Repository: envoyproxy/gateway
Pull request #4128 (2024-08-31 03:03:28)

API: use BackendCluster to represent OIDCProvider
Using BackendCluster to represent OIDCProvider allows user to customize backend connection settings for OIDC providers, such as retry policy and  tls setting.

Related: https://github.com/envoyproxy/gateway/issues/3178


codecov[bot]: ## [Codecov](https://app.codecov.io/gh/envoyproxy/gateway/pull/4128?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 67.93%. Comparing base [(`2314729`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/2314729b0e4b71154866f99c579203362bee32ca?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) to head [(`b1e7428`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/b1e7428d41ea5eec3e35d0e7ed92ae2bc71e955f?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #4128      +/-   ##
==========================================
- Coverage   67.93%   67.93%   -0.01%     
==========================================
  Files         187      187              
  Lines       23018    23024       +6     
==========================================
+ Hits        15638    15642       +4     
- Misses       6265     6266       +1     
- Partials     1115     1116       +1     
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/envoyproxy/gateway/pull/4128?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

coro: @zhaohuabing Thanks for this PR! I'm struggling to build an image of the core proxy with your [configuration PR](https://github.com/envoyproxy/envoy/pull/35262) in to test with this PR in our system - would it be possible to produce a new distroless-dev image of Envoy so we can try this?
zhaohuabing: Hi @coro You can test it after this PR has been merged.
coro: @zhaohuabing I don't think there's been a dev build for 6 days, so that won't have your PR from 4 days ago unless I'm misunderstanding how it's built: https://hub.docker.com/layers/envoyproxy/envoy/distroless-dev/images/sha256-239f7d78c7377bc668574c3be860397e640d7cff3e0b038ced64b1bb15c2b104?context=explore
zhaohuabing: > https://hub.docker.com/layers/envoyproxy/envoy/distroless-dev/images/sha256-239f7d78c7377bc668574c3be860397e640d7cff3e0b038ced64b1bb15c2b104?context=explore

Oh, I see. If you want to test now, you could probably build an envoy binary from the source:

```
ENVOY_DOCKER_BUILD_DIR=~/build ./ci/run_envoy_docker.sh './ci/do_ci.sh dev' 
```

and then build an image with a Dockerfile like this:

```
From envoyproxy/envoy:dev
COPY envoy /usr/local/bin/envoy
```

```
cp ~/build/envoy/x64/source/exe/envoy/envoy ./ 
docker build ./ -t docker.io/envoyproxy/envoy:test 
```

zirain: envoy post jobs was broken, seems got fixed by https://github.com/envoyproxy/envoy/pull/35949, maybe need wait for a while.
phlax: > I don't think there's been a dev build for 6 days

just read this and realized - our docker image building is broken 8(

ill work on a fix presently
phlax: > ... seems got fixed by ...

that PR was an unrelated docs fix
zhaohuabing: Discussed this with @arkodg this morning, it's better to put RetryPolicy into the ClusterSettings and use BackendRef to model the Auth server. In this way, the RetryPolicy can also be reused by jwt and other features.
phlax: FYI: Envoy Docker publishing is fixed

Patch:
diff --git a/.github/markdown_lint_config.json b/.github/markdown_lint_config.json
index 85aaabec0..8c62b98bf 100644
--- a/.github/markdown_lint_config.json
+++ b/.github/markdown_lint_config.json
@@ -49,5 +49,7 @@
   "MD048": false,
   "MD049": false,
   "MD050": false,
-  "MD051": false
+  "MD051": false,
+  "MD055": false,
+  "MD056": false
 }
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 750460e86..dc5833b00 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -13,6 +13,9 @@ on:
   schedule:
   - cron: '44 15 * * 5'
 
+permissions:
+  contents: read
+
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
diff --git a/api/v1alpha1/backendtrafficpolicy_types.go b/api/v1alpha1/backendtrafficpolicy_types.go
index 9d15ccd68..70a400015 100644
--- a/api/v1alpha1/backendtrafficpolicy_types.go
+++ b/api/v1alpha1/backendtrafficpolicy_types.go
@@ -57,11 +57,6 @@ type BackendTrafficPolicySpec struct {
 	// +optional
 	FaultInjection *FaultInjection `json:"faultInjection,omitempty"`
 
-	// Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
-	// If not set, retry will be disabled.
-	// +optional
-	Retry *Retry `json:"retry,omitempty"`
-
 	// UseClientProtocol configures Envoy to prefer sending requests to backends using
 	// the same HTTP protocol that the incoming request used. Defaults to false, which means
 	// that Envoy will use the protocol indicated by the attached BackendRef.
@@ -85,56 +80,6 @@ type BackendTrafficPolicyList struct {
 	Items           []BackendTrafficPolicy `json:"items"`
 }
 
-// ClusterSettings provides the various knobs that can be set to control how traffic to a given
-// backend will be configured.
-type ClusterSettings struct {
-	// LoadBalancer policy to apply when routing traffic from the gateway to
-	// the backend endpoints. Defaults to `LeastRequest`.
-	// +optional
-	LoadBalancer *LoadBalancer `json:"loadBalancer,omitempty"`
-
-	// ProxyProtocol enables the Proxy Protocol when communicating with the backend.
-	// +optional
-	ProxyProtocol *ProxyProtocol `json:"proxyProtocol,omitempty"`
-
-	// TcpKeepalive settings associated with the upstream client connection.
-	// Disabled by default.
-	//
-	// +optional
-	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty"`
-
-	// HealthCheck allows gateway to perform active health checking on backends.
-	//
-	// +optional
-	HealthCheck *HealthCheck `json:"healthCheck,omitempty"`
-
-	// Circuit Breaker settings for the upstream connections and requests.
-	// If not set, circuit breakers will be enabled with the default thresholds
-	//
-	// +optional
-	CircuitBreaker *CircuitBreaker `json:"circuitBreaker,omitempty"`
-
-	// Timeout settings for the backend connections.
-	//
-	// +optional
-	Timeout *Timeout `json:"timeout,omitempty"`
-
-	// Connection includes backend connection settings.
-	//
-	// +optional
-	Connection *BackendConnection `json:"connection,omitempty"`
-
-	// DNS includes dns resolution settings.
-	//
-	// +optional
-	DNS *DNS `json:"dns,omitempty"`
-
-	// HTTP2 provides HTTP/2 configuration for backend connections.
-	//
-	// +optional
-	HTTP2 *HTTP2Settings `json:"http2,omitempty"`
-}
-
 func init() {
 	SchemeBuilder.Register(&BackendTrafficPolicy{}, &BackendTrafficPolicyList{})
 }
diff --git a/api/v1alpha1/ext_auth_types.go b/api/v1alpha1/ext_auth_types.go
index 2d49a9df3..0670ed4b6 100644
--- a/api/v1alpha1/ext_auth_types.go
+++ b/api/v1alpha1/ext_auth_types.go
@@ -42,6 +42,14 @@ type ExtAuth struct {
 	// +optional
 	// +kubebuilder:default=false
 	FailOpen *bool `json:"failOpen,omitempty"`
+
+	// RecomputeRoute clears the route cache and recalculates the routing decision.
+	// This field must be enabled if the headers added or modified by the ExtAuth are used for
+	// route matching decisions. If the recomputation selects a new route, features targeting
+	// the new matched route will be applied.
+	//
+	// +optional
+	RecomputeRoute *bool `json:"recomputeRoute,omitempty"`
 }
 
 // GRPCExtAuthService defines the gRPC External Authorization service
diff --git a/api/v1alpha1/oidc_types.go b/api/v1alpha1/oidc_types.go
index 8951fbe63..73e1dea8c 100644
--- a/api/v1alpha1/oidc_types.go
+++ b/api/v1alpha1/oidc_types.go
@@ -106,7 +106,21 @@ type OIDC struct {
 }
 
 // OIDCProvider defines the OIDC Provider configuration.
+// +kubebuilder:validation:XValidation:rule="!has(self.backendRef)",message="BackendRefs must be used, backendRef is not supported."
+// +kubebuilder:validation:XValidation:rule="has(self.backendRefs)? self.backendRefs.size() > 1 : true",message="Only one backendRefs is allowed."
 type OIDCProvider struct {
+	// BackendRefs is used to specify the address of the OIDC Provider.
+	// If the BackendRefs is not specified, The host and port of the OIDC Provider's token endpoint
+	// will be used as the address of the OIDC Provider.
+	//
+	// TLS configuration can be specified in a BackendTLSConfig resource and target the BackendRefs.
+	//
+	// Other settings for the connection to the OIDC Provider can be specified in the BackendSettings resource.
+	//
+	// +optional
+	// +notImplementedHide
+	BackendCluster `json:",inline"`
+
 	// The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).
 	// Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST
 	// be https, a host component, and optionally, port and path components and
diff --git a/api/v1alpha1/shared_types.go b/api/v1alpha1/shared_types.go
index adfddff13..c74504a61 100644
--- a/api/v1alpha1/shared_types.go
+++ b/api/v1alpha1/shared_types.go
@@ -511,6 +511,61 @@ type BackendCluster struct {
 	BackendSettings *ClusterSettings `json:"backendSettings,omitempty"`
 }
 
