Repository: envoyproxy/gateway

Issue:
Graceful shutdown is not working as expected with default setup.
*Description*:
I'm working on implementing envoy-gateway as a replacement for our nginx controller.  I have some basic tests, a pod that returns a json block when hit an endpoint.  Using K6 as a testing sweet. I set up the following test.

```js
import http from 'k6/http';
import { sleep } from 'k6';

export const options = {
  stages: [
    { duration: '2m', target: 50 }, // ramp-up to 50 users
    { duration: '6m', target: 50 }, // stay at 50 users
    { duration: '2m', target: 0 },  // ramp-down to 0 users
  ],
};

export default function () {
  http.get(<url>/);
  sleep(1);
}
````

When I run this test and start a rollout restart of the envoy pods. I get the following errors

```sh
WARN[0070] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49547-><valid public address>:443: read: connection reset by peer"
WARN[0070] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49570-><valid public address>:443: read: connection reset by peer"
WARN[0071] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49587-><valid public address>:443: read: connection reset by peer"
WARN[0080] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49573-><valid public address>:443: read: connection reset by peer"
WARN[0080] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49601-><valid public address>:443: read: connection reset by peer"
WARN[0080] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49594-><valid public address>:443: read: connection reset by peer"
WARN[0080] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49555-><valid public address>:443: read: connection reset by peer"
WARN[0080] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49595-><valid public address>:443: read: connection reset by peer"
WARN[0080] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49589-><valid public address>:443: read: connection reset by peer"
WARN[0082] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49572-><valid public address>:443: read: connection reset by peer"
WARN[0082] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49563-><valid public address>:443: read: connection reset by peer"
WARN[0083] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49566-><valid public address>:443: read: connection reset by peer"
WARN[0488] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49619-><valid public address>:443: read: connection reset by peer"
WARN[0489] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49636-><valid public address>:443: read: connection reset by peer"
WARN[0489] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49623-><valid public address>:443: read: connection reset by peer"
WARN[0489] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49667-><valid public address>:443: read: connection reset by peer"
WARN[0489] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49611-><valid public address>:443: read: connection reset by peer"
WARN[0489] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49604-><valid public address>:443: read: connection reset by peer"
WARN[0489] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49637-><valid public address>:443: read: connection reset by peer"
WARN[0489] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49649-><valid public address>:443: read: connection reset by peer"
WARN[0498] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49642-><valid public address>:443: read: connection reset by peer"
WARN[0498] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49624-><valid public address>:443: read: connection reset by peer"
WARN[0498] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49598-><valid public address>:443: read: connection reset by peer"
WARN[0498] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49830-><valid public address>:443: read: connection reset by peer"
WARN[0498] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49634-><valid public address>:443: read: connection reset by peer"
WARN[0498] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49617-><valid public address>:443: read: connection reset by peer"
WARN[0502] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49643-><valid public address>:443: read: connection reset by peer"
WARN[0502] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49651-><valid public address>:443: read: connection reset by peer"
WARN[0503] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49630-><valid public address>:443: read: connection reset by peer"
WARN[0503] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49660-><valid public address>:443: read: connection reset by peer"
WARN[0503] Request Failed                                error="Get \"<url>": read tcp 192.168.1.99:49613-><valid public address>:443: read: connection reset by peer"

[optional *Relevant Links*:]
```

When I do this on nginx I do not get these errors. 

I added these to my custom proxy config and it seemed to fix the issue
``sh
shutdown:
    drainTimeout: 600s
    minDrainDuration: 60s
```
However there's no documentation on this. I happened to find it with kube-explain

I'm on v1.0.1
>Any extra documentation required to understand the issue.


Hints from issue comments:
@arkodg: @davem-git which L3/L4 load balancer are you using ? have you setup health checks ?@davem-git: I'm hosted in azure and gcp. Those test ended with the similar results on both clouds @arkodg: you'll need to setup health checks on the load balancer so they can stop routing to the envoy that is shutting down (draining), the first step when shutting dowm is failing health checks so the LB can route newer connections to a newer envoy pod
* either use the global one in envoy (`/ready` on port 19001)
* or a listener specific one (only available on v1.1) https://gateway.envoyproxy.io/docs/api/extension_types/#healthchecksettings@davem-git: How are these set? @davem-git: any documentation? envoy gateway stands up these load balancers. I see I can set annotations, but I don't see any annotations for health checks for gcp. @arkodg: I do see some health check info for 
* Azure
https://cloud-provider-azure.sigs.k8s.io/topics/loadbalancer/#custom-load-balancer-health-probe
https://cloud-provider-azure.sigs.k8s.io/topics/loadbalancer/#loadbalancer-annotations
* AWS
https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.3/guide/service/annotations/#health-check
@arkodg: hey @davem-git we just merged https://github.com/envoyproxy/gateway/pull/4021 that should help you with graceful shutdown on GKE with the default settings (no settings), you can try it out by using the `v0.0.0-latest` tag of. the helm chart@arkodg: hey @davem-git did you get a chance to try this out ? @davem-git: I've looked around and haven't found those settings for all of our cloud providers. I will test it out on azure today. So far though adding those settings I listed above seemed to have helped from my testing @arkodg: @davem-git with #4021 (which is now available with `v0.0.0-latest`) you may not need explicit health checks because we've reduced the time to detect failure for the envoy endpoints@ncsham: hey @arkodg  , just a basic doubt

is there no need for adding pod readiness gates on namespace where envoy proxies are running(proxies receiving traffic via nlb or alb) like for eg. on eks with aws-load-balancer-controller running,  ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/pod_readiness_gate/ @davem-git: I tried testing this, The health checks failed to work. Envoy-proxy didn't function. I reverted @arkodg: > hey @arkodg , just a basic doubt
> 
> is there no need for adding pod readiness gates on namespace where envoy proxies are running(proxies receiving traffic via nlb or alb) like for eg. on eks with aws-load-balancer-controller running, ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/pod_readiness_gate/

@ncsham afaik the controller is reading the endpoint slices of the service from the API server and will detect any endpoints that are down (whose `readinessProbe` has failed) and shouldnt route to them@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.@davem-git: This is no longer an issue the past few upgrades have gone smoothly no interuptions 

Solution patch:
diff --git a/api/v1alpha1/accesslogging_types.go b/api/v1alpha1/accesslogging_types.go
index 242725644..78b78a485 100644
--- a/api/v1alpha1/accesslogging_types.go
+++ b/api/v1alpha1/accesslogging_types.go
@@ -123,15 +123,13 @@ const (
 // - `x-accesslog-attr` - JSON encoded key/value pairs when a JSON format is used.
 //
 // +kubebuilder:validation:XValidation:rule="self.type == 'HTTP' || !has(self.http)",message="The http field may only be set when type is HTTP."
+// +kubebuilder:validation:XValidation:message="BackendRefs must be used, backendRef is not supported.",rule="!has(self.backendRef)"
+// +kubebuilder:validation:XValidation:message="must have at least one backend in backendRefs",rule="has(self.backendRefs) && self.backendRefs.size() > 0"
+// +kubebuilder:validation:XValidation:message="BackendRefs only supports Service kind.",rule="has(self.backendRefs) ? self.backendRefs.all(f, f.kind == 'Service') : true"
+// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="has(self.backendRefs) ? (self.backendRefs.all(f, f.group == \"\")) : true"
 type ALSEnvoyProxyAccessLog struct {
-	// BackendRefs references a Kubernetes object that represents the gRPC service to which
-	// the access logs will be sent. Currently only Service is supported.
-	//
-	// +kubebuilder:validation:MinItems=1
-	// +kubebuilder:validation:MaxItems=1
-	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Service kind.",rule="self.all(f, f.kind == 'Service')"
-	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
-	BackendRefs []BackendRef `json:"backendRefs"`
+	BackendCluster `json:",inline"`
+
 	// LogName defines the friendly name of the access log to be returned in
 	// StreamAccessLogsMessage.Identifier. This allows the access log server
 	// to differentiate between different access logs coming from the same Envoy.
@@ -167,7 +165,11 @@ type FileEnvoyProxyAccessLog struct {
 // OpenTelemetryEnvoyProxyAccessLog defines the OpenTelemetry access log sink.
 //
 // +kubebuilder:validation:XValidation:message="host or backendRefs needs to be set",rule="has(self.host) || self.backendRefs.size() > 0"
+// +kubebuilder:validation:XValidation:message="BackendRefs must be used, backendRef is not supported.",rule="!has(self.backendRef)"
+// +kubebuilder:validation:XValidation:message="BackendRefs only supports Service kind.",rule="has(self.backendRefs) ? self.backendRefs.all(f, f.kind == 'Service') : true"
+// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="has(self.backendRefs) ? (self.backendRefs.all(f, f.group == \"\")) : true"
 type OpenTelemetryEnvoyProxyAccessLog struct {
+	BackendCluster `json:",inline"`
 	// Host define the extension service hostname.
 	// Deprecated: Use BackendRefs instead.
 	//
@@ -180,15 +182,6 @@ type OpenTelemetryEnvoyProxyAccessLog struct {
 	// +kubebuilder:validation:Minimum=0
 	// +kubebuilder:default=4317
 	Port int32 `json:"port,omitempty"`
-	// BackendRefs references a Kubernetes object that represents the
-	// backend server to which the access log will be sent.
