 +6,9 @@ title: "TCP Routing"
 connections on the port specified by the listener to a set of backends specified by the TCPRoute. To learn more about
 HTTP routing, refer to the [Gateway API documentation][].
 
-## Installation
+## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Configuration
 
diff --git a/site/content/en/latest/tasks/traffic/udp-routing.md b/site/content/en/latest/tasks/traffic/udp-routing.md
index b9d8e3792..546b77f91 100644
--- a/site/content/en/latest/tasks/traffic/udp-routing.md
+++ b/site/content/en/latest/tasks/traffic/udp-routing.md
@@ -12,8 +12,7 @@ For additional information, refer to Envoy's [UDP proxy documentation][].
 
 ## Prerequisites
 
-Follow the steps from the [Quickstart](../../quickstart) to install Envoy Gateway and the example manifest.
-Before proceeding, you should be able to query the example backend using HTTP.
+{{< boilerplate prerequisites >}}
 
 ## Installation
 
diff --git a/site/content/zh/latest/api/extension_types.md b/site/content/zh/latest/api/extension_types.md
index 4dc4ccd89..9a2cd961a 100644
--- a/site/content/zh/latest/api/extension_types.md
+++ b/site/content/zh/latest/api/extension_types.md
@@ -288,7 +288,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `bufferLimit` | _[Quantity](#quantity)_ |  false  | BufferLimit Soft limit on size of the cluster’s connections read and write buffers.<br />If unspecified, an implementation defined default is applied (32768 bytes).<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note: that when the suffix is not provided, the value is interpreted as bytes. |
+| `bufferLimit` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | BufferLimit Soft limit on size of the cluster’s connections read and write buffers.<br />If unspecified, an implementation defined default is applied (32768 bytes).<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note: that when the suffix is not provided, the value is interpreted as bytes. |
 
 
 #### BackendEndpoint
@@ -473,7 +473,7 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `users` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ |  true  | The Kubernetes secret which contains the username-password pairs in<br />htpasswd format, used to verify user credentials in the "Authorization"<br />header.<br /><br />This is an Opaque secret. The username-password pairs should be stored in<br />the key ".htpasswd". As the key name indicates, the value needs to be the<br />htpasswd format, for example: "user1:{SHA}hashed_user1_password".<br />Right now, only SHA hash algorithm is supported.<br />Reference to https://httpd.apache.org/docs/2.4/programs/htpasswd.html<br />for more details.<br /><br />Note: The secret must be in the same namespace as the SecurityPolicy. |
+| `users` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ |  true  | The Kubernetes secret which contains the username-password pairs in<br />htpasswd format, used to verify user credentials in the "Authorization"<br />header.<br /><br />This is an Opaque secret. The username-password pairs should be stored in<br />the key ".htpasswd". As the key name indicates, the value needs to be the<br />htpasswd format, for example: "user1:\{SHA\}hashed_user1_password".<br />Right now, only SHA hash algorithm is supported.<br />Reference to https://httpd.apache.org/docs/2.4/programs/htpasswd.html<br />for more details.<br /><br />Note: The secret must be in the same namespace as the SecurityPolicy. |
 
 
 #### BootstrapType
@@ -567,7 +567,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `connectionLimit` | _[ConnectionLimit](#connectionlimit)_ |  false  | ConnectionLimit defines limits related to connections |
-| `bufferLimit` | _[Quantity](#quantity)_ |  false  | BufferLimit provides configuration for the maximum buffer size in bytes for each incoming connection.<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note that when the suffix is not provided, the value is interpreted as bytes.<br />Default: 32768 bytes. |
+| `bufferLimit` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | BufferLimit provides configuration for the maximum buffer size in bytes for each incoming connection.<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note that when the suffix is not provided, the value is interpreted as bytes.<br />Default: 32768 bytes. |
 