+// ClusterSettings provides the various knobs that can be set to control how traffic to a given
+// backend will be configured.
+type ClusterSettings struct {
+	// LoadBalancer policy to apply when routing traffic from the gateway to
+	// the backend endpoints. Defaults to `LeastRequest`.
+	// +optional
+	LoadBalancer *LoadBalancer `json:"loadBalancer,omitempty"`
+
+	// Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+	// If not set, retry will be disabled.
+	// +optional
+	Retry *Retry `json:"retry,omitempty"`
+
+	// ProxyProtocol enables the Proxy Protocol when communicating with the backend.
+	// +optional
+	ProxyProtocol *ProxyProtocol `json:"proxyProtocol,omitempty"`
+
+	// TcpKeepalive settings associated with the upstream client connection.
+	// Disabled by default.
+	//
+	// +optional
+	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty"`
+
+	// HealthCheck allows gateway to perform active health checking on backends.
+	//
+	// +optional
+	HealthCheck *HealthCheck `json:"healthCheck,omitempty"`
+
+	// Circuit Breaker settings for the upstream connections and requests.
+	// If not set, circuit breakers will be enabled with the default thresholds
+	//
+	// +optional
+	CircuitBreaker *CircuitBreaker `json:"circuitBreaker,omitempty"`
+
+	// Timeout settings for the backend connections.
+	//
+	// +optional
+	Timeout *Timeout `json:"timeout,omitempty"`
+
+	// Connection includes backend connection settings.
+	//
+	// +optional
+	Connection *BackendConnection `json:"connection,omitempty"`
+
+	// DNS includes dns resolution settings.
+	//
+	// +optional
+	DNS *DNS `json:"dns,omitempty"`
+
+	// HTTP2 provides HTTP/2 configuration for backend connections.
+	//
+	// +optional
+	HTTP2 *HTTP2Settings `json:"http2,omitempty"`
+}
+
 // CIDR defines a CIDR Address range.
 // A CIDR can be an IPv4 address range such as "192.168.1.0/24" or an IPv6 address range such as "2001:0db8:11a3:09d7::/64".
 // +kubebuilder:validation:Pattern=`((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/([0-9]+))|((([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/([0-9]+))`
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index cde4e3b90..56b3332f2 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -540,11 +540,6 @@ func (in *BackendTrafficPolicySpec) DeepCopyInto(out *BackendTrafficPolicySpec)
 		*out = new(FaultInjection)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.Retry != nil {
-		in, out := &in.Retry, &out.Retry
-		*out = new(Retry)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.UseClientProtocol != nil {
 		in, out := &in.UseClientProtocol, &out.UseClientProtocol
 		*out = new(bool)
@@ -955,6 +950,11 @@ func (in *ClusterSettings) DeepCopyInto(out *ClusterSettings) {
 		*out = new(LoadBalancer)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Retry != nil {
+		in, out := &in.Retry, &out.Retry
+		*out = new(Retry)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.ProxyProtocol != nil {
 		in, out := &in.ProxyProtocol, &out.ProxyProtocol
 		*out = new(ProxyProtocol)
@@ -2022,6 +2022,11 @@ func (in *ExtAuth) DeepCopyInto(out *ExtAuth) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.RecomputeRoute != nil {
+		in, out := &in.RecomputeRoute, &out.RecomputeRoute
+		*out = new(bool)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtAuth.
@@ -3608,6 +3613,7 @@ func (in *OIDCCookieNames) DeepCopy() *OIDCCookieNames {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCProvider) DeepCopyInto(out *OIDCProvider) {
 	*out = *in
+	in.BackendCluster.DeepCopyInto(&out.BackendCluster)
 	if in.AuthorizationEndpoint != nil {
 		in, out := &in.AuthorizationEndpoint, &out.AuthorizationEndpoint
 		*out = new(string)
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 92a538cf4..867b8933c 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -753,6 +753,86 @@ spec:
                           required:
                           - version
                           type: object
+                        retry:
+                          description: |-
+                            Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                            If not set, retry will be disabled.
+                          properties:
+                            numRetries:
+                              default: 2
+                              description: NumRetries is the number of retries to
+                                be attempted. Defaults to 2.
+                              format: int32
+                              minimum: 0
+                              type: integer
+                            perRetry:
+                              description: PerRetry is the retry policy to be applied
+                                per retry attempt.
+                              properties:
+                                backOff:
+                                  description: |-
+                                    Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                    back-off algorithm for retries. For additional details,
+                                    see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                  properties:
+                                    baseInterval:
+                                      description: BaseInterval is the base interval
+                                        between retries.
+                                      format: duration
+                                      type: string
+                                    maxInterval:
+                                      description: |-
+                                        MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                        The default is 10 times the base_interval
+                                      format: duration
+                                      type: string
+                                  type: object
+                                timeout:
+                                  description: Timeout is the timeout per retry attempt.
+                                  format: duration
+                                  type: string
+                              type: object
+                            retryOn:
+                              description: |-
+                                RetryOn specifies the retry trigger condition.
+
+                                If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                              properties:
+                                httpStatusCodes:
+                                  description: |-
+                                    HttpStatusCodes specifies the http status codes to be retried.
+                                    The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                  items:
+                                    description: HTTPStatus defines the http status
+                                      code.
+                                    exclusiveMaximum: true
+                                    maximum: 600
+                                    minimum: 100
+                                    type: integer
+                                  type: array
+                                triggers:
+                                  description: Triggers specifies the retry trigger
+                                    condition(Http/Grpc).
+                                  items:
+                                    description: TriggerEnum specifies the conditions
+                                      that trigger retries.
+                                    enum:
+                                    - 5xx
+                                    - gateway-error
+                                    - reset
+                                    - connect-failure
+                                    - retriable-4xx
+                                    - refused-stream
+                                    - retriable-status-codes
+                                    - cancelled
+                                    - deadline-exceeded
+                                    - internal
+                                    - resource-exhausted
+                                    - unavailable
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
                         tcpKeepalive:
                           description: |-
                             TcpKeepalive settings associated with the upstream client connection.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 6baf2056e..c227b546c 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -11076,6 +11076,90 @@ spec:
                                             required:
                                             - version
                                             type: object
+                                          retry:
+                                            description: |-
+                                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                                              If not set, retry will be disabled.
+                                            properties:
+                                              numRetries:
+                                                default: 2
+                                                description: NumRetries is the number
+                                                  of retries to be attempted. Defaults
+                                                  to 2.
+                                                format: int32
+                                                minimum: 0
+                                                type: integer
+                                              perRetry:
+                                                description: PerRetry is the retry
+                                                  policy to be applied per retry attempt.
+                                                properties:
+                                                  backOff:
+                                                    description: |-
+                                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                                      back-off algorithm for retries. For additional details,
+                                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                                    properties:
+                                                      baseInterval:
+                                                        description: BaseInterval
+                                                          is the base interval between
+                                                          retries.
+                                                        format: duration
+                                                        type: string
+                                                      maxInterval:
+                                                        description: |-
+                                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                                          The default is 10 times the base_interval
+                                                        format: duration
+                                                        type: string
+                                                    type: object
+                                                  timeout:
+                                                    description: Timeout is the timeout
+                                                      per retry attempt.
+                                                    format: duration
+                                                    type: string
+                                                type: object
+                                              retryOn:
+                                                description: |-
+                                                  RetryOn specifies the retry trigger condition.
+
+                                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                                properties:
+                                                  httpStatusCodes:
+                                                    description: |-
+                                                      HttpStatusCodes specifies the http status codes to be retried.
+                                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                                    items:
+                                                      description: HTTPStatus defines
+                                                        the http status code.
+                                                      exclusiveMaximum: true
+                                                      maximum: 600
+                                                      minimum: 100
+                                                      type: integer
+                                                    type: array
+                                                  triggers:
+                                                    description: Triggers specifies
+                                                      the retry trigger condition(Http/Grpc).
+                                                    items:
+                                                      description: TriggerEnum specifies
+                                                        the conditions that trigger
+                                                        retries.
+                                                      enum:
+                                                      - 5xx
+                                                      - gateway-error
+                                                      - reset
+                                                      - connect-failure
+                                                      - retriable-4xx
+                                                      - refused-stream
+                                                      - retriable-status-codes
+                                                      - cancelled
+                                                      - deadline-exceeded
+                                                      - internal
+                                                      - resource-exhausted
+                                                      - unavailable
+                                                      type: string
+                                                    type: array
+                                                type: object
+                                            type: object
                                           tcpKeepalive:
                                             description: |-
                                               TcpKeepalive settings associated with the upstream client connection.
@@ -11962,6 +12046,90 @@ spec:
                                             required:
                                             - version
                                             type: object
+                                          retry:
+                                            description: |-
+                                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                                              If not set, retry will be disabled.
+                                            properties:
+                                              numRetries:
+                                                default: 2
+                                                description: NumRetries is the number
+                                                  of retries to be attempted. Defaults
+                                                  to 2.
+                                                format: int32
+                                                minimum: 0
+                                                type: integer
+                                              perRetry:
+                                                description: PerRetry is the retry
+                                                  policy to be applied per retry attempt.
+                                                properties:
+                                                  backOff:
+                                                    description: |-
+                                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                                      back-off algorithm for retries. For additional details,
+                                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                                    properties:
+                                                      baseInterval:
+                                                        description: BaseInterval
+                                                          is the base interval between
+                                                          retries.
+                                                        format: duration
+                                                        type: string
+                                                      maxInterval:
+                                                        description: |-
+                                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                                          The default is 10 times the base_interval
+                                                        format: duration
+                                                        type: string
+                                                    type: object
+                                                  timeout:
+                                                    description: Timeout is the timeout
+                                                      per retry attempt.
+                                                    format: duration
+                                                    type: string
+                                                type: object
+                                              retryOn:
+                                                description: |-
+                                                  RetryOn specifies the retry trigger condition.
+
+                                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                                properties:
+                                                  httpStatusCodes:
+                                                    description: |-
+                                                      HttpStatusCodes specifies the http status codes to be retried.
+                                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                                    items:
+                                                      description: HTTPStatus defines
+                                                        the http status code.
+                                                      exclusiveMaximum: true
+                                                      maximum: 600
+                                                      minimum: 100
+                                                      type: integer
+                                                    type: array
+                                                  triggers:
+                                                    description: Triggers specifies
+                                                      the retry trigger condition(Http/Grpc).
+                                                    items:
+                                                      description: TriggerEnum specifies
+                                                        the conditions that trigger
+                                                        retries.
+                                                      enum:
+                                                      - 5xx
+                                                      - gateway-error
+                                                      - reset
+                                                      - connect-failure
+                                                      - retriable-4xx
+                                                      - refused-stream
+                                                      - retriable-status-codes
+                                                      - cancelled
+                                                      - deadline-exceeded
+                                                      - internal
+                                                      - resource-exhausted
+                                                      - unavailable
+                                                      type: string
+                                                    type: array
+                                                type: object
+                                            type: object
                                           tcpKeepalive:
                                             description: |-
                                               TcpKeepalive settings associated with the upstream client connection.
@@ -12896,6 +13064,87 @@ spec:
                                       required:
                                       - version
                                       type: object
+                                    retry:
+                                      description: |-
+                                        Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                                        If not set, retry will be disabled.
+                                      properties:
+                                        numRetries:
+                                          default: 2
+                                          description: NumRetries is the number of
+                                            retries to be attempted. Defaults to 2.
+                                          format: int32
+                                          minimum: 0
+                                          type: integer
+                                        perRetry:
+                                          description: PerRetry is the retry policy
+                                            to be applied per retry attempt.
+                                          properties:
+                                            backOff:
+                                              description: |-
+                                                Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                                back-off algorithm for retries. For additional details,
+                                                see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                              properties:
+                                                baseInterval:
+                                                  description: BaseInterval is the
+                                                    base interval between retries.
+                                                  format: duration
+                                                  type: string
+                                                maxInterval:
+                                                  description: |-
+                                                    MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                                    The default is 10 times the base_interval
+                                                  format: duration
+                                                  type: string
+                                              type: object
+                                            timeout:
+                                              description: Timeout is the timeout
+                                                per retry attempt.
+                                              format: duration
+                                              type: string
+                                          type: object
+                                        retryOn:
+                                          description: |-
+                                            RetryOn specifies the retry trigger condition.
+
+                                            If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                          properties:
+                                            httpStatusCodes:
+                                              description: |-
+                                                HttpStatusCodes specifies the http status codes to be retried.
+                                                The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                              items:
+                                                description: HTTPStatus defines the
+                                                  http status code.
+                                                exclusiveMaximum: true
+                                                maximum: 600
+                                                minimum: 100
+                                                type: integer
+                                              type: array
+                                            triggers:
+                                              description: Triggers specifies the
+                                                retry trigger condition(Http/Grpc).
+                                              items:
+                                                description: TriggerEnum specifies
+                                                  the conditions that trigger retries.
+                                                enum:
+                                                - 5xx
+                                                - gateway-error
+                                                - reset
+                                                - connect-failure
+                                                - retriable-4xx
+                                                - refused-stream
+                                                - retriable-status-codes
+                                                - cancelled
+                                                - deadline-exceeded
+                                                - internal
+                                                - resource-exhausted
+                                                - unavailable
+                                                type: string
+                                              type: array
+                                          type: object
+                                      type: object
                                     tcpKeepalive:
                                       description: |-
                                         TcpKeepalive settings associated with the upstream client connection.
@@ -13791,6 +14040,87 @@ spec:
                                 required:
                                 - version
                                 type: object
+                              retry:
+                                description: |-
+                                  Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                                  If not set, retry will be disabled.
+                                properties:
+                                  numRetries:
+                                    default: 2
+                                    description: NumRetries is the number of retries
+                                      to be attempted. Defaults to 2.
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                  perRetry:
+                                    description: PerRetry is the retry policy to be
+                                      applied per retry attempt.
+                                    properties:
+                                      backOff:
+                                        description: |-
+                                          Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                          back-off algorithm for retries. For additional details,
+                                          see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                        properties:
+                                          baseInterval:
+                                            description: BaseInterval is the base
+                                              interval between retries.
+                                            format: duration
+                                            type: string
+                                          maxInterval:
+                                            description: |-
+                                              MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                              The default is 10 times the base_interval
+                                            format: duration
+                                            type: string
+                                        type: object
+                                      timeout:
+                                        description: Timeout is the timeout per retry
+                                          attempt.
+                                        format: duration
+                                        type: string
+                                    type: object
+                                  retryOn:
+                                    description: |-
+                                      RetryOn specifies the retry trigger condition.
+
+                                      If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                    properties:
+                                      httpStatusCodes:
+                                        description: |-
+                                          HttpStatusCodes specifies the http status codes to be retried.
+                                          The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                        items:
+                                          description: HTTPStatus defines the http
+                                            status code.
+                                          exclusiveMaximum: true
+                                          maximum: 600
+                                          minimum: 100
+                                          type: integer
+                                        type: array
+                                      triggers:
+                                        description: Triggers specifies the retry
+                                          trigger condition(Http/Grpc).
+                                        items:
+                                          description: TriggerEnum specifies the conditions
+                                            that trigger retries.
+                                          enum:
+                                          - 5xx
+                                          - gateway-error
+                                          - reset
+                                          - connect-failure
+                                          - retriable-4xx
+                                          - refused-stream
+                                          - retriable-status-codes
+                                          - cancelled
+                                          - deadline-exceeded
+                                          - internal
+                                          - resource-exhausted
+                                          - unavailable
+                                          type: string
+                                        type: array
+                                    type: object
+                                type: object
                               tcpKeepalive:
                                 description: |-
                                   TcpKeepalive settings associated with the upstream client connection.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index f0fc4379a..f2c08a230 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -1024,6 +1024,87 @@ spec:
                             required:
                             - version
                             type: object
+                          retry:
+                            description: |-
+                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                              If not set, retry will be disabled.
+                            properties:
+                              numRetries:
+                                default: 2
+                                description: NumRetries is the number of retries to
+                                  be attempted. Defaults to 2.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                              perRetry:
+                                description: PerRetry is the retry policy to be applied
+                                  per retry attempt.
+                                properties:
+                                  backOff:
+                                    description: |-
+                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                      back-off algorithm for retries. For additional details,
+                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                    properties:
+                                      baseInterval:
+                                        description: BaseInterval is the base interval
+                                          between retries.
+                                        format: duration
+                                        type: string
+                                      maxInterval:
+                                        description: |-
+                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                          The default is 10 times the base_interval
+                                        format: duration
+                                        type: string
+                                    type: object
+                                  timeout:
+                                    description: Timeout is the timeout per retry
+                                      attempt.
+                                    format: duration
+                                    type: string
+                                type: object
+                              retryOn:
+                                description: |-
+                                  RetryOn specifies the retry trigger condition.
+
+                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                properties:
+                                  httpStatusCodes:
+                                    description: |-
+                                      HttpStatusCodes specifies the http status codes to be retried.
+                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                    items:
+                                      description: HTTPStatus defines the http status
+                                        code.
+                                      exclusiveMaximum: true
+                                      maximum: 600
+                                      minimum: 100
+                                      type: integer
+                                    type: array
+                                  triggers:
+                                    description: Triggers specifies the retry trigger
+                                      condition(Http/Grpc).
+                                    items:
+                                      description: TriggerEnum specifies the conditions
+                                        that trigger retries.
+                                      enum:
+                                      - 5xx
+                                      - gateway-error
+                                      - reset
+                                      - connect-failure
+                                      - retriable-4xx
+                                      - refused-stream
+                                      - retriable-status-codes
+                                      - cancelled
+                                      - deadline-exceeded
+                                      - internal
+                                      - resource-exhausted
+                                      - unavailable
+                                      type: string
+                                    type: array
+                                type: object
+                            type: object
                           tcpKeepalive:
                             description: |-
                               TcpKeepalive settings associated with the upstream client connection.
@@ -1821,6 +1902,87 @@ spec:
                             required:
                             - version
                             type: object
+                          retry:
+                            description: |-
+                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                              If not set, retry will be disabled.
+                            properties:
+                              numRetries:
+                                default: 2
+                                description: NumRetries is the number of retries to
+                                  be attempted. Defaults to 2.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                              perRetry:
+                                description: PerRetry is the retry policy to be applied
+                                  per retry attempt.
+                                properties:
+                                  backOff:
+                                    description: |-
+                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                      back-off algorithm for retries. For additional details,
+                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                    properties:
+                                      baseInterval:
+                                        description: BaseInterval is the base interval
+                                          between retries.
+                                        format: duration
+                                        type: string
+                                      maxInterval:
+                                        description: |-
+                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                          The default is 10 times the base_interval
+                                        format: duration
+                                        type: string
+                                    type: object
+                                  timeout:
+                                    description: Timeout is the timeout per retry
+                                      attempt.
+                                    format: duration
+                                    type: string
+                                type: object
+                              retryOn:
+                                description: |-
+                                  RetryOn specifies the retry trigger condition.
+
+                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                properties:
+                                  httpStatusCodes:
+                                    description: |-
+                                      HttpStatusCodes specifies the http status codes to be retried.
+                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                    items:
+                                      description: HTTPStatus defines the http status
+                                        code.
+                                      exclusiveMaximum: true
+                                      maximum: 600
+                                      minimum: 100
+                                      type: integer
+                                    type: array
+                                  triggers:
+                                    description: Triggers specifies the retry trigger
+                                      condition(Http/Grpc).
+                                    items:
+                                      description: TriggerEnum specifies the conditions
+                                        that trigger retries.
+                                      enum:
+                                      - 5xx
+                                      - gateway-error
+                                      - reset
+                                      - connect-failure
+                                      - retriable-4xx
+                                      - refused-stream
+                                      - retriable-status-codes
+                                      - cancelled
+                                      - deadline-exceeded
+                                      - internal
+                                      - resource-exhausted
+                                      - unavailable
+                                      type: string
+                                    type: array
+                                type: object
+                            type: object
                           tcpKeepalive:
                             description: |-
                               TcpKeepalive settings associated with the upstream client connection.
@@ -1908,6 +2070,13 @@ spec:
                         group.
                       rule: 'has(self.backendRefs) ? (self.backendRefs.all(f, f.group
                         == "" || f.group == ''gateway.envoyproxy.io'')) : true'
+                  recomputeRoute:
+                    description: |-
+                      RecomputeRoute clears the route cache and recalculates the routing decision.
+                      This field must be enabled if the headers added or modified by the ExtAuth are used for
+                      route matching decisions. If the recomputation selects a new route, features targeting
+                      the new matched route will be applied.
+                    type: boolean
                 type: object
                 x-kubernetes-validations:
                 - message: one of grpc or http must be specified
@@ -2182,22 +2351,872 @@ spec:
                           The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).
                           If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
                         type: string
-                      issuer:
+                      backendRef:
                         description: |-
-                          The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).
-                          Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST
-                          be https, a host component, and optionally, port and path components and
-                          no query or fragment components.
-                        minLength: 1
-                        type: string
-                      tokenEndpoint:
+                          BackendRef references a Kubernetes object that represents the
+                          backend server to which the authorization request will be sent.
+
+                          Deprecated: Use BackendRefs instead.
+                        properties:
+                          group:
+                            default: ""
+                            description: |-
+                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                              When unspecified or empty string, core API group is inferred.
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Service
+                            description: |-
+                              Kind is the Kubernetes resource kind of the referent. For example
+                              "Service".
+
+                              Defaults to "Service" when not specified.
+
+                              ExternalName services can refer to CNAME DNS records that may live
+                              outside of the cluster and as such are difficult to reason about in
+                              terms of conformance. They also may not be safe to forward to (see
+                              CVE-2021-25740 for more information). Implementations SHOULD NOT
+                              support ExternalName Services.
+
+                              Support: Core (Services with a type other than ExternalName)
+
+                              Support: Implementation-specific (Services with type ExternalName)
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: Name is the name of the referent.
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
+                            description: |-
+                              Namespace is the namespace of the backend. When unspecified, the local
+                              namespace is inferred.
+
+                              Note that when a namespace different than the local namespace is specified,
+                              a ReferenceGrant object is required in the referent namespace to allow that
+                              namespace's owner to accept the reference. See the ReferenceGrant
+                              documentation for details.
+
+                              Support: Core
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                            type: string
+                          port:
+                            description: |-
+                              Port specifies the destination port number to use for this resource.
+                              Port is required when the referent is a Kubernetes Service. In this
+                              case, the port number is the service port number, not the target port.
+                              For other resources, destination port might be derived from the referent
+                              resource or this field.
+                            format: int32
+                            maximum: 65535
+                            minimum: 1
+                            type: integer
+                        required:
+                        - name
+                        type: object
+                        x-kubernetes-validations:
+                        - message: Must have port for Service reference
+                          rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                            ? has(self.port) : true'
+                      backendRefs:
                         description: |-
-                          The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
-                          If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
-                        type: string
-                    required:
-                    - issuer
-                    type: object
+                          BackendRefs references a Kubernetes object that represents the
+                          backend server to which the authorization request will be sent.
+                        items:
+                          description: BackendRef defines how an ObjectReference that
+                            is specific to BackendRef.
+                          properties:
+                            fallback:
+                              description: |-
+                                Fallback indicates whether the backend is designated as a fallback.
+                                Multiple fallback backends can be configured.
+                                It is highly recommended to configure active or passive health checks to ensure that failover can be detected
+                                when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again.
+                                The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
+                                the health of the active backends falls below 72%.
+                              type: boolean
+                            group:
+                              default: ""
+                              description: |-
+                                Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                When unspecified or empty string, core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              default: Service
+                              description: |-
+                                Kind is the Kubernetes resource kind of the referent. For example
+                                "Service".
+
+                                Defaults to "Service" when not specified.
+
+                                ExternalName services can refer to CNAME DNS records that may live
+                                outside of the cluster and as such are difficult to reason about in
+                                terms of conformance. They also may not be safe to forward to (see
+                                CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                support ExternalName Services.
+
+                                Support: Core (Services with a type other than ExternalName)
+
+                                Support: Implementation-specific (Services with type ExternalName)
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            namespace:
+                              description: |-
+                                Namespace is the namespace of the backend. When unspecified, the local
+                                namespace is inferred.
+
+                                Note that when a namespace different than the local namespace is specified,
+                                a ReferenceGrant object is required in the referent namespace to allow that
+                                namespace's owner to accept the reference. See the ReferenceGrant
+                                documentation for details.
+
+                                Support: Core
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                            port:
+                              description: |-
+                                Port specifies the destination port number to use for this resource.
+                                Port is required when the referent is a Kubernetes Service. In this
+                                case, the port number is the service port number, not the target port.
+                                For other resources, destination port might be derived from the referent
+                                resource or this field.
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                          required:
+                          - name
+                          type: object
+                          x-kubernetes-validations:
+                          - message: Must have port for Service reference
+                            rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                              ? has(self.port) : true'
+                        maxItems: 16
+                        type: array
+                      backendSettings:
+                        description: |-
+                          BackendSettings holds configuration for managing the connection
+                          to the backend.
+                        properties:
+                          circuitBreaker:
+                            description: |-
+                              Circuit Breaker settings for the upstream connections and requests.
+                              If not set, circuit breakers will be enabled with the default thresholds
+                            properties:
+                              maxConnections:
+                                default: 1024
+                                description: The maximum number of connections that
+                                  Envoy will establish to the referenced backend defined
+                                  within a xRoute rule.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                              maxParallelRequests:
+                                default: 1024
+                                description: The maximum number of parallel requests
+                                  that Envoy will make to the referenced backend defined
+                                  within a xRoute rule.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                              maxParallelRetries:
+                                default: 1024
+                                description: The maximum number of parallel retries
+                                  that Envoy will make to the referenced backend defined
+                                  within a xRoute rule.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                              maxPendingRequests:
+                                default: 1024
+                                description: The maximum number of pending requests
+                                  that Envoy will queue to the referenced backend
+                                  defined within a xRoute rule.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                              maxRequestsPerConnection:
+                                description: |-
+                                  The maximum number of requests that Envoy will make over a single connection to the referenced backend defined within a xRoute rule.
+                                  Default: unlimited.
+                                format: int64
+                                maximum: 4294967295
+                                minimum: 0
+                                type: integer
+                            type: object
+                          connection:
+                            description: Connection includes backend connection settings.
+                            properties:
+                              bufferLimit:
+                                allOf:
+                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  BufferLimit Soft limit on size of the cluster’s connections read and write buffers.
+                                  BufferLimit applies to connection streaming (maybe non-streaming) channel between processes, it's in user space.
+                                  If unspecified, an implementation defined default is applied (32768 bytes).
+                                  For example, 20Mi, 1Gi, 256Ki etc.
+                                  Note: that when the suffix is not provided, the value is interpreted as bytes.
+                                x-kubernetes-int-or-string: true
+                              socketBufferLimit:
+                                allOf:
+                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  SocketBufferLimit provides configuration for the maximum buffer size in bytes for each socket
+                                  to backend.
+                                  SocketBufferLimit applies to socket streaming channel between TCP/IP stacks, it's in kernel space.
+                                  For example, 20Mi, 1Gi, 256Ki etc.
+                                  Note that when the suffix is not provided, the value is interpreted as bytes.
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          dns:
+                            description: DNS includes dns resolution settings.
+                            properties:
+                              dnsRefreshRate:
+                                description: |-
+                                  DNSRefreshRate specifies the rate at which DNS records should be refreshed.
+                                  Defaults to 30 seconds.
+                                type: string
+                              respectDnsTtl:
+                                description: |-
+                                  RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.
+                                  If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.
+                                  Defaults to true.
+                                type: boolean
+                            type: object
+                          healthCheck:
+                            description: HealthCheck allows gateway to perform active
+                              health checking on backends.
+                            properties:
+                              active:
+                                description: Active health check configuration
+                                properties:
+                                  grpc:
+                                    description: |-
+                                      GRPC defines the configuration of the GRPC health checker.
+                                      It's optional, and can only be used if the specified type is GRPC.
+                                    properties:
+                                      service:
+                                        description: |-
+                                          Service to send in the health check request.
+                                          If this is not specified, then the health check request applies to the entire
+                                          server and not to a specific service.
+                                        type: string
+                                    type: object
+                                  healthyThreshold:
+                                    default: 1
+                                    description: HealthyThreshold defines the number
+                                      of healthy health checks required before a backend
+                                      host is marked healthy.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  http:
+                                    description: |-
+                                      HTTP defines the configuration of http health checker.
+                                      It's required while the health checker type is HTTP.
+                                    properties:
+                                      expectedResponse:
+                                        description: ExpectedResponse defines a list
+                                          of HTTP expected responses to match.
+                                        properties:
+                                          binary:
+                                            description: Binary payload base64 encoded.
+                                            format: byte
+                                            type: string
+                                          text:
+                                            description: Text payload in plain text.
+                                            type: string
+                                          type:
+                                            allOf:
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            description: Type defines the type of
+                                              the payload.
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                        x-kubernetes-validations:
+                                        - message: If payload type is Text, text field
+                                            needs to be set.
+                                          rule: 'self.type == ''Text'' ? has(self.text)
+                                            : !has(self.text)'
+                                        - message: If payload type is Binary, binary
+                                            field needs to be set.
+                                          rule: 'self.type == ''Binary'' ? has(self.binary)
+                                            : !has(self.binary)'
+                                      expectedStatuses:
+                                        description: |-
+                                          ExpectedStatuses defines a list of HTTP response statuses considered healthy.
+                                          Defaults to 200 only
+                                        items:
+                                          description: HTTPStatus defines the http
+                                            status code.
+                                          exclusiveMaximum: true
+                                          maximum: 600
+                                          minimum: 100
+                                          type: integer
+                                        type: array
+                                      method:
+                                        description: |-
+                                          Method defines the HTTP method used for health checking.
+                                          Defaults to GET
+                                        type: string
+                                      path:
+                                        description: Path defines the HTTP path that
+                                          will be requested during health checking.
+                                        maxLength: 1024
+                                        minLength: 1
+                                        type: string
+                                    required:
+                                    - path
+                                    type: object
+                                  interval:
+                                    default: 3s
+                                    description: Interval defines the time between
+                                      active health checks.
+                                    format: duration
+                                    type: string
+                                  tcp:
+                                    description: |-
+                                      TCP defines the configuration of tcp health checker.
+                                      It's required while the health checker type is TCP.
+                                    properties:
+                                      receive:
+                                        description: Receive defines the expected
+                                          response payload.
+                                        properties:
+                                          binary:
+                                            description: Binary payload base64 encoded.
+                                            format: byte
+                                            type: string
+                                          text:
+                                            description: Text payload in plain text.
+                                            type: string
+                                          type:
+                                            allOf:
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            description: Type defines the type of
+                                              the payload.
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                        x-kubernetes-validations:
+                                        - message: If payload type is Text, text field
+                                            needs to be set.
+                                          rule: 'self.type == ''Text'' ? has(self.text)
+                                            : !has(self.text)'
+                                        - message: If payload type is Binary, binary
+                                            field needs to be set.
+                                          rule: 'self.type == ''Binary'' ? has(self.binary)
+                                            : !has(self.binary)'
+                                      send:
+                                        description: Send defines the request payload.
+                                        properties:
+                                          binary:
+                                            description: Binary payload base64 encoded.
+                                            format: byte
+                                            type: string
+                                          text:
+                                            description: Text payload in plain text.
+                                            type: string
+                                          type:
+                                            allOf:
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            - enum:
+                                              - Text
+                                              - Binary
+                                            description: Type defines the type of
+                                              the payload.
+                                            type: string
+                                        required:
+                                        - type
+                                        type: object
+                                        x-kubernetes-validations:
+                                        - message: If payload type is Text, text field
+                                            needs to be set.
+                                          rule: 'self.type == ''Text'' ? has(self.text)
+                                            : !has(self.text)'
+                                        - message: If payload type is Binary, binary
+                                            field needs to be set.
+                                          rule: 'self.type == ''Binary'' ? has(self.binary)
+                                            : !has(self.binary)'
+                                    type: object
+                                  timeout:
+                                    default: 1s
+                                    description: Timeout defines the time to wait
+                                      for a health check response.
+                                    format: duration
+                                    type: string
+                                  type:
+                                    allOf:
+                                    - enum:
+                                      - HTTP
+                                      - TCP
+                                      - GRPC
+                                    - enum:
+                                      - HTTP
+                                      - TCP
+                                      - GRPC
+                                    description: Type defines the type of health checker.
+                                    type: string
+                                  unhealthyThreshold:
+                                    default: 3
+                                    description: UnhealthyThreshold defines the number
+                                      of unhealthy health checks required before a
+                                      backend host is marked unhealthy.
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                required:
+                                - type
+                                type: object
+                                x-kubernetes-validations:
+                                - message: If Health Checker type is HTTP, http field
+                                    needs to be set.
+                                  rule: 'self.type == ''HTTP'' ? has(self.http) :
+                                    !has(self.http)'
+                                - message: If Health Checker type is TCP, tcp field
+                                    needs to be set.
+                                  rule: 'self.type == ''TCP'' ? has(self.tcp) : !has(self.tcp)'
+                                - message: The grpc field can only be set if the Health
+                                    Checker type is GRPC.
+                                  rule: 'has(self.grpc) ? self.type == ''GRPC'' :
+                                    true'
+                              passive:
+                                description: Passive passive check configuration
+                                properties:
+                                  baseEjectionTime:
+                                    default: 30s
+                                    description: BaseEjectionTime defines the base
+                                      duration for which a host will be ejected on
+                                      consecutive failures.
+                                    format: duration
+                                    type: string
+                                  consecutive5XxErrors:
+                                    default: 5
+                                    description: Consecutive5xxErrors sets the number
+                                      of consecutive 5xx errors triggering ejection.
+                                    format: int32
+                                    type: integer
+                                  consecutiveGatewayErrors:
+                                    default: 0
+                                    description: ConsecutiveGatewayErrors sets the
+                                      number of consecutive gateway errors triggering
+                                      ejection.
+                                    format: int32
+                                    type: integer
+                                  consecutiveLocalOriginFailures:
+                                    default: 5
+                                    description: |-
+                                      ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.
+                                      Parameter takes effect only when split_external_local_origin_errors is set to true.
+                                    format: int32
+                                    type: integer
+                                  interval:
+                                    default: 3s
+                                    description: Interval defines the time between
+                                      passive health checks.
+                                    format: duration
+                                    type: string
+                                  maxEjectionPercent:
+                                    default: 10
+                                    description: MaxEjectionPercent sets the maximum
+                                      percentage of hosts in a cluster that can be
+                                      ejected.
+                                    format: int32
+                                    type: integer
+                                  splitExternalLocalOriginErrors:
+                                    default: false
+                                    description: SplitExternalLocalOriginErrors enables
+                                      splitting of errors between external and local
+                                      origin.
+                                    type: boolean
+                                type: object
+                            type: object
+                          http2:
+                            description: HTTP2 provides HTTP/2 configuration for backend
+                              connections.
+                            properties:
+                              initialConnectionWindowSize:
+                                allOf:
+                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.
+                                  If not set, the default value is 1 MiB.
+                                x-kubernetes-int-or-string: true
+                              initialStreamWindowSize:
+                                allOf:
+                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  InitialStreamWindowSize sets the initial window size for HTTP/2 streams.
+                                  If not set, the default value is 64 KiB(64*1024).
+                                x-kubernetes-int-or-string: true
+                              maxConcurrentStreams:
+                                description: |-
+                                  MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.
+                                  If not set, the default value is 100.
+                                format: int32
+                                maximum: 2147483647
+                                minimum: 1
+                                type: integer
+                              onInvalidMessage:
+                                description: |-
+                                  OnInvalidMessage determines if Envoy will terminate the connection or just the offending stream in the event of HTTP messaging error
+                                  It's recommended for L2 Envoy deployments to set this value to TerminateStream.
+                                  https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/level_two
+                                  Default: TerminateConnection
+                                type: string
+                            type: object
+                          loadBalancer:
+                            description: |-
+                              LoadBalancer policy to apply when routing traffic from the gateway to
+                              the backend endpoints. Defaults to `LeastRequest`.
+                            properties:
+                              consistentHash:
+                                description: |-
+                                  ConsistentHash defines the configuration when the load balancer type is
+                                  set to ConsistentHash
+                                properties:
+                                  cookie:
+                                    description: Cookie configures the cookie hash
+                                      policy when the consistent hash type is set
+                                      to Cookie.
+                                    properties:
+                                      attributes:
+                                        additionalProperties:
+                                          type: string
+                                        description: Additional Attributes to set
+                                          for the generated cookie.
+                                        type: object
+                                      name:
+                                        description: |-
+                                          Name of the cookie to hash.
+                                          If this cookie does not exist in the request, Envoy will generate a cookie and set
+                                          the TTL on the response back to the client based on Layer 4
+                                          attributes of the backend endpoint, to ensure that these future requests
+                                          go to the same backend endpoint. Make sure to set the TTL field for this case.
+                                        type: string
+                                      ttl:
+                                        description: |-
+                                          TTL of the generated cookie if the cookie is not present. This value sets the
+                                          Max-Age attribute value.
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                  header:
+                                    description: Header configures the header hash
+                                      policy when the consistent hash type is set
+                                      to Header.
+                                    properties:
+                                      name:
+                                        description: Name of the header to hash.
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                  tableSize:
+                                    default: 65537
+                                    description: The table size for consistent hashing,
+                                      must be prime number limited to 5000011.
+                                    format: int64
+                                    maximum: 5000011
+                                    minimum: 2
+                                    type: integer
+                                  type:
+                                    description: |-
+                                      ConsistentHashType defines the type of input to hash on. Valid Type values are
+                                      "SourceIP",
+                                      "Header",
+                                      "Cookie".
+                                    enum:
+                                    - SourceIP
+                                    - Header
+                                    - Cookie
+                                    type: string
+                                required:
+                                - type
+                                type: object
+                                x-kubernetes-validations:
+                                - message: If consistent hash type is header, the
+                                    header field must be set.
+                                  rule: 'self.type == ''Header'' ? has(self.header)
+                                    : !has(self.header)'
+                                - message: If consistent hash type is cookie, the
+                                    cookie field must be set.
+                                  rule: 'self.type == ''Cookie'' ? has(self.cookie)
+                                    : !has(self.cookie)'
+                              slowStart:
+                                description: |-
+                                  SlowStart defines the configuration related to the slow start load balancer policy.
+                                  If set, during slow start window, traffic sent to the newly added hosts will gradually increase.
+                                  Currently this is only supported for RoundRobin and LeastRequest load balancers
+                                properties:
+                                  window:
+                                    description: |-
+                                      Window defines the duration of the warm up period for newly added host.
+                                      During slow start window, traffic sent to the newly added hosts will gradually increase.
+                                      Currently only supports linear growth of traffic. For additional details,
+                                      see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    type: string
+                                required:
+                                - window
+                                type: object
+                              type:
+                                description: |-
+                                  Type decides the type of Load Balancer policy.
+                                  Valid LoadBalancerType values are
+                                  "ConsistentHash",
+                                  "LeastRequest",
+                                  "Random",
+                                  "RoundRobin".
+                                enum:
+                                - ConsistentHash
+                                - LeastRequest
+                                - Random
+                                - RoundRobin
+                                type: string
+                            required:
+                            - type
+                            type: object
+                            x-kubernetes-validations:
+                            - message: If LoadBalancer type is consistentHash, consistentHash
+                                field needs to be set.
+                              rule: 'self.type == ''ConsistentHash'' ? has(self.consistentHash)
+                                : !has(self.consistentHash)'
+                            - message: Currently SlowStart is only supported for RoundRobin
+                                and LeastRequest load balancers.
+                              rule: 'self.type in [''Random'', ''ConsistentHash'']
+                                ? !has(self.slowStart) : true '
+                          proxyProtocol:
+                            description: ProxyProtocol enables the Proxy Protocol
+                              when communicating with the backend.
+                            properties:
+                              version:
+                                description: |-
+                                  Version of ProxyProtol
+                                  Valid ProxyProtocolVersion values are
+                                  "V1"
+                                  "V2"
+                                enum:
+                                - V1
+                                - V2
+                                type: string
+                            required:
+                            - version
+                            type: object
+                          retry:
+                            description: |-
+                              Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+                              If not set, retry will be disabled.
+                            properties:
+                              numRetries:
+                                default: 2
+                                description: NumRetries is the number of retries to
+                                  be attempted. Defaults to 2.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                              perRetry:
+                                description: PerRetry is the retry policy to be applied
+                                  per retry attempt.
+                                properties:
+                                  backOff:
+                                    description: |-
+                                      Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+                                      back-off algorithm for retries. For additional details,
+                                      see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                                    properties:
+                                      baseInterval:
+                                        description: BaseInterval is the base interval
+                                          between retries.
+                                        format: duration
+                                        type: string
+                                      maxInterval:
+                                        description: |-
+                                          MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+                                          The default is 10 times the base_interval
+                                        format: duration
+                                        type: string
+                                    type: object
+                                  timeout:
+                                    description: Timeout is the timeout per retry
+                                      attempt.
+                                    format: duration
+                                    type: string
+                                type: object
+                              retryOn:
+                                description: |-
+                                  RetryOn specifies the retry trigger condition.
+
+                                  If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+                                properties:
+                                  httpStatusCodes:
+                                    description: |-
+                                      HttpStatusCodes specifies the http status codes to be retried.
+                                      The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+                                    items:
+                                      description: HTTPStatus defines the http status
+                                        code.
+                                      exclusiveMaximum: true
+                                      maximum: 600
+                                      minimum: 100
+                                      type: integer
+                                    type: array
+                                  triggers:
+                                    description: Triggers specifies the retry trigger
+                                      condition(Http/Grpc).
+                                    items:
+                                      description: TriggerEnum specifies the conditions
+                                        that trigger retries.
+                                      enum:
+                                      - 5xx
+                                      - gateway-error
+                                      - reset
+                                      - connect-failure
+                                      - retriable-4xx
+                                      - refused-stream
+                                      - retriable-status-codes
+                                      - cancelled
+                                      - deadline-exceeded
+                                      - internal
+                                      - resource-exhausted
+                                      - unavailable
+                                      type: string
+                                    type: array
+                                type: object
+                            type: object
+                          tcpKeepalive:
+                            description: |-
+                              TcpKeepalive settings associated with the upstream client connection.
+                              Disabled by default.
+                            properties:
+                              idleTime:
+                                description: |-
+                                  The duration a connection needs to be idle before keep-alive
+                                  probes start being sent.
+                                  The duration format is
+                                  Defaults to `7200s`.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                type: string
+                              interval:
+                                description: |-
+                                  The duration between keep-alive probes.
+                                  Defaults to `75s`.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                type: string
+                              probes:
+                                description: |-
+                                  The total number of unacknowledged probes to send before deciding
+                                  the connection is dead.
+                                  Defaults to 9.
+                                format: int32
+                                type: integer
+                            type: object
+                          timeout:
+                            description: Timeout settings for the backend connections.
+                            properties:
+                              http:
+                                description: Timeout settings for HTTP.
+                                properties:
+                                  connectionIdleTimeout:
+                                    description: |-
+                                      The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+                                      Default: 1 hour.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                    type: string
+                                  maxConnectionDuration:
+                                    description: |-
+                                      The maximum duration of an HTTP connection.
+                                      Default: unlimited.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                    type: string
+                                type: object
+                              tcp:
+                                description: Timeout settings for TCP.
+                                properties:
+                                  connectTimeout:
+                                    description: |-
+                                      The timeout for network connection establishment, including TCP and TLS handshakes.
+                                      Default: 10 seconds.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                    type: string
+                                type: object
+                            type: object
+                        type: object
+                      issuer:
+                        description: |-
+                          The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).
+                          Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST
+                          be https, a host component, and optionally, port and path components and
+                          no query or fragment components.
+                        minLength: 1
+                        type: string
+                      tokenEndpoint:
+                        description: |-
+                          The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
+                          If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
+                        type: string
+                    required:
+                    - issuer
+                    type: object
+                    x-kubernetes-validations:
+                    - message: BackendRefs must be used, backendRef is not supported.
+                      rule: '!has(self.backendRef)'
+                    - message: Only one backendRefs is allowed.
+                      rule: 'has(self.backendRefs)? self.backendRefs.size() > 1 :
+                        true'
                   redirectURL:
                     description: |-
                       The redirect URL to be used in the OIDC
diff --git a/examples/extension-server/go.mod b/examples/extension-server/go.mod
index 7fee44cb4..6fa30d742 100644
--- a/examples/extension-server/go.mod
+++ b/examples/extension-server/go.mod
@@ -31,9 +31,9 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 // indirect
-	golang.org/x/net v0.28.0 // indirect
-	golang.org/x/sys v0.24.0 // indirect
-	golang.org/x/text v0.17.0 // indirect
+	golang.org/x/net v0.29.0 // indirect
+	golang.org/x/sys v0.25.0 // indirect
+	golang.org/x/text v0.18.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240822170219-fc7c04adadcd // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240822170219-fc7c04adadcd // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
diff --git a/examples/extension-server/go.sum b/examples/extension-server/go.sum
index 122562b55..6e267eb11 100644
--- a/examples/extension-server/go.sum
+++ b/examples/extension-server/go.sum
@@ -81,20 +81,20 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
-golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
+golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
+golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
-golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
+golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
-golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
+golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
diff --git a/examples/kubernetes/jwt/README.md b/examples/kubernetes/jwt/README.md
new file mode 100644
index 000000000..cc4d6eaca
--- /dev/null
+++ b/examples/kubernetes/jwt/README.md
@@ -0,0 +1,3 @@
+The JWKS and private key in this directory are for testing purposes only and should not be considered confidential. Please do not use them in a production environment.
+
+A new JWT token can be generated using tools like https://www.scottbrady91.com/tools/jwt .
\ No newline at end of file
diff --git a/examples/kubernetes/jwt/jwks.json b/examples/kubernetes/jwt/jwks.json
index 6cd882726..b58d8e04f 100644
--- a/examples/kubernetes/jwt/jwks.json
+++ b/examples/kubernetes/jwt/jwks.json
@@ -1,1 +1,22 @@
-{"keys":[{"kty":"RSA","n":"u1SU1LfVLPHCozMxH2Mo4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0_IzW7yWR7QkrmBL7jTKEn5u-qKhbwKfBstIs-bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyehkd3qqGElvW_VDL5AaWTg0nLVkjRo9z-40RQzuVaE8AkAFmxZzow3x-VJYKdjykkJ0iT9wCS0DRTXu269V264Vf_3jvredZiKRkgwlL9xNAwxXFg0x_XFw005UWVRIkdgcKWTjpBP2dPwVZ4WWC-9aGVd-Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbcmw","e":"AQAB","alg":"RS256","use":"sig"}]}
+{
+    "keys": [
+        {
+            "kty": "RSA",
+            "n": "u1SU1LfVLPHCozMxH2Mo4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0_IzW7yWR7QkrmBL7jTKEn5u-qKhbwKfBstIs-bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyehkd3qqGElvW_VDL5AaWTg0nLVkjRo9z-40RQzuVaE8AkAFmxZzow3x-VJYKdjykkJ0iT9wCS0DRTXu269V264Vf_3jvredZiKRkgwlL9xNAwxXFg0x_XFw005UWVRIkdgcKWTjpBP2dPwVZ4WWC-9aGVd-Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbcmw",
+            "e": "AQAB",
+            "alg": "RS256",
+            "use": "sig"
+        },
+        {
+            "alg": "RS256",
+            "e": "AQAB",
+            "key_ops": [
+                "verify"
+            ],
+            "kty": "RSA",
+            "n": "xOHb-i1WDfeAvsbXTSOtosl3hCUDHQ8fRDqX_Rt998-hZDJmAoPOu4J-wcwq5aZtSn_iWUYLcK2WmC_1n-p1eyc-Pl4CBnxF7LUjCk-WGhniaCzXC5I5RON6c5N-MdE0UfukK0PM0zD3iQonZq0fIsnOYyFdYdWvQ5XW-C2aLlq2FUKrjmhAav10jIC0KGd2dHRzauzfLMUmt_iMnpU84Xrur1zRYzBO4D90rN0ypC2HH7o_zI8Osx4o1L8BScW78545sWyVbaprhBV1I2Sa4SH3NAc25ej3RIh-f13Yu97FVfO0AIG4VfFiaMmsTqNTCiBkM20tXD2Z-cHJTKemXzFgInJoqFLAkHLzJ0lPvAkKOgAOufLHa7RA-C276OXd72IXPsL1UOLN4sjhGqTtaynVa00yuHdi3f4-aoy9F9SUJeWfPg--nZNLzuI0eyufsTFywnx1bTQ_kdYlEr0dRE5sujlMk3cZ7FmOQRvcjA9MxFzoVKMmlZc6LMCgqw-P",
+            "use": "sig",
+            "kid": "b520b3c2c4bd75a10e9cebc9576933dc"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/examples/kubernetes/jwt/key.json b/examples/kubernetes/jwt/key.json
new file mode 100644
index 000000000..6fbf5bb22
--- /dev/null
+++ b/examples/kubernetes/jwt/key.json
@@ -0,0 +1,17 @@
+{
+    "alg": "RS256",
+    "d": "URyb_B3hbi-hovdYjDc-ueo2iwKUncw1HW7mXyiMZSPtYdJBpJeY_Ddu8Xij06kVLbQyFIV_ARUDDf_0OcXmUK6CPj-Mpg9c34Bgx0aymF5BoJmYnvPHFFKDiEojm3KNE5mQsSJlqDxsPtEoGm0IftSVatG8Hyph4n5A6k4fTymgCnJFK45Xu7xf3-LGVj8J1kCDrHGaIF-46-JCTLM_OcXjv-uFeE_Wrxx1fSJEUs9O9AtPbX8ilzi9qahnZ3VGmG1sSv0IPy1zUcRqF0nHVi4FP4yK-jZNbGvYobqlf-CpW6FKRNwKzc9a8QfnJB-bA4DQkHZBqKOLpMlPgGQj4Sgp4OnaBrJhXO4gLkXlhLpQNjr74qZr0KYR34MsVJIbCT0m6P1HrH1Yz-k8PIWE1LfY4Ku5ECpJOP9PCqd4vcUM4ErON08MozvSvALkuzgvWC7jjkHECSaRvRKhA6cEuBPLlzwUSWPRiso6BC9TvaEmbg2zk-xBtMfiKdtc9NPB",
+    "dp": "vAzERP3CMHHpBMK_0--UPaoTcfTDlcR6-2oRfjkbb3sfbryZJkoCrnlBBbFAnbSkCIrJL9Ig2lfEpK44OQJJ48AYja5z2APQyTgoOQMpp61OH8AWgvnupLNtWdhwYQgDkb276pAcPBkgRxXt29qW_Tvbcq-vcmV9NrqEWrJj_Os7gQvVDTgagaQZ3eH7eHqKCoAcAEwKL1SOH7DEh-LSX9N2G54tU11RFSmuiGMZ_XzU-hFmQN210sRckjHivCvR",
+    "dq": "yT4AWazCtcgW44VdhSlpebeMnz591P9KA41_l8vDALCBIjbom0wX5BZaaLaPsUPvfGkIOduCs7cJWzBPwOrd_BLenqd7rsHlhAz5aBVj0aXenUGwYQ8DaZzrB_wmPrJHkyzT9HOJ1jmiC5op-igcNSHrPfwFJ5K-bjUHJE4zIMmsMzi8XoWIj52uyRdXAq1u1t12Hc3_g_Fy5PugufrNIh8bMBw8wsEfTnMc21Y5s7xTTFouf4RUgVP5oBCe12Lh",
+    "e": "AQAB",
+    "key_ops": [
+      "sign"
+    ],
+    "kty": "RSA",
+    "n": "xOHb-i1WDfeAvsbXTSOtosl3hCUDHQ8fRDqX_Rt998-hZDJmAoPOu4J-wcwq5aZtSn_iWUYLcK2WmC_1n-p1eyc-Pl4CBnxF7LUjCk-WGhniaCzXC5I5RON6c5N-MdE0UfukK0PM0zD3iQonZq0fIsnOYyFdYdWvQ5XW-C2aLlq2FUKrjmhAav10jIC0KGd2dHRzauzfLMUmt_iMnpU84Xrur1zRYzBO4D90rN0ypC2HH7o_zI8Osx4o1L8BScW78545sWyVbaprhBV1I2Sa4SH3NAc25ej3RIh-f13Yu97FVfO0AIG4VfFiaMmsTqNTCiBkM20tXD2Z-cHJTKemXzFgInJoqFLAkHLzJ0lPvAkKOgAOufLHa7RA-C276OXd72IXPsL1UOLN4sjhGqTtaynVa00yuHdi3f4-aoy9F9SUJeWfPg--nZNLzuI0eyufsTFywnx1bTQ_kdYlEr0dRE5sujlMk3cZ7FmOQRvcjA9MxFzoVKMmlZc6LMCgqw-P",
+    "p": "7m9XI2SOtfdUd-BTKSoot9bgo5oKHcG3pilZtNlqgf5o47rHeSQj8Js85PL-2IXGDuRkTA08uTzQtoPEwsGb8aB96KhSw3SSqtEN_hNFCUQ4AuxWtXj5nTEudqhyFHyYb5U-6_iVrKk_rJYI4l1dRSe0ePuIgmHJOSJUBnPFHiYURKmI3F2MCLXD3PQKbtBYx24QP0bvsTl6uz_uh5_EvPLBgtCJf0ey6D2DHt-4NQxp-_13PCBxt_ARi6lAYG8D",
+    "q": "02Lf5WZuXf0ZBvnug8lwkZ1a2pe0MG_-b6KHMaUN3su3uyqvB8x6b9wEl3UN-4z8OgDfWewYFxU5v3DMPY6ecMoMFfOzSApTEimLsJ_4i3qqxFvVeG5w0jX7nyGBvCdIuqjQYGd03P2BpXQwiFzJ7Sai4Dj_IOPUBM59TCR3R-fk8I9PoTXDXG1di6DwpXRvfYoUypxufvhQcmvBELB-sNgbX2LjVwJ4ZjniMFSkjvGNm88BH32SMRMuh3oSFiGF",
+    "qi": "wh-Gs9spzz9ogGpj_XSkHguvHayVqLzDK9GVbdXUO-bOYvZkvQO37GDBBRv39drYQrpgivT-iwgtWn6ESQ1atxcx1I6IXtAi9CZUJeBH7ipuOi5GPr_igphr0Z9O2a7Bwv3ZwwnuoseGYIW4ybPj93D1P2nHKcoh4u5dpSpXuy3qh4urAtVkivEXtxPPQdTkoizwGPAa19-Tyzv8Xrt3W6M2rCBQa8mpLkBHYhkgxfDx8olrerXxT11kMLlqFcwN",
+    "use": "sig",
+    "kid": "b520b3c2c4bd75a10e9cebc9576933dc"
+  }
\ No newline at end of file
diff --git a/go.mod b/go.mod
index 4a9e67f46..cc1e8bb74 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ replace github.com/imdario/mergo => github.com/imdario/mergo v0.3.16
 require (
 	fortio.org/fortio v1.66.1
 	fortio.org/log v1.16.0
-	github.com/Masterminds/semver/v3 v3.2.1
+	github.com/Masterminds/semver/v3 v3.3.0
 	github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/docker/cli v27.2.0+incompatible
@@ -27,8 +27,8 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/miekg/dns v1.1.62
 	github.com/ohler55/ojg v1.24.0
-	github.com/prometheus/client_golang v1.20.2
-	github.com/prometheus/common v0.57.0
+	github.com/prometheus/client_golang v1.20.3
+	github.com/prometheus/common v0.59.1
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
@@ -44,7 +44,7 @@ require (
 	go.opentelemetry.io/proto/otlp v1.3.1
 	go.uber.org/zap v1.27.0
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
-	golang.org/x/sys v0.24.0
+	golang.org/x/sys v0.25.0
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.15.4
@@ -192,7 +192,7 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
-	golang.org/x/crypto v0.26.0 // indirect
+	golang.org/x/crypto v0.27.0 // indirect
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20240806160748-b2d3a6a4b4d3 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
@@ -260,11 +260,11 @@ require (
 	go.starlark.net v0.0.0-20240520160348-046347dcd104 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/mod v0.20.0 // indirect
-	golang.org/x/net v0.28.0
+	golang.org/x/net v0.29.0
 	golang.org/x/oauth2 v0.22.0 // indirect
 	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/term v0.23.0 // indirect
-	golang.org/x/text v0.17.0 // indirect
+	golang.org/x/term v0.24.0 // indirect
+	golang.org/x/text v0.18.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.23.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
diff --git a/go.sum b/go.sum
index c8e26b75b..cc359a977 100644
--- a/go.sum
+++ b/go.sum
@@ -61,8 +61,8 @@ github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
-github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
-github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
+github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
@@ -679,8 +679,8 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
-github.com/prometheus/client_golang v1.20.2 h1:5ctymQzZlyOON1666svgwn3s6IKWgfbjsejTMiXIyjg=
-github.com/prometheus/client_golang v1.20.2/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_golang v1.20.3 h1:oPksm4K8B+Vt35tUhw6GbSNSgVlVSBH0qELP/7u83l4=
+github.com/prometheus/client_golang v1.20.3/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -691,8 +691,8 @@ github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7q
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
-github.com/prometheus/common v0.57.0 h1:Ro/rKjwdq9mZn1K5QPctzh+MA4Lp0BuYk5ZZEVhoNcY=
-github.com/prometheus/common v0.57.0/go.mod h1:7uRPFSUTbfZWsJ7MHY56sqt7hLQu3bxXHDnNhl8E9qI=
+github.com/prometheus/common v0.59.1 h1:LXb1quJHWm1P6wq/U824uxYi4Sg0oGvNeUm1z5dJoX0=
+github.com/prometheus/common v0.59.1/go.mod h1:GpWM7dewqmVYcd7SmRaiWVe9SSqjf0UrwnYnpEZNuT0=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
@@ -909,8 +909,8 @@ golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
-golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
+golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
+golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20240806160748-b2d3a6a4b4d3 h1:oWb21rU9Q9XrRwXLB7jHc1rbp6EiiimZZv5MLxpu4T0=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20240806160748-b2d3a6a4b4d3/go.mod h1:kNa9WdvYnzFwC79zRpLRMJbdEFlhyM5RPFBBZp/wWH8=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -951,8 +951,8 @@ golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
-golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
+golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
+golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1010,13 +1010,13 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
-golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
+golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
-golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
+golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
+golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1024,8 +1024,8 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
-golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
+golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go
index b9ac448e7..3fbf5fb25 100644
--- a/internal/gatewayapi/backendtrafficpolicy.go
+++ b/internal/gatewayapi/backendtrafficpolicy.go
@@ -773,7 +773,7 @@ func ratelimitUnitToDuration(unit egv1a1.RateLimitUnit) int64 {
 