-	// Only Service kind is supported for now.
-	//
-	// +optional
-	// +kubebuilder:validation:MaxItems=1
-	// +kubebuilder:validation:XValidation:message="only support Service kind.",rule="self.all(f, f.kind == 'Service')"
-	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
-	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
 	// Resources is a set of labels that describe the source of a log entry, including envoy node info.
 	// It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/).
 	// +optional
diff --git a/api/v1alpha1/envoyproxy_metric_types.go b/api/v1alpha1/envoyproxy_metric_types.go
index 8791ddbd4..0e571ef23 100644
--- a/api/v1alpha1/envoyproxy_metric_types.go
+++ b/api/v1alpha1/envoyproxy_metric_types.go
@@ -15,6 +15,7 @@ type ProxyMetrics struct {
 	// Prometheus defines the configuration for Admin endpoint `/stats/prometheus`.
 	Prometheus *ProxyPrometheusProvider `json:"prometheus,omitempty"`
 	// Sinks defines the metric sinks where metrics are sent to.
+	// +kubebuilder:validation:MaxItems=16
 	Sinks []ProxyMetricSink `json:"sinks,omitempty"`
 	// Matches defines configuration for selecting specific metrics instead of generating all metrics stats
 	// that are enabled by default. This helps reduce CPU and memory overhead in Envoy, but eliminating some stats
@@ -54,7 +55,11 @@ type ProxyMetricSink struct {
 // ProxyOpenTelemetrySink defines the configuration for OpenTelemetry sink.
 //
 // +kubebuilder:validation:XValidation:message="host or backendRefs needs to be set",rule="has(self.host) || self.backendRefs.size() > 0"
+// +kubebuilder:validation:XValidation:message="BackendRefs must be used, backendRef is not supported.",rule="!has(self.backendRef)"
+// +kubebuilder:validation:XValidation:message="only supports Service kind.",rule="has(self.backendRefs) ? self.backendRefs.all(f, f.kind == 'Service') : true"
+// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="has(self.backendRefs) ? (self.backendRefs.all(f, f.group == \"\")) : true"
 type ProxyOpenTelemetrySink struct {
+	BackendCluster `json:",inline"`
 	// Host define the service hostname.
 	// Deprecated: Use BackendRefs instead.
 	//
@@ -68,15 +73,6 @@ type ProxyOpenTelemetrySink struct {
 	// +kubebuilder:validation:Maximum=65535
 	// +kubebuilder:default=4317
 	Port int32 `json:"port,omitempty"`
-	// BackendRefs references a Kubernetes object that represents the
-	// backend server to which the metric will be sent.
-	// Only Service kind is supported for now.
-	//
-	// +optional
-	// +kubebuilder:validation:MaxItems=1
-	// +kubebuilder:validation:XValidation:message="only support Service kind.",rule="self.all(f, f.kind == 'Service')"
-	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
-	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
 
 	// TODO: add support for customizing OpenTelemetry sink in https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/stat_sinks/open_telemetry/v3/open_telemetry.proto#envoy-v3-api-msg-extensions-stat-sinks-open-telemetry-v3-sinkconfig
 }
diff --git a/api/v1alpha1/tracing_types.go b/api/v1alpha1/tracing_types.go
index b7be478de..55fd63ef4 100644
--- a/api/v1alpha1/tracing_types.go
+++ b/api/v1alpha1/tracing_types.go
@@ -31,7 +31,11 @@ const (
 // TracingProvider defines the tracing provider configuration.
 //
 // +kubebuilder:validation:XValidation:message="host or backendRefs needs to be set",rule="has(self.host) || self.backendRefs.size() > 0"
+// +kubebuilder:validation:XValidation:message="BackendRefs must be used, backendRef is not supported.",rule="!has(self.backendRef)"
+// +kubebuilder:validation:XValidation:message="only supports Service kind.",rule="has(self.backendRefs) ? self.backendRefs.all(f, f.kind == 'Service') : true"
+// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="has(self.backendRefs) ? (self.backendRefs.all(f, f.group == \"\")) : true"
 type TracingProvider struct {
+	BackendCluster `json:",inline"`
 	// Type defines the tracing provider type.
 	// +kubebuilder:validation:Enum=OpenTelemetry;Zipkin
 	// +kubebuilder:default=OpenTelemetry
@@ -48,15 +52,6 @@ type TracingProvider struct {
 	// +kubebuilder:validation:Minimum=0
 	// +kubebuilder:default=4317
 	Port int32 `json:"port,omitempty"`
-	// BackendRefs references a Kubernetes object that represents the
-	// backend server to which the trace will be sent.
-	// Only Service kind is supported for now.
-	//
-	// +optional
-	// +kubebuilder:validation:MaxItems=1
-	// +kubebuilder:validation:XValidation:message="only support Service kind.",rule="self.all(f, f.kind == 'Service')"
-	// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core group.",rule="self.all(f, f.group == '')"
-	BackendRefs []BackendRef `json:"backendRefs,omitempty"`
 	// Zipkin defines the Zipkin tracing provider configuration
 	// +optional
 	Zipkin *ZipkinTracingProvider `json:"zipkin,omitempty"`
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index c8f7a5711..ad7236580 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -23,13 +23,7 @@ import (
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ALSEnvoyProxyAccessLog) DeepCopyInto(out *ALSEnvoyProxyAccessLog) {
 	*out = *in
-	if in.BackendRefs != nil {
-		in, out := &in.BackendRefs, &out.BackendRefs
-		*out = make([]BackendRef, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
+	in.BackendCluster.DeepCopyInto(&out.BackendCluster)
 	if in.LogName != nil {
 		in, out := &in.LogName, &out.LogName
 		*out = new(string)
@@ -3552,18 +3546,12 @@ func (in *OIDCProvider) DeepCopy() *OIDCProvider {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OpenTelemetryEnvoyProxyAccessLog) DeepCopyInto(out *OpenTelemetryEnvoyProxyAccessLog) {
 	*out = *in
+	in.BackendCluster.DeepCopyInto(&out.BackendCluster)
 	if in.Host != nil {
 		in, out := &in.Host, &out.Host
 		*out = new(string)
 		**out = **in
 	}
-	if in.BackendRefs != nil {
-		in, out := &in.BackendRefs, &out.BackendRefs
-		*out = make([]BackendRef, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
 	if in.Resources != nil {
 		in, out := &in.Resources, &out.Resources
 		*out = make(map[string]string, len(*in))
@@ -3967,18 +3955,12 @@ func (in *ProxyMetrics) DeepCopy() *ProxyMetrics {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ProxyOpenTelemetrySink) DeepCopyInto(out *ProxyOpenTelemetrySink) {
 	*out = *in
+	in.BackendCluster.DeepCopyInto(&out.BackendCluster)
 	if in.Host != nil {
 		in, out := &in.Host, &out.Host
 		*out = new(string)
 		**out = **in
 	}
-	if in.BackendRefs != nil {
-		in, out := &in.BackendRefs, &out.BackendRefs
-		*out = make([]BackendRef, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyOpenTelemetrySink.
@@ -4860,18 +4842,12 @@ func (in *Timeout) DeepCopy() *Timeout {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TracingProvider) DeepCopyInto(out *TracingProvider) {
 	*out = *in
+	in.BackendCluster.DeepCopyInto(&out.BackendCluster)
 	if in.Host != nil {
 		in, out := &in.Host, &out.Host
 		*out = new(string)
 		**out = **in
 	}
-	if in.BackendRefs != nil {
-		in, out := &in.BackendRefs, &out.BackendRefs
-		*out = make([]BackendRef, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
 	if in.Zipkin != nil {
 		in, out := &in.Zipkin, &out.Zipkin
 		*out = new(ZipkinTracingProvider)
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 74438fea2..074331840 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -10303,10 +10303,91 @@ spec:
                                     description: ALS defines the gRPC Access Log Service
                                       (ALS) sink.
                                     properties:
+                                      backendRef:
+                                        description: |-
+                                          BackendRef references a Kubernetes object that represents the
+                                          backend server to which the authorization request will be sent.
+
+
+                                          Deprecated: Use BackendRefs instead.
+                                        properties:
+                                          group:
+                                            default: ""
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When unspecified or empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            default: Service
+                                            description: |-
+                                              Kind is the Kubernetes resource kind of the referent. For example
+                                              "Service".
+
+
+                                              Defaults to "Service" when not specified.
+
+
+                                              ExternalName services can refer to CNAME DNS records that may live
+                                              outside of the cluster and as such are difficult to reason about in
+                                              terms of conformance. They also may not be safe to forward to (see
+                                              CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                              support ExternalName Services.
+
+
+                                              Support: Core (Services with a type other than ExternalName)
+
+
+                                              Support: Implementation-specific (Services with type ExternalName)
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the backend. When unspecified, the local
+                                              namespace is inferred.
+
+
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+
+
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                          port:
+                                            description: |-
+                                              Port specifies the destination port number to use for this resource.
+                                              Port is required when the referent is a Kubernetes Service. In this
+                                              case, the port number is the service port number, not the target port.