 
 #### ClientIPDetectionSettings
@@ -923,17 +923,18 @@ _Appears in:_
 
 | Value | Description |
 | ----- | ----------- |
+| `envoy.filters.http.health_check` | EnvoyFilterHealthCheck defines the Envoy HTTP health check filter.<br /> | 
 | `envoy.filters.http.fault` | EnvoyFilterFault defines the Envoy HTTP fault filter.<br /> | 
 | `envoy.filters.http.cors` | EnvoyFilterCORS defines the Envoy HTTP CORS filter.<br /> | 
 | `envoy.filters.http.ext_authz` | EnvoyFilterExtAuthz defines the Envoy HTTP external authorization filter.<br /> | 
-| `envoy.filters.http.basic_authn` | EnvoyFilterBasicAuthn defines the Envoy HTTP basic authentication filter.<br /> | 
+| `envoy.filters.http.basic_auth` | EnvoyFilterBasicAuth defines the Envoy HTTP basic authentication filter.<br /> | 
 | `envoy.filters.http.oauth2` | EnvoyFilterOAuth2 defines the Envoy HTTP OAuth2 filter.<br /> | 
 | `envoy.filters.http.jwt_authn` | EnvoyFilterJWTAuthn defines the Envoy HTTP JWT authentication filter.<br /> | 
 | `envoy.filters.http.ext_proc` | EnvoyFilterExtProc defines the Envoy HTTP external process filter.<br /> | 
 | `envoy.filters.http.wasm` | EnvoyFilterWasm defines the Envoy HTTP WebAssembly filter.<br /> | 
+| `envoy.filters.http.rbac` | EnvoyFilterRBAC defines the Envoy RBAC filter.<br /> | 
 | `envoy.filters.http.local_ratelimit` | EnvoyFilterLocalRateLimit defines the Envoy HTTP local rate limit filter.<br /> | 
 | `envoy.filters.http.ratelimit` | EnvoyFilterRateLimit defines the Envoy HTTP rate limit filter.<br /> | 
-| `envoy.filters.http.rbac` | EnvoyFilterRBAC defines the Envoy RBAC filter.<br /> | 
 | `envoy.filters.http.router` | EnvoyFilterRouter defines the Envoy HTTP router filter.<br /> | 
 
 
@@ -1387,7 +1388,7 @@ _Appears in:_
 | `extraArgs` | _string array_ |  false  | ExtraArgs defines additional command line options that are provided to Envoy.<br />More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options<br />Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here. |
 | `mergeGateways` | _boolean_ |  false  | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.<br />Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.<br />This means that the port, protocol and hostname tuple must be unique for every listener.<br />If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition. |
 | `shutdown` | _[ShutdownConfig](#shutdownconfig)_ |  false  | Shutdown defines configuration for graceful envoy shutdown process. |
-| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br /><br />- envoy.filters.http.fault<br /><br />- envoy.filters.http.cors<br /><br />- envoy.filters.http.ext_authz<br /><br />- envoy.filters.http.basic_authn<br /><br />- envoy.filters.http.oauth2<br /><br />- envoy.filters.http.jwt_authn<br /><br />- envoy.filters.http.ext_proc<br /><br />- envoy.filters.http.wasm<br /><br />- envoy.filters.http.rbac<br /><br />- envoy.filters.http.local_ratelimit<br /><br />- envoy.filters.http.ratelimit<br /><br />- envoy.filters.http.router |
+| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br /><br />- envoy.filters.http.health_check<br /><br />- envoy.filters.http.fault<br /><br />- envoy.filters.http.cors<br /><br />- envoy.filters.http.ext_authz<br /><br />- envoy.filters.http.basic_auth<br /><br />- envoy.filters.http.oauth2<br /><br />- envoy.filters.http.jwt_authn<br /><br />- envoy.filters.http.ext_proc<br /><br />- envoy.filters.http.wasm<br /><br />- envoy.filters.http.rbac<br /><br />- envoy.filters.http.local_ratelimit<br /><br />- envoy.filters.http.ratelimit<br /><br />- envoy.filters.http.router<br /><br />Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. |
 | `backendTLS` | _[BackendTLSConfig](#backendtlsconfig)_ |  false  | BackendTLS is the TLS configuration for the Envoy proxy to use when connecting to backends.<br />These settings are applied on backends for which TLS policies are specified. |
 
 
@@ -1779,8 +1780,8 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `initialStreamWindowSize` | _[Quantity](#quantity)_ |  false  | InitialStreamWindowSize sets the initial window size for HTTP/2 streams.<br />If not set, the default value is 64 KiB(64*1024). |
-| `initialConnectionWindowSize` | _[Quantity](#quantity)_ |  false  | InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.<br />If not set, the default value is 1 MiB. |
+| `initialStreamWindowSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | InitialStreamWindowSize sets the initial window size for HTTP/2 streams.<br />If not set, the default value is 64 KiB(64*1024). |
+| `initialConnectionWindowSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.<br />If not set, the default value is 1 MiB. |
 | `maxConcurrentStreams` | _integer_ |  false  | MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.<br />If not set, the default value is 100. |
 
 
@@ -1883,7 +1884,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `url` | _string_ |  true  | URL is the URL containing the Wasm code. |
-| `sha256` | _string_ |  false  | SHA256 checksum that will be used to verify the Wasm code.<br /><br />If not specified, Envoy Gateway will not verify the downloaded Wasm code.<br />kubebuilder:validation:Pattern=`^[a-f0-9]{64}$` |
+| `sha256` | _string_ |  false  | SHA256 checksum that will be used to verify the Wasm code.<br /><br />If not specified, Envoy Gateway will not verify the downloaded Wasm code.<br />kubebuilder:validation:Pattern=`^[a-f0-9]\{64\}$` |
 