 func int64ToUint32(in int64) (uint32, bool) {
 	if in >= 0 && in <= math.MaxUint32 {
-		return uint32(in), true // nolint: gosec
+		return uint32(in), true
 	}
 	return 0, false
 }
diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go
index b0294a143..7d4c95e6e 100644
--- a/internal/gatewayapi/clienttrafficpolicy.go
+++ b/internal/gatewayapi/clienttrafficpolicy.go
@@ -661,6 +661,7 @@ func translateHTTP1Settings(http1Settings *egv1a1.HTTP1Settings, httpIR *ir.HTTP
 	if http1Settings.HTTP10 != nil {
 		var defaultHost *string
 		if ptr.Deref(http1Settings.HTTP10.UseDefaultHost, false) {
+			// First level of precedence - the first non-wildcard hostname associated with the listener
 			for _, hostname := range httpIR.Hostnames {
 				if !strings.Contains(hostname, "*") {
 					// make linter happy
@@ -669,8 +670,27 @@ func translateHTTP1Settings(http1Settings *egv1a1.HTTP1Settings, httpIR *ir.HTTP
 					break
 				}
 			}
+			// second level of precedence - try to get a hostname from the HTTPRoutes
+			numMatchingRoutes := 0
 			if defaultHost == nil {
-				return fmt.Errorf("cannot set http10 default host on listener with only wildcard hostnames")
+				// When taken from the routes, a default hostname can only be chosen if there
+				// is exactly one HTTPRoute with a non-wildcard hostname configured.
+				for _, route := range httpIR.Routes {
+					if route.Hostname != "" && !strings.Contains(route.Hostname, "*") {
+						numMatchingRoutes++
+						// make the linter happy
+						theHost := route.Hostname
+						defaultHost = ptr.To(theHost)
+					}
+					if numMatchingRoutes > 1 {
+						break
+					}
+				}
+				if numMatchingRoutes == 0 {
+					return fmt.Errorf("cannot set http10 default host on listener with only wildcard hostnames")
+				} else if numMatchingRoutes > 1 {
+					return fmt.Errorf("cannot set http10 default host on listener with only wildcard hostnames and more than one possible default route")
+				}
 			}
 		}
 		// If useDefaultHost was set, then defaultHost will have the hostname to use.
@@ -703,7 +723,7 @@ func translateHTTP2Settings(http2Settings *egv1a1.HTTP2Settings, httpIR *ir.HTTP
 				MinHTTP2InitialStreamWindowSize,
 				MaxHTTP2InitialStreamWindowSize))
 		default:
-			http2.InitialStreamWindowSize = ptr.To(uint32(initialStreamWindowSize)) // nolint: gosec
+			http2.InitialStreamWindowSize = ptr.To(uint32(initialStreamWindowSize))
 		}
 	}
 