+                                              For other resources, destination port might be derived from the referent
+                                              resource or this field.
+                                            format: int32
+                                            maximum: 65535
+                                            minimum: 1
+                                            type: integer
+                                        required:
+                                        - name
+                                        type: object
+                                        x-kubernetes-validations:
+                                        - message: Must have port for Service reference
+                                          rule: '(size(self.group) == 0 && self.kind
+                                            == ''Service'') ? has(self.port) : true'
                                       backendRefs:
                                         description: |-
-                                          BackendRefs references a Kubernetes object that represents the gRPC service to which
-                                          the access logs will be sent. Currently only Service is supported.
+                                          BackendRefs references a Kubernetes object that represents the
+                                          backend server to which the authorization request will be sent.
                                         items:
                                           description: BackendRef defines how an ObjectReference
                                             that is specific to BackendRef.
@@ -10385,16 +10466,642 @@ spec:
                                           - message: Must have port for Service reference
                                             rule: '(size(self.group) == 0 && self.kind
                                               == ''Service'') ? has(self.port) : true'
-                                        maxItems: 1
-                                        minItems: 1
+                                        maxItems: 16
                                         type: array
-                                        x-kubernetes-validations:
-                                        - message: BackendRefs only supports Service
-                                            kind.
-                                          rule: self.all(f, f.kind == 'Service')
-                                        - message: BackendRefs only supports Core
-                                            group.
-                                          rule: self.all(f, f.group == '')
+                                      backendSettings:
+                                        description: |-
+                                          BackendSettings holds configuration for managing the connection
+                                          to the backend.
+                                        properties:
+                                          circuitBreaker:
+                                            description: |-
+                                              Circuit Breaker settings for the upstream connections and requests.
+                                              If not set, circuit breakers will be enabled with the default thresholds
+                                            properties:
+                                              maxConnections:
+                                                default: 1024
+                                                description: The maximum number of
+                                                  connections that Envoy will establish
+                                                  to the referenced backend defined
+                                                  within a xRoute rule.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                              maxParallelRequests:
+                                                default: 1024
+                                                description: The maximum number of
+                                                  parallel requests that Envoy will
+                                                  make to the referenced backend defined
+                                                  within a xRoute rule.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                              maxParallelRetries:
+                                                default: 1024
+                                                description: The maximum number of
+                                                  parallel retries that Envoy will
+                                                  make to the referenced backend defined
+                                                  within a xRoute rule.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                              maxPendingRequests:
+                                                default: 1024
+                                                description: The maximum number of
+                                                  pending requests that Envoy will
+                                                  queue to the referenced backend
+                                                  defined within a xRoute rule.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                              maxRequestsPerConnection:
+                                                description: |-
+                                                  The maximum number of requests that Envoy will make over a single connection to the referenced backend defined within a xRoute rule.
+                                                  Default: unlimited.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                            type: object
+                                          connection:
+                                            description: Connection includes backend
+                                              connection settings.
+                                            properties:
+                                              bufferLimit:
+                                                allOf:
+                                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                description: |-
+                                                  BufferLimit Soft limit on size of the cluster’s connections read and write buffers.
+                                                  BufferLimit applies to connection streaming (maybe non-streaming) channel between processes, it's in user space.
+                                                  If unspecified, an implementation defined default is applied (32768 bytes).
+                                                  For example, 20Mi, 1Gi, 256Ki etc.
+                                                  Note: that when the suffix is not provided, the value is interpreted as bytes.
+                                                x-kubernetes-int-or-string: true
+                                              socketBufferLimit:
+                                                allOf:
+                                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                description: |-
+                                                  SocketBufferLimit provides configuration for the maximum buffer size in bytes for each socket
+                                                  to backend.
+                                                  SocketBufferLimit applies to socket streaming channel between TCP/IP stacks, it's in kernel space.
+                                                  For example, 20Mi, 1Gi, 256Ki etc.
+                                                  Note that when the suffix is not provided, the value is interpreted as bytes.
+                                                x-kubernetes-int-or-string: true
+                                            type: object
+                                          dns:
+                                            description: DNS includes dns resolution
+                                              settings.
+                                            properties:
+                                              dnsRefreshRate:
+                                                description: |-
+                                                  DNSRefreshRate specifies the rate at which DNS records should be refreshed.
+                                                  Defaults to 30 seconds.
+                                                type: string
+                                              respectDnsTtl:
+                                                description: |-
+                                                  RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.
+                                                  If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.
+                                                  Defaults to true.
+                                                type: boolean
+                                            type: object
+                                          healthCheck:
+                                            description: HealthCheck allows gateway
+                                              to perform active health checking on
+                                              backends.
+                                            properties:
+                                              active:
+                                                description: Active health check configuration
+                                                properties:
+                                                  healthyThreshold:
+                                                    default: 1
+                                                    description: HealthyThreshold
+                                                      defines the number of healthy
+                                                      health checks required before
+                                                      a backend host is marked healthy.
+                                                    format: int32
+                                                    minimum: 1
+                                                    type: integer
+                                                  http:
+                                                    description: |-
+                                                      HTTP defines the configuration of http health checker.
+                                                      It's required while the health checker type is HTTP.
+                                                    properties:
+                                                      expectedResponse:
+                                                        description: ExpectedResponse
+                                                          defines a list of HTTP expected
+                                                          responses to match.
+                                                        properties:
+                                                          binary:
+                                                            description: Binary payload
+                                                              base64 encoded.
+                                                            format: byte
+                                                            type: string
+                                                          text:
+                                                            description: Text payload
+                                                              in plain text.
+                                                            type: string
+                                                          type:
+                                                            allOf:
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            description: Type defines
+                                                              the type of the payload.
+                                                            type: string
+                                                        required:
+                                                        - type
+                                                        type: object
+                                                        x-kubernetes-validations:
+                                                        - message: If payload type
+                                                            is Text, text field needs
+                                                            to be set.
+                                                          rule: 'self.type == ''Text''
+                                                            ? has(self.text) : !has(self.text)'
+                                                        - message: If payload type
+                                                            is Binary, binary field
+                                                            needs to be set.
+                                                          rule: 'self.type == ''Binary''
+                                                            ? has(self.binary) : !has(self.binary)'
+                                                      expectedStatuses:
+                                                        description: |-
+                                                          ExpectedStatuses defines a list of HTTP response statuses considered healthy.
+                                                          Defaults to 200 only
+                                                        items:
+                                                          description: HTTPStatus
+                                                            defines the http status
+                                                            code.
+                                                          exclusiveMaximum: true
+                                                          maximum: 600
+                                                          minimum: 100
+                                                          type: integer
+                                                        type: array
+                                                      method:
+                                                        description: |-
+                                                          Method defines the HTTP method used for health checking.
+                                                          Defaults to GET
+                                                        type: string
+                                                      path:
+                                                        description: Path defines
+                                                          the HTTP path that will
+                                                          be requested during health
+                                                          checking.
+                                                        maxLength: 1024
+                                                        minLength: 1
+                                                        type: string
+                                                    required:
+                                                    - path
+                                                    type: object
+                                                  interval:
+                                                    default: 3s
+                                                    description: Interval defines
+                                                      the time between active health
+                                                      checks.
+                                                    format: duration
+                                                    type: string
+                                                  tcp:
+                                                    description: |-
+                                                      TCP defines the configuration of tcp health checker.
+                                                      It's required while the health checker type is TCP.
+                                                    properties:
+                                                      receive:
+                                                        description: Receive defines
+                                                          the expected response payload.
+                                                        properties:
+                                                          binary:
+                                                            description: Binary payload
+                                                              base64 encoded.
+                                                            format: byte
+                                                            type: string
+                                                          text:
+                                                            description: Text payload
+                                                              in plain text.
+                                                            type: string
+                                                          type:
+                                                            allOf:
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            description: Type defines
+                                                              the type of the payload.
+                                                            type: string
+                                                        required:
+                                                        - type
+                                                        type: object
+                                                        x-kubernetes-validations:
+                                                        - message: If payload type
+                                                            is Text, text field needs
+                                                            to be set.
+                                                          rule: 'self.type == ''Text''
+                                                            ? has(self.text) : !has(self.text)'
+                                                        - message: If payload type
+                                                            is Binary, binary field
+                                                            needs to be set.
+                                                          rule: 'self.type == ''Binary''
+                                                            ? has(self.binary) : !has(self.binary)'
+                                                      send:
+                                                        description: Send defines
+                                                          the request payload.
+                                                        properties:
+                                                          binary:
+                                                            description: Binary payload
+                                                              base64 encoded.
+                                                            format: byte
+                                                            type: string
+                                                          text:
+                                                            description: Text payload
+                                                              in plain text.
+                                                            type: string
+                                                          type:
+                                                            allOf:
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            description: Type defines
+                                                              the type of the payload.
+                                                            type: string
+                                                        required:
+                                                        - type
+                                                        type: object
+                                                        x-kubernetes-validations:
+                                                        - message: If payload type
+                                                            is Text, text field needs
+                                                            to be set.
+                                                          rule: 'self.type == ''Text''
+                                                            ? has(self.text) : !has(self.text)'
+                                                        - message: If payload type
+                                                            is Binary, binary field
+                                                            needs to be set.