 
 #### Header
@@ -2012,7 +2013,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `url` | _string_ |  true  | URL is the URL of the OCI image.<br />URL can be in the format of `registry/image:tag` or `registry/image@sha256:digest`. |
-| `sha256` | _string_ |  false  | SHA256 checksum that will be used to verify the OCI image.<br /><br />It must match the digest of the OCI image.<br /><br />If not specified, Envoy Gateway will not verify the downloaded OCI image.<br />kubebuilder:validation:Pattern=`^[a-f0-9]{64}$` |
+| `sha256` | _string_ |  false  | SHA256 checksum that will be used to verify the OCI image.<br /><br />It must match the digest of the OCI image.<br /><br />If not specified, Envoy Gateway will not verify the downloaded OCI image.<br />kubebuilder:validation:Pattern=`^[a-f0-9]\{64\}$` |
 | `pullSecretRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ |  false  | PullSecretRef is a reference to the secret containing the credentials to pull the image.<br />Only support Kubernetes Secret resource from the same namespace. |
 
 
@@ -2104,7 +2105,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `name` | _string_ |  true  | Name is the HTTP header name to retrieve the token |
-| `valuePrefix` | _string_ |  false  | ValuePrefix is the prefix that should be stripped before extracting the token.<br />The format would be used by Envoy like "{ValuePrefix}<TOKEN>".<br />For example, "Authorization: Bearer <TOKEN>", then the ValuePrefix="Bearer " with a space at the end. |
+| `valuePrefix` | _string_ |  false  | ValuePrefix is the prefix that should be stripped before extracting the token.<br />The format would be used by Envoy like "\{ValuePrefix\}<TOKEN>".<br />For example, "Authorization: Bearer <TOKEN>", then the ValuePrefix="Bearer " with a space at the end. |
 
 
 #### JWTProvider
@@ -3335,6 +3336,7 @@ _Appears in:_
 | `jwt` | _[JWT](#jwt)_ |  false  | JWT defines the configuration for JSON Web Token (JWT) authentication. |
 | `oidc` | _[OIDC](#oidc)_ |  false  | OIDC defines the configuration for the OpenID Connect (OIDC) authentication. |
 | `extAuth` | _[ExtAuth](#extauth)_ |  false  | ExtAuth defines the configuration for External Authorization. |
+| `authorization` | _[Authorization](#authorization)_ |  false  | Authorization defines the authorization configuration. |
 
 
 #### ServiceExternalTrafficPolicy
diff --git a/test/cel-validation/envoyproxy_test.go b/test/cel-validation/envoyproxy_test.go
index f24dfd0eb..4d914a7e9 100644
--- a/test/cel-validation/envoyproxy_test.go
+++ b/test/cel-validation/envoyproxy_test.go
@@ -1345,7 +1345,7 @@ func TestEnvoyProxyProvider(t *testing.T) {
 						{
 							Name:   egv1a1.EnvoyFilterRateLimit,
 							Before: ptr.To(egv1a1.EnvoyFilterCORS),
-							After:  ptr.To(egv1a1.EnvoyFilterBasicAuthn),
+							After:  ptr.To(egv1a1.EnvoyFilterBasicAuth),
 						},
 					},
 				}
@@ -1386,7 +1386,7 @@ func TestEnvoyProxyProvider(t *testing.T) {
 					FilterOrder: []egv1a1.FilterPosition{
 						{
 							Name:  egv1a1.EnvoyFilterRateLimit,
-							After: ptr.To(egv1a1.EnvoyFilterBasicAuthn),
+							After: ptr.To(egv1a1.EnvoyFilterBasicAuth),
 						},
 					},
 				}
diff --git a/test/e2e/tests/merge_gateways.go b/test/e2e/tests/merge_gateways.go
index 900c30548..fee4fd718 100644
--- a/test/e2e/tests/merge_gateways.go
+++ b/test/e2e/tests/merge_gateways.go
@@ -96,10 +96,11 @@ var MergeGatewaysTest = suite.ConformanceTest{
 			})
 		})
 
-		t.Run("apply a gateway with conflicted listener", func(t *testing.T) {
+		t.Run("apply a gateway with conflicted listener and a httproute", func(t *testing.T) {
 			// Manually create the conflicted Gateway and HTTPRoute resources,
 			// in order to make sure the conflicted status will certainly surface for them.
 