@@ -718,7 +738,7 @@ func translateHTTP2Settings(http2Settings *egv1a1.HTTP2Settings, httpIR *ir.HTTP
 				MinHTTP2InitialConnectionWindowSize,
 				MaxHTTP2InitialConnectionWindowSize))
 		default:
-			http2.InitialConnectionWindowSize = ptr.To(uint32(initialConnectionWindowSize)) // nolint: gosec
+			http2.InitialConnectionWindowSize = ptr.To(uint32(initialConnectionWindowSize))
 		}
 	}
 
@@ -878,7 +898,7 @@ func buildConnection(connection *egv1a1.ClientConnection) (*ir.ClientConnection,
 			return nil, fmt.Errorf("BufferLimit value %s is out of range, must be between 0 and %d",
 				connection.BufferLimit.String(), math.MaxUint32)
 		}
-		irConnection.BufferLimitBytes = ptr.To(uint32(bufferLimit)) // nolint: gosec
+		irConnection.BufferLimitBytes = ptr.To(uint32(bufferLimit))
 	}
 
 	return irConnection, nil
diff --git a/internal/gatewayapi/clustersettings.go b/internal/gatewayapi/clustersettings.go
index a05ad60ff..4b295ea5b 100644
--- a/internal/gatewayapi/clustersettings.go
+++ b/internal/gatewayapi/clustersettings.go
@@ -190,7 +190,7 @@ func buildBackendConnection(policy egv1a1.ClusterSettings) (*ir.BackendConnectio
 				return nil, fmt.Errorf("BufferLimit value %s is out of range", bc.BufferLimit.String())
 			}
 
-			bcIR.BufferLimitBytes = ptr.To(uint32(bf)) // nolint: gosec
+			bcIR.BufferLimitBytes = ptr.To(uint32(bf))
 		}
 	}
 
@@ -339,7 +339,7 @@ func buildConsistentHashLoadBalancer(policy egv1a1.LoadBalancer) (*ir.Consistent
 	if policy.ConsistentHash.TableSize != nil {
 		tableSize := policy.ConsistentHash.TableSize
 
-		if *tableSize > MaxConsistentHashTableSize || !big.NewInt(int64(*tableSize)).ProbablyPrime(0) { // nolint: gosec
+		if *tableSize > MaxConsistentHashTableSize || !big.NewInt(int64(*tableSize)).ProbablyPrime(0) {
 			return nil, fmt.Errorf("invalid TableSize value %d", *tableSize)
 		}
 
diff --git a/internal/gatewayapi/filters.go b/internal/gatewayapi/filters.go
index f3484c6d9..aecc2e811 100644
--- a/internal/gatewayapi/filters.go
+++ b/internal/gatewayapi/filters.go
@@ -358,7 +358,7 @@ func (t *Translator) processRedirectFilter(
 	}
 
 	if redirect.StatusCode != nil {
-		redirectCode := int32(*redirect.StatusCode) // nolint: gosec
+		redirectCode := int32(*redirect.StatusCode)
 		// Envoy supports 302, 303, 307, and 308, but gateway API only includes 301 and 302
 		if redirectCode == 301 || redirectCode == 302 {
 			redir.StatusCode = &redirectCode
diff --git a/internal/gatewayapi/helpers.go b/internal/gatewayapi/helpers.go
index 7e0cf05de..52df40f47 100644
--- a/internal/gatewayapi/helpers.go
+++ b/internal/gatewayapi/helpers.go
@@ -513,7 +513,7 @@ func parseCIDR(cidr string) (*ir.CIDRMatch, error) {
 	return &ir.CIDRMatch{
 		CIDR:    ipn.String(),
 		IP:      ip.String(),
-		MaskLen: uint32(mask), // nolint: gosec
+		MaskLen: uint32(mask),
 		IsIPv6:  ip.To4() == nil,
 	}, nil
 }
diff --git a/internal/gatewayapi/http.go b/internal/gatewayapi/http.go
index eed3145eb..e54b3f761 100644
--- a/internal/gatewayapi/http.go
+++ b/internal/gatewayapi/http.go
@@ -42,7 +42,7 @@ func buildIRHTTP2Settings(http2Settings *egv1a1.HTTP2Settings) (*ir.HTTP2Setting
 				MinHTTP2InitialStreamWindowSize,
 				MaxHTTP2InitialStreamWindowSize))
 		default:
-			http2.InitialStreamWindowSize = ptr.To(uint32(initialStreamWindowSize)) // nolint: gosec
+			http2.InitialStreamWindowSize = ptr.To(uint32(initialStreamWindowSize))
 		}
 	}
 
@@ -57,7 +57,7 @@ func buildIRHTTP2Settings(http2Settings *egv1a1.HTTP2Settings) (*ir.HTTP2Setting
 				MinHTTP2InitialConnectionWindowSize,
 				MaxHTTP2InitialConnectionWindowSize))
 		default:
-			http2.InitialConnectionWindowSize = ptr.To(uint32(initialConnectionWindowSize)) // nolint: gosec
+			http2.InitialConnectionWindowSize = ptr.To(uint32(initialConnectionWindowSize))
 		}
 	}
 
diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
index 6590311d1..887b63386 100644
--- a/internal/gatewayapi/securitypolicy.go
+++ b/internal/gatewayapi/securitypolicy.go
@@ -872,6 +872,7 @@ func (t *Translator) buildExtAuth(policy *egv1a1.SecurityPolicy, resources *Reso
 		HeadersToExtAuth: policy.Spec.ExtAuth.HeadersToExtAuth,
 		FailOpen:         policy.Spec.ExtAuth.FailOpen,
 		Traffic:          traffic,
+		RecomputeRoute:   policy.Spec.ExtAuth.RecomputeRoute,
 	}
 
 	if http != nil {
diff --git a/internal/gatewayapi/translator.go b/internal/gatewayapi/translator.go
index 1be3f59f2..6346bb1a4 100644
--- a/internal/gatewayapi/translator.go
+++ b/internal/gatewayapi/translator.go
@@ -186,9 +186,6 @@ func (t *Translator) Translate(resources *Resources) (*TranslateResult, error) {
 	// Process EnvoyPatchPolicies
 	t.ProcessEnvoyPatchPolicies(resources.EnvoyPatchPolicies, xdsIR)
 
-	// Process ClientTrafficPolicies
-	clientTrafficPolicies := t.ProcessClientTrafficPolicies(resources, gateways, xdsIR, infraIR)
-
 	// Process all Addresses for all relevant Gateways.
 	t.ProcessAddresses(gateways, xdsIR, infraIR, resources)
 
@@ -210,6 +207,9 @@ func (t *Translator) Translate(resources *Resources) (*TranslateResult, error) {
 	// Process all relevant UDPRoutes.
 	udpRoutes := t.ProcessUDPRoutes(resources.UDPRoutes, gateways, resources, xdsIR)
 
+	// Process ClientTrafficPolicies
+	clientTrafficPolicies := t.ProcessClientTrafficPolicies(resources, gateways, xdsIR, infraIR)
+
 	// Process BackendTrafficPolicies
 	routes := []RouteContext{}
 	for _, h := range httpRoutes {
diff --git a/internal/gatewayapi/validate.go b/internal/gatewayapi/validate.go
index 5c442812d..d92dee3bc 100644
--- a/internal/gatewayapi/validate.go
+++ b/internal/gatewayapi/validate.go
@@ -314,6 +314,19 @@ func (t *Translator) validateBackendRefBackend(backendRef *gwapiv1a2.BackendRef,
 		return false
 	}
 
+	if err := validateBackend(backend); err != nil {
+		status.SetRouteStatusCondition(routeStatus,
+			parentRef.routeParentStatusIdx,
+			route.GetGeneration(),
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			"UnsupportedRefAddressFound",
+			fmt.Sprintf("Invalid Backend reference to Backend %s/%s found", backendNamespace,
+				string(backendRef.Name)),
+		)
+		return false
+	}
+
 	for _, bep := range backend.Spec.Endpoints {
 		if bep.Unix != nil {
 			status.SetRouteStatusCondition(routeStatus,
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index 5d90b6816..3465645e6 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -883,6 +883,13 @@ type ExtAuth struct {
 	// This setting determines whether to prioritize accessibility over strict security in case of authorization service failure.
 	// +optional
 	FailOpen *bool `json:"failOpen,omitempty"`
+
+	// RecomputeRoute clears the route cache and recalculates the routing decision.
+	// This field must be enabled if the headers generated from the claim are used for
+	// route matching decisions. If the recomputation selects a new route, features targeting
+	// the new matched route will be applied.
+	// +optional
+	RecomputeRoute *bool `json:"recomputeRoute,omitempty"`
 }
 
 // HTTPExtAuthService defines the HTTP External Authorization service
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index c16028999..1639262be 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -851,6 +851,11 @@ func (in *ExtAuth) DeepCopyInto(out *ExtAuth) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.RecomputeRoute != nil {
+		in, out := &in.RecomputeRoute, &out.RecomputeRoute
+		*out = new(bool)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtAuth.
diff --git a/internal/xds/translator/extauth.go b/internal/xds/translator/extauth.go
index 3b64326c4..7d7cc6a72 100644
--- a/internal/xds/translator/extauth.go
+++ b/internal/xds/translator/extauth.go
@@ -103,6 +103,10 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 		config.FailureModeAllow = *extAuth.FailOpen
 	}
 
+	if extAuth.RecomputeRoute != nil {
+		config.ClearRouteCache = *extAuth.RecomputeRoute
+	}
+
 	var headersToExtAuth []*matcherv3.StringMatcher
 	for _, header := range extAuth.HeadersToExtAuth {
 		headersToExtAuth = append(headersToExtAuth, &matcherv3.StringMatcher{
diff --git a/internal/xds/translator/local_ratelimit.go b/internal/xds/translator/local_ratelimit.go
index 2aad87852..1503758df 100644
--- a/internal/xds/translator/local_ratelimit.go
+++ b/internal/xds/translator/local_ratelimit.go
@@ -147,9 +147,9 @@ func (*localRateLimit) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) e
 	localRl := &localrlv3.LocalRateLimit{
 		StatPrefix: localRateLimitFilterStatPrefix,
 		TokenBucket: &typev3.TokenBucket{
-			MaxTokens: uint32(local.Default.Requests), // nolint: gosec
+			MaxTokens: uint32(local.Default.Requests),
 			TokensPerFill: &wrapperspb.UInt32Value{
-				Value: uint32(local.Default.Requests), // nolint: gosec
+				Value: uint32(local.Default.Requests),
 			},
 			FillInterval: ratelimitUnitToDuration(local.Default.Unit),
 		},
@@ -273,9 +273,9 @@ func buildRouteLocalRateLimits(local *ir.LocalRateLimit) (
 		descriptor := &rlv3.LocalRateLimitDescriptor{
 			Entries: descriptorEntries,
 			TokenBucket: &typev3.TokenBucket{
-				MaxTokens: uint32(rule.Limit.Requests), // nolint: gosec
+				MaxTokens: uint32(rule.Limit.Requests),
 				TokensPerFill: &wrapperspb.UInt32Value{
-					Value: uint32(rule.Limit.Requests), // nolint: gosec
+					Value: uint32(rule.Limit.Requests),
 				},
 				FillInterval: ratelimitUnitToDuration(rule.Limit.Unit),
 			},
diff --git a/internal/xds/translator/ratelimit.go b/internal/xds/translator/ratelimit.go
index 1641ee0f1..8e3e661f9 100644
--- a/internal/xds/translator/ratelimit.go
+++ b/internal/xds/translator/ratelimit.go
@@ -337,7 +337,7 @@ func buildRateLimitServiceDescriptors(global *ir.GlobalRateLimit) []*rlsconfv3.R
 			pbDesc.Key = getRouteRuleDescriptor(rIdx, -1)
 			pbDesc.Value = getRouteRuleDescriptor(rIdx, -1)
 			rateLimit := rlsconfv3.RateLimitPolicy{
-				RequestsPerUnit: uint32(rule.Limit.Requests), // nolint: gosec
+				RequestsPerUnit: uint32(rule.Limit.Requests),
 				Unit:            rlsconfv3.RateLimitUnit(rlsconfv3.RateLimitUnit_value[strings.ToUpper(string(rule.Limit.Unit))]),
 			}
 			pbDesc.RateLimit = &rateLimit
@@ -360,7 +360,7 @@ func buildRateLimitServiceDescriptors(global *ir.GlobalRateLimit) []*rlsconfv3.R
 			// Add the ratelimit values to the last descriptor
 			if mIdx == len(rule.HeaderMatches)-1 {
 				rateLimit := rlsconfv3.RateLimitPolicy{
-					RequestsPerUnit: uint32(rule.Limit.Requests), // nolint: gosec
+					RequestsPerUnit: uint32(rule.Limit.Requests),
 					Unit:            rlsconfv3.RateLimitUnit(rlsconfv3.RateLimitUnit_value[strings.ToUpper(string(rule.Limit.Unit))]),
 				}
 				pbDesc.RateLimit = &rateLimit
@@ -402,7 +402,7 @@ func buildRateLimitServiceDescriptors(global *ir.GlobalRateLimit) []*rlsconfv3.R
 			pbDesc.Key = "masked_remote_address"
 			pbDesc.Value = rule.CIDRMatch.CIDR
 			rateLimit := rlsconfv3.RateLimitPolicy{
-				RequestsPerUnit: uint32(rule.Limit.Requests), // nolint: gosec
+				RequestsPerUnit: uint32(rule.Limit.Requests),
 				Unit:            rlsconfv3.RateLimitUnit(rlsconfv3.RateLimitUnit_value[strings.ToUpper(string(rule.Limit.Unit))]),
 			}
 
@@ -522,5 +522,5 @@ func (t *Translator) getRateLimitServiceGrpcHostPort() (string, uint32) {
 	if err != nil {
 		panic(err)
 	}
-	return u.Hostname(), uint32(p) // nolint: gosec
+	return u.Hostname(), uint32(p)
 }
diff --git a/internal/xds/translator/route.go b/internal/xds/translator/route.go
index a23657a83..42f17ff94 100644
--- a/internal/xds/translator/route.go
+++ b/internal/xds/translator/route.go
@@ -598,7 +598,7 @@ func buildRetryPolicy(route *ir.HTTPRoute) (*routev3.RetryPolicy, error) {
 func buildRetryStatusCodes(codes []ir.HTTPStatus) []uint32 {
 	ret := make([]uint32, len(codes))
 	for i, c := range codes {
-		ret[i] = uint32(c) // nolint: gosec
+		ret[i] = uint32(c)
 	}
 	return ret
 }
diff --git a/internal/xds/translator/utils.go b/internal/xds/translator/utils.go
index a31a4a160..23d455edd 100644
--- a/internal/xds/translator/utils.go
+++ b/internal/xds/translator/utils.go
@@ -63,7 +63,7 @@ func url2Cluster(strURL string) (*urlCluster, error) {
 		}
 	}
 