+                                                          rule: 'self.type == ''Binary''
+                                                            ? has(self.binary) : !has(self.binary)'
+                                                    type: object
+                                                  timeout:
+                                                    default: 1s
+                                                    description: Timeout defines the
+                                                      time to wait for a health check
+                                                      response.
+                                                    format: duration
+                                                    type: string
+                                                  type:
+                                                    allOf:
+                                                    - enum:
+                                                      - HTTP
+                                                      - TCP
+                                                    - enum:
+                                                      - HTTP
+                                                      - TCP
+                                                    description: Type defines the
+                                                      type of health checker.
+                                                    type: string
+                                                  unhealthyThreshold:
+                                                    default: 3
+                                                    description: UnhealthyThreshold
+                                                      defines the number of unhealthy
+                                                      health checks required before
+                                                      a backend host is marked unhealthy.
+                                                    format: int32
+                                                    minimum: 1
+                                                    type: integer
+                                                required:
+                                                - type
+                                                type: object
+                                                x-kubernetes-validations:
+                                                - message: If Health Checker type
+                                                    is HTTP, http field needs to be
+                                                    set.
+                                                  rule: 'self.type == ''HTTP'' ? has(self.http)
+                                                    : !has(self.http)'
+                                                - message: If Health Checker type
+                                                    is TCP, tcp field needs to be
+                                                    set.
+                                                  rule: 'self.type == ''TCP'' ? has(self.tcp)
+                                                    : !has(self.tcp)'
+                                              passive:
+                                                description: Passive passive check
+                                                  configuration
+                                                properties:
+                                                  baseEjectionTime:
+                                                    default: 30s
+                                                    description: BaseEjectionTime
+                                                      defines the base duration for
+                                                      which a host will be ejected
+                                                      on consecutive failures.
+                                                    format: duration
+                                                    type: string
+                                                  consecutive5XxErrors:
+                                                    default: 5
+                                                    description: Consecutive5xxErrors
+                                                      sets the number of consecutive
+                                                      5xx errors triggering ejection.
+                                                    format: int32
+                                                    type: integer
+                                                  consecutiveGatewayErrors:
+                                                    default: 0
+                                                    description: ConsecutiveGatewayErrors
+                                                      sets the number of consecutive
+                                                      gateway errors triggering ejection.
+                                                    format: int32
+                                                    type: integer
+                                                  consecutiveLocalOriginFailures:
+                                                    default: 5
+                                                    description: |-
+                                                      ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.
+                                                      Parameter takes effect only when split_external_local_origin_errors is set to true.
+                                                    format: int32
+                                                    type: integer
+                                                  interval:
+                                                    default: 3s
+                                                    description: Interval defines
+                                                      the time between passive health
+                                                      checks.
+                                                    format: duration
+                                                    type: string
+                                                  maxEjectionPercent:
+                                                    default: 10
+                                                    description: MaxEjectionPercent
+                                                      sets the maximum percentage
+                                                      of hosts in a cluster that can
+                                                      be ejected.
+                                                    format: int32
+                                                    type: integer
+                                                  splitExternalLocalOriginErrors:
+                                                    default: false
+                                                    description: SplitExternalLocalOriginErrors
+                                                      enables splitting of errors
+                                                      between external and local origin.
+                                                    type: boolean
+                                                type: object
+                                            type: object
+                                          http2:
+                                            description: HTTP2 provides HTTP/2 configuration
+                                              for backend connections.
+                                            properties:
+                                              initialConnectionWindowSize:
+                                                allOf:
+                                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                description: |-
+                                                  InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.
+                                                  If not set, the default value is 1 MiB.
+                                                x-kubernetes-int-or-string: true
+                                              initialStreamWindowSize:
+                                                allOf:
+                                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                description: |-
+                                                  InitialStreamWindowSize sets the initial window size for HTTP/2 streams.
+                                                  If not set, the default value is 64 KiB(64*1024).
+                                                x-kubernetes-int-or-string: true
+                                              maxConcurrentStreams:
+                                                description: |-
+                                                  MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.
+                                                  If not set, the default value is 100.
+                                                format: int32
+                                                maximum: 2147483647
+                                                minimum: 1
+                                                type: integer
+                                              onInvalidMessage:
+                                                description: |-
+                                                  OnInvalidMessage determines if Envoy will terminate the connection or just the offending stream in the event of HTTP messaging error
+                                                  It's recommended for L2 Envoy deployments to set this value to TerminateStream.
+                                                  https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/level_two
+                                                  Default: TerminateConnection
+                                                type: string
+                                            type: object
+                                          loadBalancer:
+                                            description: |-
+                                              LoadBalancer policy to apply when routing traffic from the gateway to
+                                              the backend endpoints
+                                            properties:
+                                              consistentHash:
+                                                description: |-
+                                                  ConsistentHash defines the configuration when the load balancer type is
+                                                  set to ConsistentHash
+                                                properties:
+                                                  cookie:
+                                                    description: Cookie configures
+                                                      the cookie hash policy when
+                                                      the consistent hash type is
+                                                      set to Cookie.
+                                                    properties:
+                                                      attributes:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: Additional Attributes
+                                                          to set for the generated
+                                                          cookie.
+                                                        type: object
+                                                      name:
+                                                        description: |-
+                                                          Name of the cookie to hash.
+                                                          If this cookie does not exist in the request, Envoy will generate a cookie and set
+                                                          the TTL on the response back to the client based on Layer 4
+                                                          attributes of the backend endpoint, to ensure that these future requests
+                                                          go to the same backend endpoint. Make sure to set the TTL field for this case.
+                                                        type: string
+                                                      ttl:
+                                                        description: |-
+                                                          TTL of the generated cookie if the cookie is not present. This value sets the
+                                                          Max-Age attribute value.
+                                                        type: string
+                                                    required:
+                                                    - name
+                                                    type: object
+                                                  header:
+                                                    description: Header configures
+                                                      the header hash policy when
+                                                      the consistent hash type is
+                                                      set to Header.
+                                                    properties:
+                                                      name:
+                                                        description: Name of the header
+                                                          to hash.
+                                                        type: string
+                                                    required:
+                                                    - name
+                                                    type: object
+                                                  tableSize:
+                                                    default: 65537
+                                                    description: The table size for
+                                                      consistent hashing, must be
+                                                      prime number limited to 5000011.
+                                                    format: int64
+                                                    maximum: 5000011
+                                                    minimum: 2
+                                                    type: integer
+                                                  type:
+                                                    description: |-
+                                                      ConsistentHashType defines the type of input to hash on. Valid Type values are
+                                                      "SourceIP",
+                                                      "Header",
+                                                      "Cookie".
+                                                    enum:
+                                                    - SourceIP
+                                                    - Header
+                                                    - Cookie
+                                                    type: string
+                                                required:
+                                                - type
+                                                type: object
+                                                x-kubernetes-validations:
+                                                - message: If consistent hash type
+                                                    is header, the header field must
+                                                    be set.
+                                                  rule: 'self.type == ''Header'' ?
+                                                    has(self.header) : !has(self.header)'
+                                                - message: If consistent hash type
+                                                    is cookie, the cookie field must
+                                                    be set.
+                                                  rule: 'self.type == ''Cookie'' ?
+                                                    has(self.cookie) : !has(self.cookie)'
+                                              slowStart:
+                                                description: |-
+                                                  SlowStart defines the configuration related to the slow start load balancer policy.
+                                                  If set, during slow start window, traffic sent to the newly added hosts will gradually increase.
+                                                  Currently this is only supported for RoundRobin and LeastRequest load balancers
+                                                properties:
+                                                  window:
+                                                    description: |-
+                                                      Window defines the duration of the warm up period for newly added host.
+                                                      During slow start window, traffic sent to the newly added hosts will gradually increase.
+                                                      Currently only supports linear growth of traffic. For additional details,
+                                                      see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    type: string
+                                                required:
+                                                - window
+                                                type: object
+                                              type:
+                                                description: |-
+                                                  Type decides the type of Load Balancer policy.
+                                                  Valid LoadBalancerType values are
+                                                  "ConsistentHash",
+                                                  "LeastRequest",
+                                                  "Random",
+                                                  "RoundRobin".
+                                                enum:
+                                                - ConsistentHash
+                                                - LeastRequest
+                                                - Random
+                                                - RoundRobin
+                                                type: string
+                                            required:
+                                            - type
+                                            type: object
+                                            x-kubernetes-validations:
+                                            - message: If LoadBalancer type is consistentHash,
+                                                consistentHash field needs to be set.
+                                              rule: 'self.type == ''ConsistentHash''
+                                                ? has(self.consistentHash) : !has(self.consistentHash)'
+                                            - message: Currently SlowStart is only
+                                                supported for RoundRobin and LeastRequest
+                                                load balancers.
+                                              rule: 'self.type in [''Random'', ''ConsistentHash'']
+                                                ? !has(self.slowStart) : true '
+                                          proxyProtocol:
+                                            description: ProxyProtocol enables the
+                                              Proxy Protocol when communicating with
+                                              the backend.