+			// Create Gateway first to make sure there's no HTTPRoute attach to it.
 			conflictedGateway := gwapiv1.Gateway{
 				TypeMeta: metav1.TypeMeta{
 					Kind:       gatewayapi.KindGateway,
@@ -126,6 +127,32 @@ var MergeGatewaysTest = suite.ConformanceTest{
 				},
 			}
 
+			if err := suite.Client.Create(ctx, &conflictedGateway); err != nil {
+				t.Errorf("failed to create conflicted gateway: %v", err)
+			}
+
+			conflictedListenerStatus := []gwapiv1.ListenerStatus{{
+				Name: gwapiv1.SectionName("http3"),
+				SupportedKinds: []gwapiv1.RouteGroupKind{
+					{
+						Group: gatewayapi.GroupPtr(gwapiv1.GroupName),
+						Kind:  gatewayapi.KindHTTPRoute,
+					},
+					{
+						Group: gatewayapi.GroupPtr(gwapiv1.GroupName),
+						Kind:  gatewayapi.KindGRPCRoute,
+					},
+				},
+				Conditions: []metav1.Condition{{
+					Type:   string(gwapiv1.ListenerConditionConflicted),
+					Status: metav1.ConditionTrue,
+					Reason: string(gwapiv1.ListenerReasonHostnameConflict),
+				}},
+				AttachedRoutes: 0,
+			}}
+			kubernetes.GatewayStatusMustHaveListeners(t, suite.Client, suite.TimeoutConfig, gw4NN, conflictedListenerStatus)
+
+			// Create HTTPRoute at last to make sure it will be referenced by the conflicted listener in Gateway.
 			conflictedHTTPRoute := gwapiv1.HTTPRoute{
 				TypeMeta: metav1.TypeMeta{
 					Kind:       gatewayapi.KindHTTPRoute,
@@ -174,15 +201,20 @@ var MergeGatewaysTest = suite.ConformanceTest{
 				},
 			}
 
-			if err := suite.Client.Create(ctx, &conflictedGateway); err != nil {
-				t.Errorf("failed to create conflicted gateway: %v", err)
-				t.FailNow()
-			}
-
 			if err := suite.Client.Create(ctx, &conflictedHTTPRoute); err != nil {
 				t.Errorf("failed to create conflicted httproute: %v", err)
 				t.FailNow()
 			}
+
+			conflictedListenerStatus[0].AttachedRoutes = 1
+			kubernetes.GatewayStatusMustHaveListeners(t, suite.Client, suite.TimeoutConfig, gw4NN, conflictedListenerStatus)
+
+			expectedHTTPRouteCondition := metav1.Condition{
+				Type:   string(gwapiv1.RouteConditionAccepted),
+				Status: metav1.ConditionFalse,
+				Reason: "NoReadyListeners",
+			}
+			kubernetes.HTTPRouteMustHaveCondition(t, suite.Client, suite.TimeoutConfig, route4NN, gw4NN, expectedHTTPRouteCondition)
 		})
 
 		t.Run("gateway with conflicted listener cannot be merged", func(t *testing.T) {
@@ -204,34 +236,6 @@ var MergeGatewaysTest = suite.ConformanceTest{
 				t.FailNow()
 			}
 
-			conflictedListener := []gwapiv1.ListenerStatus{{
-				Name: gwapiv1.SectionName("http3"),
-				SupportedKinds: []gwapiv1.RouteGroupKind{
-					{
-						Group: gatewayapi.GroupPtr(gwapiv1.GroupName),
-						Kind:  gatewayapi.KindHTTPRoute,
-					},
-					{
-						Group: gatewayapi.GroupPtr(gwapiv1.GroupName),
-						Kind:  gatewayapi.KindGRPCRoute,
-					},
-				},
-				Conditions: []metav1.Condition{{
-					Type:   string(gwapiv1.ListenerConditionConflicted),
-					Status: metav1.ConditionTrue,
-					Reason: string(gwapiv1.ListenerReasonHostnameConflict),
-				}},
-				AttachedRoutes: 1,
-			}}
-			kubernetes.GatewayStatusMustHaveListeners(t, suite.Client, suite.TimeoutConfig, gw4NN, conflictedListener)
-
-			expectedHTTPRouteCondition := metav1.Condition{
-				Type:   string(gwapiv1.RouteConditionAccepted),
-				Status: metav1.ConditionFalse,
-				Reason: "NoReadyListeners",
-			}
-			kubernetes.HTTPRouteMustHaveCondition(t, suite.Client, suite.TimeoutConfig, route4NN, gw4NN, expectedHTTPRouteCondition)
-
 			// Not merged gateway should not receive any traffic.
 			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gw4HostPort, http.ExpectedResponse{
 				Request:   http.Request{Path: "/merge4", Host: "www.example4.com"},
@@ -242,6 +246,9 @@ var MergeGatewaysTest = suite.ConformanceTest{
 
 		// Clean-up the conflicted gateway and route resources.
 		t.Cleanup(func() {
+			// Collect and dump every config before removing the created resource.
+			CollectAndDump(t, suite.RestConfig)
+
 			conflictedGateway := new(gwapiv1.Gateway)
 			conflictedHTTPRoute := new(gwapiv1.HTTPRoute)