-	name := clusterName(u.Hostname(), uint32(port)) // nolint: gosec
+	name := clusterName(u.Hostname(), uint32(port))
 
 	if ip, err := netip.ParseAddr(u.Hostname()); err == nil {
 		if ip.Unmap().Is4() {
@@ -74,7 +74,7 @@ func url2Cluster(strURL string) (*urlCluster, error) {
 	return &urlCluster{
 		name:         name,
 		hostname:     u.Hostname(),
-		port:         uint32(port), // nolint: gosec
+		port:         uint32(port),
 		endpointType: epType,
 		tls:          u.Scheme == "https",
 	}, nil
diff --git a/tools/docker/envoy-gateway/Dockerfile b/tools/docker/envoy-gateway/Dockerfile
index 33d874be4..4b40efa93 100644
--- a/tools/docker/envoy-gateway/Dockerfile
+++ b/tools/docker/envoy-gateway/Dockerfile
@@ -1,10 +1,10 @@
-FROM busybox@sha256:82742949a3709938cbeb9cec79f5eaf3e48b255389f2dcedf2de29ef96fd841c as source
+FROM busybox@sha256:34b191d63fbc93e25e275bfccf1b5365664e5ac28f06d974e8d50090fbb49f41 as source
 # Create the data directory for eg
 RUN mkdir -p /var/lib/eg
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot@sha256:8dd8d3ca2cf283383304fd45a5c9c74d5f2cd9da8d3b077d720e264880077c65
+FROM gcr.io/distroless/static:nonroot@sha256:42d15c647a762d3ce3a67eab394220f5268915d6ddba9006871e16e4698c3a24
 ARG TARGETPLATFORM
 COPY $TARGETPLATFORM/envoy-gateway /usr/local/bin/
 COPY --from=source --chown=65532:65532 /var/lib /var/lib
diff --git a/tools/linter/golangci-lint/.golangci.yml b/tools/linter/golangci-lint/.golangci.yml
index 962075c1c..7877f56cd 100644
--- a/tools/linter/golangci-lint/.golangci.yml
+++ b/tools/linter/golangci-lint/.golangci.yml
@@ -25,6 +25,9 @@ linters:
     - unparam
 
 linters-settings:
+  gosec:
+    excludes:
+      - G115
   depguard:
     rules:
       Main:
diff --git a/tools/make/lint.mk b/tools/make/lint.mk
index 8f9b306d0..7bd8231a1 100644
--- a/tools/make/lint.mk
+++ b/tools/make/lint.mk
@@ -93,3 +93,7 @@ licensecheck: ## Check license headers are present.
 latest-release-check: ## Check if latest release and tag are created properly.
 	@$(LOG_TARGET)
 	sh tools/hack/check-latest-release.sh
+
+.PHONY: lint.markdown
+lint.markdown:
+	markdownlint -c .github/markdown_lint_config.json site/content/*
\ No newline at end of file
diff --git a/tools/src/buf/go.mod b/tools/src/buf/go.mod
index 78355ec35..182b2697b 100644
--- a/tools/src/buf/go.mod
+++ b/tools/src/buf/go.mod
@@ -2,24 +2,27 @@ module local
 
 go 1.22.7
 
-require github.com/bufbuild/buf v1.39.0
+require github.com/bufbuild/buf v1.40.1
 
 require (
+	buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.34.2-20240904181154-a0be11449112.2 // indirect
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.2-20240717164558-a6c49f84cc0f.2 // indirect
 	buf.build/gen/go/bufbuild/registry/connectrpc/go v1.16.2-20240821192916-45ba72cdd479.1 // indirect
 	buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.34.2-20240821192916-45ba72cdd479.2 // indirect
+	buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.34.2-20240828222655-5345c0a56177.2 // indirect
 	connectrpc.com/connect v1.16.2 // indirect
 	connectrpc.com/otelconnect v0.7.1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.12.6 // indirect
-	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
-	github.com/bufbuild/protocompile v0.14.0 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/bufbuild/bufplugin-go v0.1.0 // indirect
+	github.com/bufbuild/protocompile v0.14.1 // indirect
 	github.com/bufbuild/protoplugin v0.0.0-20240323223605-e2735f6c31ee // indirect
-	github.com/bufbuild/protovalidate-go v0.6.4 // indirect
-	github.com/bufbuild/protoyaml-go v0.1.11 // indirect
+	github.com/bufbuild/protovalidate-go v0.6.5 // indirect
+	github.com/bufbuild/protoyaml-go v0.1.12 // indirect
 	github.com/containerd/cgroups/v3 v3.0.3 // indirect
-	github.com/containerd/containerd v1.7.20 // indirect
+	github.com/containerd/containerd v1.7.21 // indirect
 	github.com/containerd/continuity v0.4.3 // indirect
 	github.com/containerd/errdefs v0.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
@@ -29,13 +32,13 @@ require (
 	github.com/containerd/typeurl/v2 v2.2.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v27.1.2+incompatible // indirect
+	github.com/docker/cli v27.2.0+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v27.1.2+incompatible // indirect
+	github.com/docker/docker v27.2.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/felixge/fgprof v0.9.4 // indirect
+	github.com/felixge/fgprof v0.9.5 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-chi/chi/v5 v5.1.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
@@ -47,13 +50,14 @@ require (
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/cel-go v0.21.0 // indirect
 	github.com/google/go-containerregistry v0.20.2 // indirect
-	github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
+	github.com/google/pprof v0.0.0-20240903155634-a8630aee4ab9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jdx/go-netrc v1.0.0 // indirect
 	github.com/klauspost/compress v1.17.9 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
@@ -65,16 +69,16 @@ require (
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
-	github.com/onsi/ginkgo/v2 v2.20.1 // indirect
+	github.com/onsi/ginkgo/v2 v2.20.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/opencontainers/runtime-spec v1.2.0 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
-	github.com/quic-go/qpack v0.4.0 // indirect
+	github.com/quic-go/qpack v0.5.0 // indirect
 	github.com/quic-go/quic-go v0.46.0 // indirect
-	github.com/rs/cors v1.11.0 // indirect
+	github.com/rs/cors v1.11.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/cobra v1.8.1 // indirect
@@ -94,16 +98,17 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/crypto v0.26.0 // indirect
 	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 // indirect
-	golang.org/x/mod v0.20.0 // indirect
+	golang.org/x/mod v0.21.0 // indirect
 	golang.org/x/net v0.28.0 // indirect
 	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.24.0 // indirect
-	golang.org/x/term v0.23.0 // indirect
-	golang.org/x/text v0.17.0 // indirect
+	golang.org/x/sys v0.25.0 // indirect
+	golang.org/x/term v0.24.0 // indirect
+	golang.org/x/text v0.18.0 // indirect
 	golang.org/x/tools v0.24.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240823204242-4ba0660f739c // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240823204242-4ba0660f739c // indirect
-	google.golang.org/grpc v1.65.0 // indirect
-	google.golang.org/protobuf v1.34.2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
+	google.golang.org/grpc v1.66.0 // indirect
+	google.golang.org/protobuf v1.34.3-0.20240816073751-94ecbc261689 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	pluginrpc.com/pluginrpc v0.2.0 // indirect
 )
diff --git a/tools/src/buf/go.sum b/tools/src/buf/go.sum
index 444adc359..e611b0b96 100644
--- a/tools/src/buf/go.sum
+++ b/tools/src/buf/go.sum
@@ -1,9 +1,13 @@
+buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.34.2-20240904181154-a0be11449112.2 h1:X9qBPcvWGOJs/CeRVLoxxLJwC/eKyWDS/G4nj+3KGMY=
+buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.34.2-20240904181154-a0be11449112.2/go.mod h1:B+9TKHRYqoAUW57pLjhkLOnBCu0DQYMV+f7imQ9nXwI=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.2-20240717164558-a6c49f84cc0f.2 h1:SZRVx928rbYZ6hEKUIN+vtGDkl7uotABRWGY4OAg5gM=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.2-20240717164558-a6c49f84cc0f.2/go.mod h1:ylS4c28ACSI59oJrOdW4pHS4n0Hw4TgSPHn8rpHl4Yw=
 buf.build/gen/go/bufbuild/registry/connectrpc/go v1.16.2-20240821192916-45ba72cdd479.1 h1:QaJ6UkpvlGo4dBXR41vLRfPiKungbg7brjmbBC/k6Ig=
 buf.build/gen/go/bufbuild/registry/connectrpc/go v1.16.2-20240821192916-45ba72cdd479.1/go.mod h1:oQsMFNU3YzxxjRS6O68UkcF/A+pXdXqQNcUfQEBTWcw=
 buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.34.2-20240821192916-45ba72cdd479.2 h1:C3CTZTucEUm7i0O2tAM8GSlg23GnQYcljX1b1Jcpsro=
 buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.34.2-20240821192916-45ba72cdd479.2/go.mod h1:psseUmlKRo9v5LZJtR/aTpdTLuyp9o3X7rnLT87SZEo=
+buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.34.2-20240828222655-5345c0a56177.2 h1:oSi+Adw4xvIjXrW8eY8QGR3sBdfWeY5HN/RefnRt52M=
+buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.34.2-20240828222655-5345c0a56177.2/go.mod h1:GjH0gjlY/ns16X8d6eaXV2W+6IFwsO5Ly9WVnzyd1E0=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 connectrpc.com/connect v1.16.2 h1:ybd6y+ls7GOlb7Bh5C8+ghA6SvCBajHwxssO2CGFjqE=
 connectrpc.com/connect v1.16.2/go.mod h1:n2kgwskMHXC+lVqb18wngEpF95ldBHXjZYJussz5FRc=
@@ -18,18 +22,20 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Microsoft/hcsshim v0.12.6 h1:qEnZjoHXv+4/s0LmKZWE0/AiZmMWEIkFfWBSf1a0wlU=
 github.com/Microsoft/hcsshim v0.12.6/go.mod h1:ZABCLVcvLMjIkzr9rUGcQ1QA0p0P3Ps+d3N1g2DsFfk=
-github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
-github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
-github.com/bufbuild/buf v1.39.0 h1:f8bpK/8+cpgbppSyK4RKe0L1FxLqWcbgnHnWgXpVM7s=
-github.com/bufbuild/buf v1.39.0/go.mod h1:1P0U+x/ky1KhpK7o7mGraDAYjQUG7710wk5lEZFWsTA=
-github.com/bufbuild/protocompile v0.14.0 h1:z3DW4IvXE5G/uTOnSQn+qwQQxvhckkTWLS/0No/o7KU=
-github.com/bufbuild/protocompile v0.14.0/go.mod h1:N6J1NYzkspJo3ZwyL4Xjvli86XOj1xq4qAasUFxGups=
+github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
+github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
+github.com/bufbuild/buf v1.40.1 h1:u99ME/yC6zzZH5yGfwmcTt46bxFqDfuvFuif/W9F3Qo=
+github.com/bufbuild/buf v1.40.1/go.mod h1:PMkhwcFMP8d/aBJsvJL7GZq/CdeT7jwTS96RwFyKSU8=
+github.com/bufbuild/bufplugin-go v0.1.0 h1:3LmgSHaSf8mPvwoFunimgm8uKJFLg+YePdi7NQgnfdY=
+github.com/bufbuild/bufplugin-go v0.1.0/go.mod h1:gIbsJlcYJRLylxxNN3FPNd91fYxJmGVQgbZ67xLVrXk=
+github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
+github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/bufbuild/protoplugin v0.0.0-20240323223605-e2735f6c31ee h1:E6ET8YUcYJ1lAe6ctR3as7yqzW2BNItDFnaB5zQq/8M=
 github.com/bufbuild/protoplugin v0.0.0-20240323223605-e2735f6c31ee/go.mod h1:HjGFxsck9RObrTJp2hXQZfWhPgZqnR6sR1U5fCA/Kus=
-github.com/bufbuild/protovalidate-go v0.6.4 h1:QtNIz4LGclM3UArQv/R1AKNF7MO8wriT9v7b8Gnmqak=
-github.com/bufbuild/protovalidate-go v0.6.4/go.mod h1:HlkVnkE/zVYZvHIG/a7QZuzqC9bSqHaOOTeRomYF0Q8=
-github.com/bufbuild/protoyaml-go v0.1.11 h1:Iyixd6Y5dx6ws6Uh8APgC1lMyvXt710NayoY8cY0Vj8=
-github.com/bufbuild/protoyaml-go v0.1.11/go.mod h1:KCBItkvZOK/zwGueLdH1Wx1RLyFn5rCH7YjQrdty2Wc=
+github.com/bufbuild/protovalidate-go v0.6.5 h1:WucDKXIbK22WjkO8A8J6Yyxxy0jl91Oe9LSMduq3YEE=
+github.com/bufbuild/protovalidate-go v0.6.5/go.mod h1:LHDiGCWSM3GagZEnyEZ1sPtFwi6Ja4tVTi/DCc+iDFI=
+github.com/bufbuild/protoyaml-go v0.1.12 h1:tIJrwvGxumVpNwLsw/AevT1QnkPDBuAObBSuBAdmAWY=
+github.com/bufbuild/protoyaml-go v0.1.12/go.mod h1:Xmz3wct+08Va+g9gjIuLTAmxW2w6sre5Wrgw7K3gn0I=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -46,8 +52,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/containerd/cgroups/v3 v3.0.3 h1:S5ByHZ/h9PMe5IOQoN7E+nMc2UcLEM/V48DGDJ9kip0=
 github.com/containerd/cgroups/v3 v3.0.3/go.mod h1:8HBe7V3aWGLFPd/k03swSIsGjZhHI2WzJmticMgVuz0=
-github.com/containerd/containerd v1.7.20 h1:Sl6jQYk3TRavaU83h66QMbI2Nqg9Jm6qzwX57Vsn1SQ=
-github.com/containerd/containerd v1.7.20/go.mod h1:52GsS5CwquuqPuLncsXwG0t2CiUce+KsNHJZQJvAgR0=
+github.com/containerd/containerd v1.7.21 h1:USGXRK1eOC/SX0L195YgxTHb0a00anxajOzgfN0qrCA=
+github.com/containerd/containerd v1.7.21/go.mod h1:e3Jz1rYRUZ2Lt51YrH9Rz0zPyJBOlSvB3ghr2jbVD8g=
 github.com/containerd/continuity v0.4.3 h1:6HVkalIp+2u1ZLH1J/pYX2oBVXlJZvh1X1A7bEZ9Su8=
 github.com/containerd/continuity v0.4.3/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
 github.com/containerd/errdefs v0.1.0 h1:m0wCRBiu1WJT/Fr+iOoQHMQS/eP5myQ8lCv4Dz5ZURM=
@@ -71,12 +77,12 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v27.1.2+incompatible h1:nYviRv5Y+YAKx3dFrTvS1ErkyVVunKOhoweCTE1BsnI=
-github.com/docker/cli v27.1.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v27.2.0+incompatible h1:yHD1QEB1/0vr5eBNpu8tncu8gWxg8EydFPOSKHzXSMM=
+github.com/docker/cli v27.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v27.1.2+incompatible h1:AhGzR1xaQIy53qCkxARaFluI00WPGtXn0AJuoQsVYTY=
-github.com/docker/docker v27.1.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.2.0+incompatible h1:Rk9nIVdfH3+Vz4cyI/uhbINhEZ/oLmc+CBXmH6fbNk4=
+github.com/docker/docker v27.2.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -90,8 +96,8 @@ github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7
 github.com/envoyproxy/protoc-gen-validate v1.1.0 h1:tntQDh69XqOCOZsDz0lVJQez/2L6Uu2PdjCQwWCJ3bM=
 github.com/envoyproxy/protoc-gen-validate v1.1.0/go.mod h1:sXRDRVmzEbkM7CVcM06s9shE/m23dg3wzjl0UWqJ2q4=
 github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
-github.com/felixge/fgprof v0.9.4 h1:ocDNwMFlnA0NU0zSB3I52xkO4sFXk80VK9lXjLClu88=
-github.com/felixge/fgprof v0.9.4/go.mod h1:yKl+ERSa++RYOs32d8K6WEXCB4uXdLls4ZaZPpayhMM=
+github.com/felixge/fgprof v0.9.5 h1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=
+github.com/felixge/fgprof v0.9.5/go.mod h1:yKl+ERSa++RYOs32d8K6WEXCB4uXdLls4ZaZPpayhMM=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/go-chi/chi/v5 v5.1.0 h1:acVI1TYaD+hhedDJ3r54HyA6sExp3HfXq7QWEEY/xMw=
@@ -142,8 +148,8 @@ github.com/google/go-containerregistry v0.20.2 h1:B1wPJ1SN/S7pB+ZAimcciVD+r+yV/l
 github.com/google/go-containerregistry v0.20.2/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
 github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
 github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
-github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
+github.com/google/pprof v0.0.0-20240903155634-a8630aee4ab9 h1:q5g0N9eal4bmJwXHC5z0QCKs8qhS35hFfq0BAYsIwZI=
+github.com/google/pprof v0.0.0-20240903155634-a8630aee4ab9/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -170,6 +176,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
@@ -192,8 +200,8 @@ github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
 github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
-github.com/onsi/ginkgo/v2 v2.20.1 h1:YlVIbqct+ZmnEph770q9Q7NVAz4wwIiVNahee6JyUzo=
-github.com/onsi/ginkgo/v2 v2.20.1/go.mod h1:lG9ey2Z29hR41WMVthyJBGUBcBhGOtoPF2VFMvBXFCI=
+github.com/onsi/ginkgo/v2 v2.20.2 h1:7NVCeyIWROIAheY21RLS+3j2bb52W0W82tkberYytp4=
+github.com/onsi/ginkgo/v2 v2.20.2/go.mod h1:K9gyxPIlb+aIvnZ8bd9Ak+YP18w3APlR+5coaZoE2ag=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
 github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -216,14 +224,14 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=
-github.com/quic-go/qpack v0.4.0/go.mod h1:UZVnYIfi5GRk+zI9UMaCPsmZ2xKJP7XBUvVyT1Knj9A=
+github.com/quic-go/qpack v0.5.0 h1:jldbr38Ef/swDfxtvNvvUIYNg5LNm3Oa9W+IZvCm4q0=
+github.com/quic-go/qpack v0.5.0/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
 github.com/quic-go/quic-go v0.46.0 h1:uuwLClEEyk1DNvchH8uCByQVjo3yKL9opKulExNDs7Y=
 github.com/quic-go/quic-go v0.46.0/go.mod h1:1dLehS7TIR64+vxGR70GDcatWTOtMX2PUtnKsjbTurI=
 github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
 github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
-github.com/rs/cors v1.11.0 h1:0B9GE/r9Bc2UxRMMtymBkHTenPkHDv0CW4Y98GBY+po=
-github.com/rs/cors v1.11.0/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
+github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
@@ -290,8 +298,8 @@ golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvx
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
-golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
+golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -321,14 +329,14 @@ golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
-golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
-golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
+golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
+golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
+golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
-golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
+golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -350,17 +358,17 @@ google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto/googleapis/api v0.0.0-20240823204242-4ba0660f739c h1:e0zB268kOca6FbuJkYUGxfwG4DKFZG/8DLyv9Zv66cE=
-google.golang.org/genproto/googleapis/api v0.0.0-20240823204242-4ba0660f739c/go.mod h1:fO8wJzT2zbQbAjbIoos1285VfEIYKDDY+Dt+WpTkh6g=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240823204242-4ba0660f739c h1:Kqjm4WpoWvwhMPcrAczoTyMySQmYa9Wy2iL6Con4zn8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240823204242-4ba0660f739c/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
+google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 h1:hjSy6tcFQZ171igDaN5QHOw2n6vx40juYbC/x67CEhc=
+google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:qpvKtACPCQhAdu3PyQgV4l3LMXZEtft7y8QcarRsp9I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1:pPJltXNxVzT4pK9yD8vR9X75DaWYYmLGMsEvBfFQZzQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
-google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
+google.golang.org/grpc v1.66.0 h1:DibZuoBznOxbDQxRINckZcUvnCEvrW9pcWIE2yF9r1c=
+google.golang.org/grpc v1.66.0/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -370,8 +378,8 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
-google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+google.golang.org/protobuf v1.34.3-0.20240816073751-94ecbc261689 h1:hNwajDgT0MlsxZzlUajZVmUYFpts8/CYe4BSNx503ZE=
+google.golang.org/protobuf v1.34.3-0.20240816073751-94ecbc261689/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -382,3 +390,5 @@ gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+pluginrpc.com/pluginrpc v0.2.0 h1:mUuxA2Vtt1/buDsnR1HscuAu56Y/3ax5oPPy+9q/Zr4=
+pluginrpc.com/pluginrpc v0.2.0/go.mod h1:rX3qwV56YEwfayfyfEovbQ+KMVDjgJ8icHy0WTaUXRY=