+                                            properties:
+                                              version:
+                                                description: |-
+                                                  Version of ProxyProtol
+                                                  Valid ProxyProtocolVersion values are
+                                                  "V1"
+                                                  "V2"
+                                                enum:
+                                                - V1
+                                                - V2
+                                                type: string
+                                            required:
+                                            - version
+                                            type: object
+                                          tcpKeepalive:
+                                            description: |-
+                                              TcpKeepalive settings associated with the upstream client connection.
+                                              Disabled by default.
+                                            properties:
+                                              idleTime:
+                                                description: |-
+                                                  The duration a connection needs to be idle before keep-alive
+                                                  probes start being sent.
+                                                  The duration format is
+                                                  Defaults to `7200s`.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                type: string
+                                              interval:
+                                                description: |-
+                                                  The duration between keep-alive probes.
+                                                  Defaults to `75s`.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                type: string
+                                              probes:
+                                                description: |-
+                                                  The total number of unacknowledged probes to send before deciding
+                                                  the connection is dead.
+                                                  Defaults to 9.
+                                                format: int32
+                                                type: integer
+                                            type: object
+                                          timeout:
+                                            description: Timeout settings for the
+                                              backend connections.
+                                            properties:
+                                              http:
+                                                description: Timeout settings for
+                                                  HTTP.
+                                                properties:
+                                                  connectionIdleTimeout:
+                                                    description: |-
+                                                      The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+                                                      Default: 1 hour.
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                    type: string
+                                                  maxConnectionDuration:
+                                                    description: |-
+                                                      The maximum duration of an HTTP connection.
+                                                      Default: unlimited.
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                    type: string
+                                                type: object
+                                              tcp:
+                                                description: Timeout settings for
+                                                  TCP.
+                                                properties:
+                                                  connectTimeout:
+                                                    description: |-
+                                                      The timeout for network connection establishment, including TCP and TLS handshakes.
+                                                      Default: 10 seconds.
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                    type: string
+                                                type: object
+                                            type: object
+                                        type: object
                                       http:
                                         description: HTTP defines additional configuration
                                           specific to HTTP access logs.
@@ -10436,13 +11143,24 @@ spec:
                                         - TCP
                                         type: string
                                     required:
-                                    - backendRefs
                                     - type
                                     type: object
                                     x-kubernetes-validations:
                                     - message: The http field may only be set when
                                         type is HTTP.
                                       rule: self.type == 'HTTP' || !has(self.http)
+                                    - message: BackendRefs must be used, backendRef
+                                        is not supported.
+                                      rule: '!has(self.backendRef)'
+                                    - message: must have at least one backend in backendRefs
+                                      rule: has(self.backendRefs) && self.backendRefs.size()
+                                        > 0
+                                    - message: BackendRefs only supports Service kind.
+                                      rule: 'has(self.backendRefs) ? self.backendRefs.all(f,
+                                        f.kind == ''Service'') : true'
+                                    - message: BackendRefs only supports Core group.
+                                      rule: 'has(self.backendRefs) ? (self.backendRefs.all(f,
+                                        f.group == "")) : true'
                                   file:
                                     description: File defines the file accesslog sink.
                                     properties:
@@ -10456,11 +11174,91 @@ spec:
                                     description: OpenTelemetry defines the OpenTelemetry
                                       accesslog sink.
                                     properties:
+                                      backendRef:
+                                        description: |-
+                                          BackendRef references a Kubernetes object that represents the
+                                          backend server to which the authorization request will be sent.
+
+
+                                          Deprecated: Use BackendRefs instead.
+                                        properties:
+                                          group:
+                                            default: ""
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When unspecified or empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            default: Service
+                                            description: |-
+                                              Kind is the Kubernetes resource kind of the referent. For example
+                                              "Service".
+
+
+                                              Defaults to "Service" when not specified.
+
+
+                                              ExternalName services can refer to CNAME DNS records that may live
+                                              outside of the cluster and as such are difficult to reason about in
+                                              terms of conformance. They also may not be safe to forward to (see
+                                              CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                              support ExternalName Services.
+
+
+                                              Support: Core (Services with a type other than ExternalName)
+
+
+                                              Support: Implementation-specific (Services with type ExternalName)
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the backend. When unspecified, the local
+                                              namespace is inferred.
+
+
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+
+
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                          port:
+                                            description: |-
+                                              Port specifies the destination port number to use for this resource.
+                                              Port is required when the referent is a Kubernetes Service. In this
+                                              case, the port number is the service port number, not the target port.
+                                              For other resources, destination port might be derived from the referent
+                                              resource or this field.
+                                            format: int32
+                                            maximum: 65535
+                                            minimum: 1
+                                            type: integer
+                                        required:
+                                        - name
+                                        type: object
+                                        x-kubernetes-validations:
+                                        - message: Must have port for Service reference
+                                          rule: '(size(self.group) == 0 && self.kind
+                                            == ''Service'') ? has(self.port) : true'
                                       backendRefs:
                                         description: |-
                                           BackendRefs references a Kubernetes object that represents the
-                                          backend server to which the access log will be sent.
-                                          Only Service kind is supported for now.
+                                          backend server to which the authorization request will be sent.
                                         items:
                                           description: BackendRef defines how an ObjectReference
                                             that is specific to BackendRef.
@@ -10539,45 +11337,682 @@ spec:
                                           - message: Must have port for Service reference
                                             rule: '(size(self.group) == 0 && self.kind
                                               == ''Service'') ? has(self.port) : true'
-                                        maxItems: 1
+                                        maxItems: 16
                                         type: array
-                                        x-kubernetes-validations:
-                                        - message: only support Service kind.
-                                          rule: self.all(f, f.kind == 'Service')
-                                        - message: BackendRefs only supports Core
-                                            group.
-                                          rule: self.all(f, f.group == '')
-                                      host:
-                                        description: |-
-                                          Host define the extension service hostname.
-                                          Deprecated: Use BackendRefs instead.
-                                        type: string
-                                      port:
-                                        default: 4317
-                                        description: |-
-                                          Port defines the port the extension service is exposed on.
-                                          Deprecated: Use BackendRefs instead.
-                                        format: int32
-                                        minimum: 0
-                                        type: integer
-                                      resources:
-                                        additionalProperties:
-                                          type: string
+                                      backendSettings:
                                         description: |-
-                                          Resources is a set of labels that describe the source of a log entry, including envoy node info.
-                                          It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/).
-                                        type: object
-                                    type: object
-                                    x-kubernetes-validations:
-                                    - message: host or backendRefs needs to be set
-                                      rule: has(self.host) || self.backendRefs.size()
-                                        > 0
-                                  type:
-                                    description: Type defines the type of accesslog
-                                      sink.
-                                    enum:
-                                    - ALS
-                                    - File
+                                          BackendSettings holds configuration for managing the connection
+                                          to the backend.
+                                        properties:
+                                          circuitBreaker:
+                                            description: |-
+                                              Circuit Breaker settings for the upstream connections and requests.
+                                              If not set, circuit breakers will be enabled with the default thresholds
+                                            properties:
+                                              maxConnections:
+                                                default: 1024
+                                                description: The maximum number of
+                                                  connections that Envoy will establish
+                                                  to the referenced backend defined
+                                                  within a xRoute rule.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                              maxParallelRequests:
+                                                default: 1024
+                                                description: The maximum number of
+                                                  parallel requests that Envoy will
+                                                  make to the referenced backend defined
+                                                  within a xRoute rule.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                              maxParallelRetries:
+                                                default: 1024
+                                                description: The maximum number of
+                                                  parallel retries that Envoy will
+                                                  make to the referenced backend defined
+                                                  within a xRoute rule.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                              maxPendingRequests:
+                                                default: 1024
+                                                description: The maximum number of
+                                                  pending requests that Envoy will
+                                                  queue to the referenced backend
+                                                  defined within a xRoute rule.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                              maxRequestsPerConnection:
+                                                description: |-
+                                                  The maximum number of requests that Envoy will make over a single connection to the referenced backend defined within a xRoute rule.
+                                                  Default: unlimited.
+                                                format: int64
+                                                maximum: 4294967295
+                                                minimum: 0
+                                                type: integer
+                                            type: object
+                                          connection:
+                                            description: Connection includes backend
+                                              connection settings.
+                                            properties:
+                                              bufferLimit:
+                                                allOf:
+                                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                description: |-
+                                                  BufferLimit Soft limit on size of the cluster’s connections read and write buffers.
+                                                  BufferLimit applies to connection streaming (maybe non-streaming) channel between processes, it's in user space.
+                                                  If unspecified, an implementation defined default is applied (32768 bytes).
+                                                  For example, 20Mi, 1Gi, 256Ki etc.
+                                                  Note: that when the suffix is not provided, the value is interpreted as bytes.
+                                                x-kubernetes-int-or-string: true
+                                              socketBufferLimit:
+                                                allOf:
+                                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                description: |-
+                                                  SocketBufferLimit provides configuration for the maximum buffer size in bytes for each socket
+                                                  to backend.
+                                                  SocketBufferLimit applies to socket streaming channel between TCP/IP stacks, it's in kernel space.
+                                                  For example, 20Mi, 1Gi, 256Ki etc.
+                                                  Note that when the suffix is not provided, the value is interpreted as bytes.
+                                                x-kubernetes-int-or-string: true
+                                            type: object
+                                          dns:
+                                            description: DNS includes dns resolution
+                                              settings.
+                                            properties:
+                                              dnsRefreshRate:
+                                                description: |-
+                                                  DNSRefreshRate specifies the rate at which DNS records should be refreshed.
+                                                  Defaults to 30 seconds.
+                                                type: string
+                                              respectDnsTtl:
+                                                description: |-
+                                                  RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.
+                                                  If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.
+                                                  Defaults to true.
+                                                type: boolean
+                                            type: object
+                                          healthCheck:
+                                            description: HealthCheck allows gateway
+                                              to perform active health checking on
+                                              backends.
+                                            properties:
+                                              active:
+                                                description: Active health check configuration
+                                                properties:
+                                                  healthyThreshold:
+                                                    default: 1
+                                                    description: HealthyThreshold
+                                                      defines the number of healthy
+                                                      health checks required before
+                                                      a backend host is marked healthy.
+                                                    format: int32
+                                                    minimum: 1
+                                                    type: integer
+                                                  http:
+                                                    description: |-
+                                                      HTTP defines the configuration of http health checker.
+                                                      It's required while the health checker type is HTTP.
+                                                    properties:
+                                                      expectedResponse:
+                                                        description: ExpectedResponse
+                                                          defines a list of HTTP expected
+                                                          responses to match.
+                                                        properties:
+                                                          binary:
+                                                            description: Binary payload
+                                                              base64 encoded.
+                                                            format: byte
+                                                            type: string
+                                                          text:
+                                                            description: Text payload
+                                                              in plain text.
+                                                            type: string
+                                                          type:
+                                                            allOf:
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            description: Type defines
+                                                              the type of the payload.
+                                                            type: string
+                                                        required:
+                                                        - type
+                                                        type: object
+                                                        x-kubernetes-validations:
+                                                        - message: If payload type
+                                                            is Text, text field needs
+                                                            to be set.
+                                                          rule: 'self.type == ''Text''
+                                                            ? has(self.text) : !has(self.text)'
+                                                        - message: If payload type
+                                                            is Binary, binary field
+                                                            needs to be set.
+                                                          rule: 'self.type == ''Binary''
+                                                            ? has(self.binary) : !has(self.binary)'
+                                                      expectedStatuses:
+                                                        description: |-
+                                                          ExpectedStatuses defines a list of HTTP response statuses considered healthy.
+                                                          Defaults to 200 only
+                                                        items:
+                                                          description: HTTPStatus
+                                                            defines the http status
+                                                            code.
+                                                          exclusiveMaximum: true
+                                                          maximum: 600
+                                                          minimum: 100
+                                                          type: integer
+                                                        type: array
+                                                      method:
+                                                        description: |-
+                                                          Method defines the HTTP method used for health checking.
+                                                          Defaults to GET
+                                                        type: string
+                                                      path:
+                                                        description: Path defines
+                                                          the HTTP path that will
+                                                          be requested during health
+                                                          checking.
+                                                        maxLength: 1024
+                                                        minLength: 1
+                                                        type: string
+                                                    required:
+                                                    - path
+                                                    type: object
+                                                  interval:
+                                                    default: 3s
+                                                    description: Interval defines
+                                                      the time between active health
+                                                      checks.
+                                                    format: duration
+                                                    type: string
+                                                  tcp:
+                                                    description: |-
+                                                      TCP defines the configuration of tcp health checker.
+                                                      It's required while the health checker type is TCP.
+                                                    properties:
+                                                      receive:
+                                                        description: Receive defines
+                                                          the expected response payload.
+                                                        properties:
+                                                          binary:
+                                                            description: Binary payload
+                                                              base64 encoded.
+                                                            format: byte
+                                                            type: string
+                                                          text:
+                                                            description: Text payload
+                                                              in plain text.
+                                                            type: string
+                                                          type:
+                                                            allOf:
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            description: Type defines
+                                                              the type of the payload.
+                                                            type: string
+                                                        required:
+                                                        - type
+                                                        type: object
+                                                        x-kubernetes-validations:
+                                                        - message: If payload type
+                                                            is Text, text field needs
+                                                            to be set.
+                                                          rule: 'self.type == ''Text''
+                                                            ? has(self.text) : !has(self.text)'
+                                                        - message: If payload type
+                                                            is Binary, binary field
+                                                            needs to be set.
+                                                          rule: 'self.type == ''Binary''
+                                                            ? has(self.binary) : !has(self.binary)'
+                                                      send:
+                                                        description: Send defines
+                                                          the request payload.
+                                                        properties:
+                                                          binary:
+                                                            description: Binary payload
+                                                              base64 encoded.
+                                                            format: byte
+                                                            type: string
+                                                          text:
+                                                            description: Text payload
+                                                              in plain text.
+                                                            type: string
+                                                          type:
+                                                            allOf:
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            - enum:
+                                                              - Text
+                                                              - Binary
+                                                            description: Type defines
+                                                              the type of the payload.
+                                                            type: string
+                                                        required:
+                                                        - type
+                                                        type: object
+                                                        x-kubernetes-validations:
+                                                        - message: If payload type
+                                                            is Text, text field needs
+                                                            to be set.
+                                                          rule: 'self.type == ''Text''
+                                                            ? has(self.text) : !has(self.text)'
+                                                        - message: If payload type
+                                                            is Binary, binary field
+                                                            needs to be set.
+                                                          rule: 'self.type == ''Binary''
+                                                            ? has(self.binary) : !has(self.binary)'
+                                                    type: object
+                                                  timeout:
+                                                    default: 1s
+                                                    description: Timeout defines the
+                                                      time to wait for a health check
+                                                      response.
+                                                    format: duration
+                                                    type: string
+                                                  type:
+                                                    allOf:
+                                                    - enum:
+                                                      - HTTP
+                                                      - TCP
+                                                    - enum:
+                                                      - HTTP
+                                                      - TCP
+                                                    description: Type defines the
+                                                      type of health checker.
+                                                    type: string
+                                                  unhealthyThreshold:
+                                                    default: 3
+                                                    description: UnhealthyThreshold
+                                                      defines the number of unhealthy
+                                                      health checks required before
+                                                      a backend host is marked unhealthy.
+                                                    format: int32
+                                                    minimum: 1
+                                                    type: integer
+                                                required:
+                                                - type
+                                                type: object
+                                                x-kubernetes-validations:
+                                                - message: If Health Checker type
+                                                    is HTTP, http field needs to be
+                                                    set.
+                                                  rule: 'self.type == ''HTTP'' ? has(self.http)
+                                                    : !has(self.http)'
+                                                - message: If Health Checker type
+                                                    is TCP, tcp field needs to be
+                                                    set.
+                                                  rule: 'self.type == ''TCP'' ? has(self.tcp)
+                                                    : !has(self.tcp)'
+                                              passive:
+                                                description: Passive passive check
+                                                  configuration
+                                                properties:
+                                                  baseEjectionTime:
+                                                    default: 30s
+                                                    description: BaseEjectionTime
+                                                      defines the base duration for
+                                                      which a host will be ejected
+                                                      on consecutive failures.
+                                                    format: duration
+                                                    type: string
+                                                  consecutive5XxErrors:
+                                                    default: 5
+                                                    description: Consecutive5xxErrors
+                                                      sets the number of consecutive
+                                                      5xx errors triggering ejection.
+                                                    format: int32
+                                                    type: integer
+                                                  consecutiveGatewayErrors:
+                                                    default: 0
+                                                    description: ConsecutiveGatewayErrors
+                                                      sets the number of consecutive
+                                                      gateway errors triggering ejection.
+                                                    format: int32
+                                                    type: integer
+                                                  consecutiveLocalOriginFailures:
+                                                    default: 5
+                                                    description: |-
+                                                      ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.
+                                                      Parameter takes effect only when split_external_local_origin_errors is set to true.
+                                                    format: int32
+                                                    type: integer
+                                                  interval:
+                                                    default: 3s
+                                                    description: Interval defines
+                                                      the time between passive health
+                                                      checks.
+                                                    format: duration
+                                                    type: string
+                                                  maxEjectionPercent:
+                                                    default: 10
+                                                    description: MaxEjectionPercent
+                                                      sets the maximum percentage
+                                                      of hosts in a cluster that can
+                                                      be ejected.
+                                                    format: int32
+                                                    type: integer
+                                                  splitExternalLocalOriginErrors:
+                                                    default: false
+                                                    description: SplitExternalLocalOriginErrors
+                                                      enables splitting of errors
+                                                      between external and local origin.
+                                                    type: boolean
+                                                type: object
+                                            type: object
+                                          http2:
+                                            description: HTTP2 provides HTTP/2 configuration
+                                              for backend connections.
+                                            properties:
+                                              initialConnectionWindowSize:
+                                                allOf:
+                                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                description: |-
+                                                  InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.
+                                                  If not set, the default value is 1 MiB.
+                                                x-kubernetes-int-or-string: true
+                                              initialStreamWindowSize:
+                                                allOf:
+                                                - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                description: |-
+                                                  InitialStreamWindowSize sets the initial window size for HTTP/2 streams.