Test patch:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.in.yaml
index 5ea01c153..c4f16d4a2 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.in.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.in.yaml
@@ -40,6 +40,34 @@ clientTrafficPolicies:
       kind: Gateway
       name: gateway-1
       sectionName: http-3
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1-section-http-4
+  spec:
+    http1:
+      http10:
+        useDefaultHost: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-4
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1-section-http-5
+  spec:
+    http1:
+      http10:
+        useDefaultHost: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-5
 gateways:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
@@ -68,3 +96,57 @@ gateways:
       allowedRoutes:
         namespaces:
           from: Same
+    - name: http-4
+      protocol: HTTP
+      port: 8082
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: http-5
+      protocol: HTTP
+      port: 8083
+      allowedRoutes:
+        namespaces:
+          from: Same
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    hostnames:
+    - route.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http-4
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http-5
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-2
+  spec:
+    hostnames:
+    - route2.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http-5
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
index d0d0a8975..8561d9300 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
@@ -89,6 +89,67 @@ clientTrafficPolicies:
         status: "False"
         type: Accepted
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1-section-http-4
+    namespace: envoy-gateway
+  spec:
+    http1:
+      http10:
+        useDefaultHost: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-4
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-4
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: ClientTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1-section-http-5
+    namespace: envoy-gateway
+  spec:
+    http1:
+      http10:
+        useDefaultHost: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      sectionName: http-5
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-5
+      conditions:
+      - lastTransitionTime: null
+        message: 'HTTP1: cannot set http10 default host on listener with only wildcard
+          hostnames and more than one possible default route.'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
 gateways:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
@@ -118,6 +179,18 @@ gateways:
       name: http-3
       port: 8081
       protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http-4
+      port: 8082
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http-5
+      port: 8083
+      protocol: HTTP
   status:
     listeners:
     - attachedRoutes: 0
@@ -189,6 +262,148 @@ gateways:
         kind: HTTPRoute
       - group: gateway.networking.k8s.io
         kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-4
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-5
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - route.example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http-4
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http-5
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-4
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-5
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - route2.example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http-5
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-5
 infraIR:
   envoy-gateway/gateway-1:
     proxy:
@@ -214,6 +429,20 @@ infraIR:
           name: http-8081
           protocol: HTTP
           servicePort: 8081
+      - address: null
+        name: envoy-gateway/gateway-1/http-4
+        ports:
+        - containerPort: 8082
+          name: http-8082
+          protocol: HTTP
+          servicePort: 8082
+      - address: null
+        name: envoy-gateway/gateway-1/http-5
+        ports:
+        - containerPort: 8083
+          name: http-8083
+          protocol: HTTP
+          servicePort: 8083
       metadata:
         labels:
           gateway.envoyproxy.io/owning-gateway-name: gateway-1
@@ -273,3 +502,88 @@ xdsIR:
         escapedSlashesAction: UnescapeAndRedirect
         mergeSlashes: true
       port: 8081
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      http1:
+        http10:
+          defaultHost: route.example.com
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-4
+      name: envoy-gateway/gateway-1/http-4
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8082
+      routes:
+      - destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - weight: 1
+        directResponse:
+          statusCode: 500
+        hostname: route.example.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: envoy-gateway
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/route_example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      http1: {}
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-5
+      name: envoy-gateway/gateway-1/http-5
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8083
+      routes:
+      - destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - weight: 1
+        directResponse:
+          statusCode: 500
+        hostname: route.example.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: envoy-gateway
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/route_example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      - destination:
+          name: httproute/envoy-gateway/httproute-2/rule/0
+          settings:
+          - weight: 1
+        directResponse:
+          statusCode: 500
+        hostname: route2.example.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-2
+          namespace: envoy-gateway
+        name: httproute/envoy-gateway/httproute-2/rule/0/match/0/route2_example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml b/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml b/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
index b25d2af5d..25ee9e8ba 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
@@ -272,9 +272,10 @@ httpRoutes:
         status: "True"
         type: Accepted
       - lastTransitionTime: null
-        message: Resolved all the Object references for the Route
-        reason: ResolvedRefs
-        status: "True"
+        message: Invalid Backend reference to Backend default/backend-ip-localhost
+          found
+        reason: UnsupportedRefAddressFound
+        status: "False"
         type: ResolvedRefs
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
       parentRef:
@@ -309,9 +310,10 @@ httpRoutes:
         status: "True"
         type: Accepted
       - lastTransitionTime: null
-        message: Resolved all the Object references for the Route
-        reason: ResolvedRefs
-        status: "True"
+        message: Invalid Backend reference to Backend default/backend-fqdn-localhost
+          found
+        reason: UnsupportedRefAddressFound
+        status: "False"
         type: ResolvedRefs
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
       parentRef:
@@ -413,11 +415,9 @@ xdsIR:
       - destination:
           name: httproute/default/httproute-4/rule/0
           settings:
-          - addressType: IP
-            endpoints:
-            - host: 127.0.0.1
-              port: 3001
-            weight: 1
+          - weight: 1
+        directResponse:
+          statusCode: 500
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -432,11 +432,9 @@ xdsIR:
       - destination:
           name: httproute/default/httproute-5/rule/0
           settings:
-          - addressType: FQDN
-            endpoints:
-            - host: localhost
-              port: 3001
-            weight: 1
+          - weight: 1
+        directResponse:
+          statusCode: 500
         hostname: '*'
         isHTTP2: false
         metadata:
diff --git a/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml b/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml
old mode 100755
new mode 100644
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.in.yaml
new file mode 100644
index 000000000..5cab33ed6
--- /dev/null
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.in.yaml
@@ -0,0 +1,111 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo1
+          backendRefs:
+            - name: service-1
+              port: 8080
+        - matches:
+            - path:
+                value: /foo2
+          backendRefs:
+            - name: service-2
+              port: 8080
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-2
+    spec:
+      hostnames:
+        - www.bar.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /bar
+          backendRefs:
+            - name: service-3
+              port: 8080
+backends:
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: Backend
+    metadata:
+      name: backend-fqdn
+      namespace: default
+    spec:
+      endpoints:
+        - fqdn:
+            hostname: 'primary.foo.com'
+            port: 3000
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: envoy-gateway
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.envoyproxy.io
+          kind: SecurityPolicy
+          namespace: default
+      to:
+        - group: ""
+          kind: Service
+securityPolicies:
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-http-route-1
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+      extAuth:
+        failOpen: true
+        recomputeRoute: true
+        headersToExtAuth:
+          - header1
+          - header2
+        grpc:
+          backendRefs:
+            - name: service-2
+              kind: Service
+              port: 8080
+            - name: backend-fqdn
+              kind: Backend
+              group: gateway.envoyproxy.io
+              port: 3000
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
new file mode 100644
index 000000000..bc18a9b53
--- /dev/null
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
@@ -0,0 +1,332 @@
+backends:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    creationTimestamp: null
+    name: backend-fqdn
+    namespace: default
+  spec:
+    endpoints:
+    - fqdn:
+        hostname: primary.foo.com
+        port: 3000
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The Backend was accepted
+      reason: Accepted
+      status: "True"
+      type: Invalid
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo1
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /foo2
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-3
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route-1
+    namespace: default
+  spec:
+    extAuth:
+      failOpen: true
+      grpc:
+        backendRefs:
+        - kind: Service
+          name: service-2
+          port: 8080
+        - group: gateway.envoyproxy.io
+          kind: Backend
+          name: backend-fqdn
+          port: 3000
+      headersToExtAuth:
+      - header1
+      - header2
+      recomputeRoute: true
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: default
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo1
+        security:
+          extAuth:
+            failOpen: true
+            grpc:
+              authority: service-2.default:8080
+              destination:
+                name: securitypolicy/default/policy-for-http-route-1/0
+                settings:
+                - addressType: IP
+                  endpoints:
+                  - host: 7.7.7.7
+                    port: 8080
+                  protocol: GRPC
+                  weight: 1
+                - addressType: FQDN
+                  endpoints:
+                  - host: primary.foo.com
+                    port: 3000
+                  protocol: GRPC
+                  weight: 1
+            headersToExtAuth:
+            - header1
+            - header2
+            name: securitypolicy/default/policy-for-http-route-1
+            recomputeRoute: true
+      - destination:
+          name: httproute/default/httproute-1/rule/1
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: default
+        name: httproute/default/httproute-1/rule/1/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo2
+        security:
+          extAuth:
+            failOpen: true
+            grpc:
+              authority: service-2.default:8080
+              destination:
+                name: securitypolicy/default/policy-for-http-route-1/0
+                settings:
+                - addressType: IP
+                  endpoints:
+                  - host: 7.7.7.7
+                    port: 8080
+                  protocol: GRPC
+                  weight: 1
+                - addressType: FQDN
+                  endpoints:
+                  - host: primary.foo.com
+                    port: 3000
+                  protocol: GRPC
+                  weight: 1
+            headersToExtAuth:
+            - header1
+            - header2
+            name: securitypolicy/default/policy-for-http-route-1
+            recomputeRoute: true
+      - destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.bar.com
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-2
+          namespace: default
+        name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/internal/xds/translator/testdata/in/xds-ir/ext-auth-recomputation.yaml b/internal/xds/translator/testdata/in/xds-ir/ext-auth-recomputation.yaml
new file mode 100644
index 000000000..fb0451b98
--- /dev/null
+++ b/internal/xds/translator/testdata/in/xds-ir/ext-auth-recomputation.yaml
@@ -0,0 +1,124 @@
+http:
+  - address: 0.0.0.0
+    hostnames:
+      - '*'
+    isHTTP2: false
+    name: default/gateway-1/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        hostname: www.foo.com
+        isHTTP2: false
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo1
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 7.7.7.7
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        security:
+          extAuth:
+            name: securitypolicy/default/policy-for-http-route-1
+            failOpen: false
+            grpc:
+              authority: primary.foo.com
+              destination:
+                name: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
+                settings:
+                  - addressType: FQDN
+                    endpoints:
+                      - host: primary.foo.com
+                        port: 9000
+                    protocol: GRPC
+                    weight: 1
+            headersToExtAuth:
+              - header1
+              - header2
+      - name: httproute/default/httproute-1/rule/1/match/0/www_foo_com
+        hostname: www.foo.com
+        isHTTP2: false
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo2
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/1
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 7.7.7.7
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        security:
+          extAuth:
+            name: securitypolicy/default/policy-for-http-route-1
+            failOpen: false
+            grpc:
+              authority: primary.foo.com
+              destination:
+                name: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
+                settings:
+                  - addressType: IP
+                    endpoints:
+                      - host: primary.foo.com
+                        port: 3000
+                    protocol: GRPC
+                    weight: 1
+            headersToExtAuth:
+              - header1
+              - header2
+      - name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+        hostname: www.bar.com
+        isHTTP2: false
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 7.7.7.7
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        security:
+          extAuth:
+            name: securitypolicy/default/policy-for-gateway-1
+            failOpen: true
+            recomputeRoute: true
+            http:
+              authority: primary.foo.com
+              destination:
+                name: securitypolicy/default/policy-for-gateway-1/envoy-gateway/http-backend
+                settings:
+                  - addressType: FQDN
+                    endpoints:
+                      - host: primary.foo.com
+                        port: 80
+                    protocol: HTTP
+                    weight: 1
+              headersToBackend:
+                - header1
+                - header2
+              path: /auth
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.clusters.yaml
new file mode 100644
index 000000000..880f77a06
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.clusters.yaml
@@ -0,0 +1,112 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-1/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-1/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-1/rule/1
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-1/rule/1
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-2/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-2/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: primary.foo.com
+              portValue: 9000
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: securitypolicy/default/policy-for-http-route-1/default/grpc-backend/backend/0
+  name: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: securitypolicy/default/policy-for-gateway-1/envoy-gateway/http-backend
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: primary.foo.com
+              portValue: 80
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: securitypolicy/default/policy-for-gateway-1/envoy-gateway/http-backend/backend/0
+  name: securitypolicy/default/policy-for-gateway-1/envoy-gateway/http-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.endpoints.yaml
new file mode 100644
index 000000000..bf9f00237
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.endpoints.yaml
@@ -0,0 +1,36 @@
+- clusterName: httproute/default/httproute-1/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-1/rule/0/backend/0
+- clusterName: httproute/default/httproute-1/rule/1
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-1/rule/1/backend/0
+- clusterName: httproute/default/httproute-2/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-2/rule/0/backend/0
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.listeners.yaml
new file mode 100644
index 000000000..56cfa9ea5
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.listeners.yaml
@@ -0,0 +1,71 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_authz/securitypolicy/default/policy-for-http-route-1
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            allowedHeaders:
+              patterns:
+              - exact: header1
+                ignoreCase: true
+              - exact: header2
+                ignoreCase: true
+            grpcService:
+              envoyGrpc:
+                authority: primary.foo.com
+                clusterName: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
+              timeout: 10s
+            transportApiVersion: V3
+        - disabled: true
+          name: envoy.filters.http.ext_authz/securitypolicy/default/policy-for-gateway-1
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            clearRouteCache: true
+            failureModeAllow: true
+            httpService:
+              authorizationResponse:
+                allowedUpstreamHeaders:
+                  patterns:
+                  - exact: header1
+                    ignoreCase: true
+                  - exact: header2
+                    ignoreCase: true
+              pathPrefix: /auth
+              serverUri:
+                cluster: securitypolicy/default/policy-for-gateway-1/envoy-gateway/http-backend
+                timeout: 10s
+                uri: http://primary.foo.com/auth
+            transportApiVersion: V3
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: default/gateway-1/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http-10080
+        useRemoteAddress: true
+    name: default/gateway-1/http
+  drainType: MODIFY_ONLY
+  name: default/gateway-1/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.routes.yaml
new file mode 100644
index 000000000..08edfc3c4
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-auth-recomputation.routes.yaml
@@ -0,0 +1,44 @@
+- ignorePortInHostMatching: true
+  name: default/gateway-1/http
+  virtualHosts:
+  - domains:
+    - www.foo.com
+    name: default/gateway-1/http/www_foo_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /foo1
+      name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+      route:
+        cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz/securitypolicy/default/policy-for-http-route-1:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+    - match:
+        pathSeparatedPrefix: /foo2
+      name: httproute/default/httproute-1/rule/1/match/0/www_foo_com
+      route:
+        cluster: httproute/default/httproute-1/rule/1
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz/securitypolicy/default/policy-for-http-route-1:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+  - domains:
+    - www.bar.com
+    name: default/gateway-1/http/www_bar_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /bar
+      name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+      route:
+        cluster: httproute/default/httproute-2/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz/securitypolicy/default/policy-for-gateway-1:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 802efac58..4dc8b30f3 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -290,6 +290,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -353,6 +354,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -466,6 +468,7 @@ _Appears in:_
 | `targetRefs` | _[LocalPolicyTargetReferenceWithSectionName](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.LocalPolicyTargetReferenceWithSectionName) array_ |  true  | TargetRefs are the names of the Gateway resources this policy<br />is being attached to. |
 | `targetSelectors` | _[TargetSelector](#targetselector) array_ |  true  | TargetSelectors allow targeting resources for this policy based on labels |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
+| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -476,7 +479,6 @@ _Appears in:_
 | `http2` | _[HTTP2Settings](#http2settings)_ |  false  | HTTP2 provides HTTP/2 configuration for backend connections. |
 | `rateLimit` | _[RateLimitSpec](#ratelimitspec)_ |  false  | RateLimit allows the user to limit the number of incoming requests<br />to a predefined value based on attributes within the traffic flow. |
 | `faultInjection` | _[FaultInjection](#faultinjection)_ |  false  | FaultInjection defines the fault injection policy to be applied. This configuration can be used to<br />inject delays and abort requests to mimic failure scenarios such as service failures and overloads |
-| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `useClientProtocol` | _boolean_ |  false  | UseClientProtocol configures Envoy to prefer sending requests to backends using<br />the same HTTP protocol that the incoming request used. Defaults to false, which means<br />that Envoy will use the protocol indicated by the attached BackendRef. |
 