+                                                  If not set, the default value is 64 KiB(64*1024).
+                                                x-kubernetes-int-or-string: true
+                                              maxConcurrentStreams:
+                                                description: |-
+                                                  MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.
+                                                  If not set, the default value is 100.
+                                                format: int32
+                                                maximum: 2147483647
+                                                minimum: 1
+                                                type: integer
+                                              onInvalidMessage:
+                                                description: |-
+                                                  OnInvalidMessage determines if Envoy will terminate the connection or just the offending stream in the event of HTTP messaging error
+                                                  It's recommended for L2 Envoy deployments to set this value to TerminateStream.
+                                                  https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/level_two
+                                                  Default: TerminateConnection
+                                                type: string
+                                            type: object
+                                          loadBalancer:
+                                            description: |-
+                                              LoadBalancer policy to apply when routing traffic from the gateway to
+                                              the backend endpoints
+                                            properties:
+                                              consistentHash:
+                                                description: |-
+                                                  ConsistentHash defines the configuration when the load balancer type is
+                                                  set to ConsistentHash
+                                                properties:
+                                                  cookie:
+                                                    description: Cookie configures
+                                                      the cookie hash policy when
+                                                      the consistent hash type is
+                                                      set to Cookie.
+                                                    properties:
+                                                      attributes:
+                                                        additionalProperties:
+                                                          type: string
+                                                        description: Additional Attributes
+                                                          to set for the generated
+                                                          cookie.
+                                                        type: object
+                                                      name:
+                                                        description: |-
+                                                          Name of the cookie to hash.
+                                                          If this cookie does not exist in the request, Envoy will generate a cookie and set
+                                                          the TTL on the response back to the client based on Layer 4
+                                                          attributes of the backend endpoint, to ensure that these future requests
+                                                          go to the same backend endpoint. Make sure to set the TTL field for this case.
+                                                        type: string
+                                                      ttl:
+                                                        description: |-
+                                                          TTL of the generated cookie if the cookie is not present. This value sets the
+                                                          Max-Age attribute value.
+                                                        type: string
+                                                    required:
+                                                    - name
+                                                    type: object
+                                                  header:
+                                                    description: Header configures
+                                                      the header hash policy when
+                                                      the consistent hash type is
+                                                      set to Header.
+                                                    properties:
+                                                      name:
+                                                        description: Name of the header
+                                                          to hash.
+                                                        type: string
+                                                    required:
+                                                    - name
+                                                    type: object
+                                                  tableSize:
+                                                    default: 65537
+                                                    description: The table size for
+                                                      consistent hashing, must be
+                                                      prime number limited to 5000011.
+                                                    format: int64
+                                                    maximum: 5000011
+                                                    minimum: 2
+                                                    type: integer
+                                                  type:
+                                                    description: |-
+                                                      ConsistentHashType defines the type of input to hash on. Valid Type values are
+                                                      "SourceIP",
+                                                      "Header",
+                                                      "Cookie".
+                                                    enum:
+                                                    - SourceIP
+                                                    - Header
+                                                    - Cookie
+                                                    type: string
+                                                required:
+                                                - type
+                                                type: object
+                                                x-kubernetes-validations:
+                                                - message: If consistent hash type
+                                                    is header, the header field must
+                                                    be set.
+                                                  rule: 'self.type == ''Header'' ?
+                                                    has(self.header) : !has(self.header)'
+                                                - message: If consistent hash type
+                                                    is cookie, the cookie field must
+                                                    be set.
+                                                  rule: 'self.type == ''Cookie'' ?
+                                                    has(self.cookie) : !has(self.cookie)'
+                                              slowStart:
+                                                description: |-
+                                                  SlowStart defines the configuration related to the slow start load balancer policy.
+                                                  If set, during slow start window, traffic sent to the newly added hosts will gradually increase.
+                                                  Currently this is only supported for RoundRobin and LeastRequest load balancers
+                                                properties:
+                                                  window:
+                                                    description: |-
+                                                      Window defines the duration of the warm up period for newly added host.
+                                                      During slow start window, traffic sent to the newly added hosts will gradually increase.
+                                                      Currently only supports linear growth of traffic. For additional details,
+                                                      see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    type: string
+                                                required:
+                                                - window
+                                                type: object
+                                              type:
+                                                description: |-
+                                                  Type decides the type of Load Balancer policy.
+                                                  Valid LoadBalancerType values are
+                                                  "ConsistentHash",
+                                                  "LeastRequest",
+                                                  "Random",
+                                                  "RoundRobin".
+                                                enum:
+                                                - ConsistentHash
+                                                - LeastRequest
+                                                - Random
+                                                - RoundRobin
+                                                type: string
+                                            required:
+                                            - type
+                                            type: object
+                                            x-kubernetes-validations:
+                                            - message: If LoadBalancer type is consistentHash,
+                                                consistentHash field needs to be set.
+                                              rule: 'self.type == ''ConsistentHash''
+                                                ? has(self.consistentHash) : !has(self.consistentHash)'
+                                            - message: Currently SlowStart is only
+                                                supported for RoundRobin and LeastRequest
+                                                load balancers.
+                                              rule: 'self.type in [''Random'', ''ConsistentHash'']
+                                                ? !has(self.slowStart) : true '
+                                          proxyProtocol:
+                                            description: ProxyProtocol enables the
+                                              Proxy Protocol when communicating with
+                                              the backend.
+                                            properties:
+                                              version:
+                                                description: |-
+                                                  Version of ProxyProtol
+                                                  Valid ProxyProtocolVersion values are
+                                                  "V1"
+                                                  "V2"
+                                                enum:
+                                                - V1
+                                                - V2
+                                                type: string
+                                            required:
+                                            - version
+                                            type: object
+                                          tcpKeepalive:
+                                            description: |-
+                                              TcpKeepalive settings associated with the upstream client connection.
+                                              Disabled by default.
+                                            properties:
+                                              idleTime:
+                                                description: |-
+                                                  The duration a connection needs to be idle before keep-alive
+                                                  probes start being sent.
+                                                  The duration format is
+                                                  Defaults to `7200s`.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                type: string
+                                              interval:
+                                                description: |-
+                                                  The duration between keep-alive probes.
+                                                  Defaults to `75s`.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                type: string
+                                              probes:
+                                                description: |-
+                                                  The total number of unacknowledged probes to send before deciding
+                                                  the connection is dead.
+                                                  Defaults to 9.
+                                                format: int32
+                                                type: integer
+                                            type: object
+                                          timeout:
+                                            description: Timeout settings for the
+                                              backend connections.
+                                            properties:
+                                              http:
+                                                description: Timeout settings for
+                                                  HTTP.
+                                                properties:
+                                                  connectionIdleTimeout:
+                                                    description: |-
+                                                      The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+                                                      Default: 1 hour.
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                    type: string
+                                                  maxConnectionDuration:
+                                                    description: |-
+                                                      The maximum duration of an HTTP connection.
+                                                      Default: unlimited.
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                    type: string
+                                                type: object
+                                              tcp:
+                                                description: Timeout settings for
+                                                  TCP.
+                                                properties:
+                                                  connectTimeout:
+                                                    description: |-
+                                                      The timeout for network connection establishment, including TCP and TLS handshakes.
+                                                      Default: 10 seconds.
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                                    type: string
+                                                type: object
+                                            type: object
+                                        type: object
+                                      host:
+                                        description: |-
+                                          Host define the extension service hostname.
+                                          Deprecated: Use BackendRefs instead.
+                                        type: string
+                                      port:
+                                        default: 4317
+                                        description: |-
+                                          Port defines the port the extension service is exposed on.
+                                          Deprecated: Use BackendRefs instead.
+                                        format: int32
+                                        minimum: 0
+                                        type: integer
+                                      resources:
+                                        additionalProperties:
+                                          type: string
+                                        description: |-
+                                          Resources is a set of labels that describe the source of a log entry, including envoy node info.
+                                          It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/).
+                                        type: object
+                                    type: object
+                                    x-kubernetes-validations:
+                                    - message: host or backendRefs needs to be set
+                                      rule: has(self.host) || self.backendRefs.size()
+                                        > 0
+                                    - message: BackendRefs must be used, backendRef
+                                        is not supported.
+                                      rule: '!has(self.backendRef)'
+                                    - message: BackendRefs only supports Service kind.
+                                      rule: 'has(self.backendRefs) ? self.backendRefs.all(f,
+                                        f.kind == ''Service'') : true'
+                                    - message: BackendRefs only supports Core group.
+                                      rule: 'has(self.backendRefs) ? (self.backendRefs.all(f,
+                                        f.group == "")) : true'
+                                  type:
+                                    description: Type defines the type of accesslog
+                                      sink.
+                                    enum:
+                                    - ALS
+                                    - File
                                     - OpenTelemetry
                                     type: string
                                 type: object
@@ -10688,11 +12123,91 @@ spec:
                                 OpenTelemetry defines the configuration for OpenTelemetry sink.
                                 It's required if the sink type is OpenTelemetry.
                               properties:
+                                backendRef:
+                                  description: |-
+                                    BackendRef references a Kubernetes object that represents the
+                                    backend server to which the authorization request will be sent.