 
@@ -717,6 +719,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -724,6 +727,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
+| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -1473,6 +1477,7 @@ _Appears in:_
 | `http` | _[HTTPExtAuthService](#httpextauthservice)_ |  true  | HTTP defines the HTTP External Authorization service.<br />Either GRPCService or HTTPService must be specified,<br />and only one of them can be provided. |
 | `headersToExtAuth` | _string array_ |  false  | HeadersToExtAuth defines the client request headers that will be included<br />in the request to the external authorization service.<br />Note: If not specified, the default behavior for gRPC and HTTP external<br />authorization services is different due to backward compatibility reasons.<br />All headers will be included in the check request to a gRPC authorization server.<br />Only the following headers will be included in the check request to an HTTP<br />authorization server: Host, Method, Path, Content-Length, and Authorization.<br />And these headers will always be included to the check request to an HTTP<br />authorization server by default, no matter whether they are specified<br />in HeadersToExtAuth or not. |
 | `failOpen` | _boolean_ |  false  | FailOpen is a switch used to control the behavior when a response from the External Authorization service cannot be obtained.<br />If FailOpen is set to true, the system allows the traffic to pass through.<br />Otherwise, if it is set to false or not set (defaulting to false),<br />the system blocks the traffic and returns a HTTP 5xx error, reflecting a fail-closed approach.<br />This setting determines whether to prioritize accessibility over strict security in case of authorization service failure. |
+| `recomputeRoute` | _boolean_ |  false  | RecomputeRoute clears the route cache and recalculates the routing decision.<br />This field must be enabled if the headers added or modified by the ExtAuth are used for<br />route matching decisions. If the recomputation selects a new route, features targeting<br />the new matched route will be applied. |
 
 
 #### ExtProc
@@ -2566,6 +2571,9 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `issuer` | _string_ |  true  | The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).<br />Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST<br />be https, a host component, and optionally, port and path components and<br />no query or fragment components. |
 | `authorizationEndpoint` | _string_ |  false  | The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
 | `tokenEndpoint` | _string_ |  false  | The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
@@ -3309,20 +3317,6 @@ _Appears in:_
 | `File` | ResourceProviderTypeFile defines the "File" provider.<br /> | 
 
 
-#### Retry
-
-
-
-Retry defines the retry strategy to be applied.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `numRetries` | _integer_ |  false  | NumRetries is the number of retries to be attempted. Defaults to 2. |
-| `retryOn` | _[RetryOn](#retryon)_ |  false  | RetryOn specifies the retry trigger condition.<br /><br />If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503). |
-| `perRetry` | _[PerRetryPolicy](#perretrypolicy)_ |  false  | PerRetry is the retry policy to be applied per retry attempt. |
 
 
 #### RetryOn
diff --git a/site/content/en/latest/tasks/security/private-key-provider.md b/site/content/en/latest/tasks/security/private-key-provider.md
index 79f992aa5..529056b33 100644
--- a/site/content/en/latest/tasks/security/private-key-provider.md
+++ b/site/content/en/latest/tasks/security/private-key-provider.md
@@ -14,7 +14,9 @@ This task will walk you through the steps required to configure TLS Termination
 
 ## Prerequisites
 
-### For QAT
+{{< tabpane text=true >}}
+
+{{% tab header="QAT (Intel QuickAssist Technology)" %}}
 
 - Install Linux kernel 5.17 or similar
 - Ensure the node has QAT devices by checking the QAT physical function devices presented. [Supported Devices](https://intel.github.io/quickassist/qatlib/requirements.html#qat2-0-qatlib-supported-devices)
@@ -88,7 +90,9 @@ This task will walk you through the steps required to configure TLS Termination
   kubectl get node -o yaml| grep qat.intel.com
   ```
 
-### For CryptoMB:
+{{% /tab %}}
+
+{{% tab header="CryptoMB" %}}
 
 It required the node with 3rd generation Intel Xeon Scalable processor server processors, or later.
 - For kubernetes Cluster, if not all nodes that support Intel® AVX-512 in Kubernetes cluster, you need to add some labels to divide these two kinds of nodes manually or using [NFD](https://github.com/kubernetes-sigs/node-feature-discovery).
@@ -110,6 +114,10 @@ It required the node with 3rd generation Intel Xeon Scalable processor server pr
     cat /proc/cpuinfo |grep avx512f|grep avx512dq|grep avx512bw|grep avx512_vbmi2|grep avx512ifma
     ```
 
+{{% /tab %}}
+
+{{< /tabpane >}}
+
 ## Installation
 
 * Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway.
@@ -214,10 +222,14 @@ spec:
 {{% /tab %}}
 {{< /tabpane >}}
 
-### Change EnvoyProxy configuration for QAT
+## Change EnvoyProxy configuration
 
 Using the envoyproxy image with contrib extensions and add qat resources requesting, ensure the k8s scheduler find out a machine with required resource.
 
+{{< tabpane text=true >}}
+
+{{% tab header="QAT (Intel QuickAssist Technology)" %}}
+
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
 
@@ -285,7 +297,9 @@ spec:
 {{% /tab %}}
 {{< /tabpane >}}
 
-### Change EnvoyProxy configuration for CryptoMB
+{{% /tab %}}
+
+{{% tab header="CryptoMB" %}}
 
 Using the envoyproxy image with contrib extensions and add the node affinity to scheduling the Envoy Gateway pod on the machine with required CPU instructions.
 
@@ -386,9 +400,11 @@ spec:
 
 Or using `preferredDuringSchedulingIgnoredDuringExecution` for best effort scheduling, or not doing any node affinity, just doing the random scheduling. The CryptoMB private key provider supports software fallback if the required CPU instructions aren't here.
 
-## Apply EnvoyPatchPolicy to enable private key provider
+{{% /tab %}}
 
-### Benchmark before enabling private key provider
+{{< /tabpane >}}
+
+## Benchmark before enabling private key provider
 
 First follow the instructions in [TLS Termination for TCP](./tls-termination) to do the functionality test.
 
@@ -416,7 +432,11 @@ Benchmark the gateway with fortio.
 fortio load -c 10 -k -qps 0 -t 30s -keepalive=false https://www.example.com:${NODE_PORT}
 ```
 
-### For QAT
+## Apply EnvoyPatchPolicy to enable private key provider
+
+{{< tabpane text=true >}}
+
+{{% tab header="QAT (Intel QuickAssist Technology)" %}}
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
@@ -501,7 +521,9 @@ spec:
 {{% /tab %}}
 {{< /tabpane >}}
 
-### For CryptoMB
+{{% /tab %}}
+
+{{% tab header="CryptoMB" %}}
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
@@ -586,7 +608,11 @@ spec:
 {{% /tab %}}
 {{< /tabpane >}}
 
-### Benchmark after enabling private key provider
+{{% /tab %}}
+
+{{< /tabpane >}}
+
+## Benchmark after enabling private key provider
 
 First follow the instructions in [TLS Termination for TCP](./tls-termination) to do the functionality test again.
 
@@ -596,6 +622,8 @@ Benchmark the gateway with fortio.
 fortio load -c 64 -k -qps 0 -t 30s -keepalive=false https://www.example.com:${NODE_PORT}
 ```
 
+## Benchmark Result
+
 You will see a performance boost after private key provider enabled. For example, you will get results as below.
 
 Without private key provider:
@@ -604,14 +632,26 @@ Without private key provider:
 All done 43069 calls (plus 10 warmup) 6.966 ms avg, 1435.4 qps
 ```
 
-With CryptoMB private key provider, the QPS is over 2 times than without private key provider.
+{{< tabpane text=true >}}
 
-```shell
-All done 93983 calls (plus 128 warmup) 40.880 ms avg, 3130.5 qps
-```
+{{% tab header="QAT (Intel QuickAssist Technology)" %}}
 
 With QAT private key provider, the QPS is over 3 times than without private key provider
 
 ```shell
 All done 134746 calls (plus 128 warmup) 28.505 ms avg, 4489.6 qps
 ```
+
+{{% /tab %}}
+
+{{% tab header="CryptoMB" %}}
+
+With CryptoMB private key provider, the QPS is over 2 times than without private key provider.
+
+```shell
+All done 93983 calls (plus 128 warmup) 40.880 ms avg, 3130.5 qps
+```
+
+{{% /tab %}}
+
+{{< /tabpane >}}
diff --git a/site/content/zh/latest/api/extension_types.md b/site/content/zh/latest/api/extension_types.md
index 802efac58..4dc8b30f3 100644
--- a/site/content/zh/latest/api/extension_types.md
+++ b/site/content/zh/latest/api/extension_types.md
@@ -290,6 +290,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -353,6 +354,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -466,6 +468,7 @@ _Appears in:_
 | `targetRefs` | _[LocalPolicyTargetReferenceWithSectionName](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.LocalPolicyTargetReferenceWithSectionName) array_ |  true  | TargetRefs are the names of the Gateway resources this policy<br />is being attached to. |
 | `targetSelectors` | _[TargetSelector](#targetselector) array_ |  true  | TargetSelectors allow targeting resources for this policy based on labels |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
+| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -476,7 +479,6 @@ _Appears in:_
 | `http2` | _[HTTP2Settings](#http2settings)_ |  false  | HTTP2 provides HTTP/2 configuration for backend connections. |
 | `rateLimit` | _[RateLimitSpec](#ratelimitspec)_ |  false  | RateLimit allows the user to limit the number of incoming requests<br />to a predefined value based on attributes within the traffic flow. |
 | `faultInjection` | _[FaultInjection](#faultinjection)_ |  false  | FaultInjection defines the fault injection policy to be applied. This configuration can be used to<br />inject delays and abort requests to mimic failure scenarios such as service failures and overloads |
-| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `useClientProtocol` | _boolean_ |  false  | UseClientProtocol configures Envoy to prefer sending requests to backends using<br />the same HTTP protocol that the incoming request used. Defaults to false, which means<br />that Envoy will use the protocol indicated by the attached BackendRef. |
 
 
@@ -717,6 +719,7 @@ _Appears in:_
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
 - [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
 - [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
 - [TracingProvider](#tracingprovider)
@@ -724,6 +727,7 @@ _Appears in:_
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
+| `retry` | _[Retry](#retry)_ |  false  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -1473,6 +1477,7 @@ _Appears in:_
 | `http` | _[HTTPExtAuthService](#httpextauthservice)_ |  true  | HTTP defines the HTTP External Authorization service.<br />Either GRPCService or HTTPService must be specified,<br />and only one of them can be provided. |
 | `headersToExtAuth` | _string array_ |  false  | HeadersToExtAuth defines the client request headers that will be included<br />in the request to the external authorization service.<br />Note: If not specified, the default behavior for gRPC and HTTP external<br />authorization services is different due to backward compatibility reasons.<br />All headers will be included in the check request to a gRPC authorization server.<br />Only the following headers will be included in the check request to an HTTP<br />authorization server: Host, Method, Path, Content-Length, and Authorization.<br />And these headers will always be included to the check request to an HTTP<br />authorization server by default, no matter whether they are specified<br />in HeadersToExtAuth or not. |
 | `failOpen` | _boolean_ |  false  | FailOpen is a switch used to control the behavior when a response from the External Authorization service cannot be obtained.<br />If FailOpen is set to true, the system allows the traffic to pass through.<br />Otherwise, if it is set to false or not set (defaulting to false),<br />the system blocks the traffic and returns a HTTP 5xx error, reflecting a fail-closed approach.<br />This setting determines whether to prioritize accessibility over strict security in case of authorization service failure. |
+| `recomputeRoute` | _boolean_ |  false  | RecomputeRoute clears the route cache and recalculates the routing decision.<br />This field must be enabled if the headers added or modified by the ExtAuth are used for<br />route matching decisions. If the recomputation selects a new route, features targeting<br />the new matched route will be applied. |
 
 
 #### ExtProc
@@ -2566,6 +2571,9 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  false  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `issuer` | _string_ |  true  | The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).<br />Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST<br />be https, a host component, and optionally, port and path components and<br />no query or fragment components. |
 | `authorizationEndpoint` | _string_ |  false  | The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
 | `tokenEndpoint` | _string_ |  false  | The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
@@ -3309,20 +3317,6 @@ _Appears in:_
 | `File` | ResourceProviderTypeFile defines the "File" provider.<br /> | 
 
 
-#### Retry
-
-
-
-Retry defines the retry strategy to be applied.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `numRetries` | _integer_ |  false  | NumRetries is the number of retries to be attempted. Defaults to 2. |
-| `retryOn` | _[RetryOn](#retryon)_ |  false  | RetryOn specifies the retry trigger condition.<br /><br />If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503). |
-| `perRetry` | _[PerRetryPolicy](#perretrypolicy)_ |  false  | PerRetry is the retry policy to be applied per retry attempt. |
 
 
 #### RetryOn
diff --git a/test/e2e/tests/backend_tls_settings.go b/test/e2e/tests/backend_tls_settings.go
index 404b50e6d..0fdbdf10d 100644
--- a/test/e2e/tests/backend_tls_settings.go
+++ b/test/e2e/tests/backend_tls_settings.go
@@ -301,7 +301,7 @@ func restartDeploymentAndWaitForRollout(t *testing.T, timeoutConfig config.Timeo
 		}
 
 		// all pods are rolled
-		if rolled == int32(len(podList.Items)) && rolled >= *dp.Spec.Replicas { // nolint: gosec
+		if rolled == int32(len(podList.Items)) && rolled >= *dp.Spec.Replicas {
 			return true, nil
 		}
 
diff --git a/test/e2e/tests/envoy_shutdown.go b/test/e2e/tests/envoy_shutdown.go
index 58b3cdae4..6b5a35f49 100644
--- a/test/e2e/tests/envoy_shutdown.go
+++ b/test/e2e/tests/envoy_shutdown.go
@@ -163,7 +163,7 @@ func restartProxyAndWaitForRollout(t *testing.T, timeoutConfig config.TimeoutCon
 		}
 
 		// all pods are rolled
-		if rolled == int32(len(podList.Items)) && rolled >= *dp.Spec.Replicas { // nolint: gosec
+		if rolled == int32(len(podList.Items)) && rolled >= *dp.Spec.Replicas {
 			return true, nil
 		}