+
+
+                                    Deprecated: Use BackendRefs instead.
+                                  properties:
+                                    group:
+                                      default: ""
+                                      description: |-
+                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                        When unspecified or empty string, core API group is inferred.
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      default: Service
+                                      description: |-
+                                        Kind is the Kubernetes resource kind of the referent. For example
+                                        "Service".
+
+
+                                        Defaults to "Service" when not specified.
+
+
+                                        ExternalName services can refer to CNAME DNS records that may live
+                                        outside of the cluster and as such are difficult to reason about in
+                                        terms of conformance. They also may not be safe to forward to (see
+                                        CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                        support ExternalName Services.
+
+
+                                        Support: Core (Services with a type other than ExternalName)
+
+
+                                        Support: Implementation-specific (Services with type ExternalName)
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: Name is the name of the referent.
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the backend. When unspecified, the local
+                                        namespace is inferred.
+
+
+                                        Note that when a namespace different than the local namespace is specified,
+                                        a ReferenceGrant object is required in the referent namespace to allow that
+                                        namespace's owner to accept the reference. See the ReferenceGrant
+                                        documentation for details.
+
+
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                    port:
+                                      description: |-
+                                        Port specifies the destination port number to use for this resource.
+                                        Port is required when the referent is a Kubernetes Service. In this
+                                        case, the port number is the service port number, not the target port.
+                                        For other resources, destination port might be derived from the referent
+                                        resource or this field.
+                                      format: int32
+                                      maximum: 65535
+                                      minimum: 1
+                                      type: integer
+                                  required:
+                                  - name
+                                  type: object
+                                  x-kubernetes-validations:
+                                  - message: Must have port for Service reference
+                                    rule: '(size(self.group) == 0 && self.kind ==
+                                      ''Service'') ? has(self.port) : true'
                                 backendRefs:
                                   description: |-
                                     BackendRefs references a Kubernetes object that represents the
-                                    backend server to which the metric will be sent.
-                                    Only Service kind is supported for now.
+                                    backend server to which the authorization request will be sent.
                                   items:
                                     description: BackendRef defines how an ObjectReference
                                       that is specific to BackendRef.
@@ -10770,48 +12285,657 @@ spec:
                                     - message: Must have port for Service reference
                                       rule: '(size(self.group) == 0 && self.kind ==
                                         ''Service'') ? has(self.port) : true'
-                                  maxItems: 1
+                                  maxItems: 16
                                   type: array
-                                  x-kubernetes-validations:
-                                  - message: only support Service kind.
-                                    rule: self.all(f, f.kind == 'Service')
-                                  - message: BackendRefs only supports Core group.
-                                    rule: self.all(f, f.group == '')
-                                host:
-                                  description: |-
-                                    Host define the service hostname.
-                                    Deprecated: Use BackendRefs instead.
-                                  type: string
-                                port:
-                                  default: 4317
+                                backendSettings:
                                   description: |-
-                                    Port defines the port the service is exposed on.
-                                    Deprecated: Use BackendRefs instead.
-                                  format: int32
-                                  maximum: 65535
-                                  minimum: 0
-                                  type: integer
-                              type: object
-                              x-kubernetes-validations:
-                              - message: host or backendRefs needs to be set
-                                rule: has(self.host) || self.backendRefs.size() >
-                                  0
-                            type:
-                              default: OpenTelemetry
-                              description: |-
-                                Type defines the metric sink type.
-                                EG currently only supports OpenTelemetry.
-                              enum:
-                              - OpenTelemetry
-                              type: string
-                          required:
-                          - type
-                          type: object
-                          x-kubernetes-validations:
-                          - message: If MetricSink type is OpenTelemetry, openTelemetry
-                              field needs to be set.
+                                    BackendSettings holds configuration for managing the connection
+                                    to the backend.
+                                  properties:
+                                    circuitBreaker:
+                                      description: |-
+                                        Circuit Breaker settings for the upstream connections and requests.
+                                        If not set, circuit breakers will be enabled with the default thresholds
+                                      properties:
+                                        maxConnections:
+                                          default: 1024
+                                          description: The maximum number of connections
+                                            that Envoy will establish to the referenced
+                                            backend defined within a xRoute rule.
+                                          format: int64
+                                          maximum: 4294967295
+                                          minimum: 0
+                                          type: integer
+                                        maxParallelRequests:
+                                          default: 1024
+                                          description: The maximum number of parallel
+                                            requests that Envoy will make to the referenced
+                                            backend defined within a xRoute rule.
+                                          format: int64
+                                          maximum: 4294967295
+                                          minimum: 0
+                                          type: integer
+                                        maxParallelRetries:
+                                          default: 1024
+                                          description: The maximum number of parallel
+                                            retries that Envoy will make to the referenced
+                                            backend defined within a xRoute rule.
+                                          format: int64
+                                          maximum: 4294967295
+                                          minimum: 0
+                                          type: integer
+                                        maxPendingRequests:
+                                          default: 1024
+                                          description: The maximum number of pending
+                                            requests that Envoy will queue to the
+                                            referenced backend defined within a xRoute
+                                            rule.
+                                          format: int64
+                                          maximum: 4294967295
+                                          minimum: 0
+                                          type: integer
+                                        maxRequestsPerConnection:
+                                          description: |-
+                                            The maximum number of requests that Envoy will make over a single connection to the referenced backend defined within a xRoute rule.
+                                            Default: unlimited.
+                                          format: int64
+                                          maximum: 4294967295
+                                          minimum: 0
+                                          type: integer
+                                      type: object
+                                    connection:
+                                      description: Connection includes backend connection
+                                        settings.
+                                      properties:
+                                        bufferLimit:
+                                          allOf:
+                                          - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          description: |-
+                                            BufferLimit Soft limit on size of the cluster’s connections read and write buffers.
+                                            BufferLimit applies to connection streaming (maybe non-streaming) channel between processes, it's in user space.
+                                            If unspecified, an implementation defined default is applied (32768 bytes).
+                                            For example, 20Mi, 1Gi, 256Ki etc.
+                                            Note: that when the suffix is not provided, the value is interpreted as bytes.
+                                          x-kubernetes-int-or-string: true
+                                        socketBufferLimit:
+                                          allOf:
+                                          - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          description: |-
+                                            SocketBufferLimit provides configuration for the maximum buffer size in bytes for each socket
+                                            to backend.
+                                            SocketBufferLimit applies to socket streaming channel between TCP/IP stacks, it's in kernel space.
+                                            For example, 20Mi, 1Gi, 256Ki etc.
+                                            Note that when the suffix is not provided, the value is interpreted as bytes.
+                                          x-kubernetes-int-or-string: true
+                                      type: object
+                                    dns:
+                                      description: DNS includes dns resolution settings.
+                                      properties:
+                                        dnsRefreshRate:
+                                          description: |-
+                                            DNSRefreshRate specifies the rate at which DNS records should be refreshed.
+                                            Defaults to 30 seconds.
+                                          type: string
+                                        respectDnsTtl:
+                                          description: |-
+                                            RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.
+                                            If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.
+                                            Defaults to true.
+                                          type: boolean
+                                      type: object
+                                    healthCheck:
+                                      description: HealthCheck allows gateway to perform
+                                        active health checking on backends.
+                                      properties:
+                                        active:
+                                          description: Active health check configuration
+                                          properties:
+                                            healthyThreshold:
+                                              default: 1
+                                              description: HealthyThreshold defines
+                                                the number of healthy health checks
+                                                required before a backend host is
+                                                marked healthy.
+                                              format: int32
+                                              minimum: 1
+                                              type: integer
+                                            http:
+                                              description: |-
+                                                HTTP defines the configuration of http health checker.
+                                                It's required while the health checker type is HTTP.
+                                              properties:
+                                                expectedResponse:
+                                                  description: ExpectedResponse defines
+                                                    a list of HTTP expected responses
+                                                    to match.
+                                                  properties:
+                                                    binary:
+                                                      description: Binary payload
+                                                        base64 encoded.
+                                                      format: byte
+                                                      type: string
+                                                    text:
+                                                      description: Text payload in
+                                                        plain text.
+                                                      type: string
+                                                    type:
+                                                      allOf:
+                                                      - enum:
+                                                        - Text
+                                                        - Binary
+                                                      - enum:
+                                                        - Text
+                                                        - Binary
+                                                      description: Type defines the
+                                                        type of the payload.
+                                                      type: string
+                                                  required:
+                                                  - type
+                                                  type: object
+                                                  x-kubernetes-validations:
+                                                  - message: If payload type is Text,
+                                                      text field needs to be set.
+                                                    rule: 'self.type == ''Text'' ?
+                                                      has(self.text) : !has(self.text)'
+                                                  - message: If payload type is Binary,
+                                                      binary field needs to be set.
+                                                    rule: 'self.type == ''Binary''
+                                                      ? has(self.binary) : !has(self.binary)'
+                                                expectedStatuses:
+                                                  description: |-
+                                                    ExpectedStatuses defines a list of HTTP response statuses considered healthy.
+                                                    Defaults to 200 only
+                                                  items:
+                                                    description: HTTPStatus defines
+                                                      the http status code.
+                                                    exclusiveMaximum: true
+                                                    maximum: 600
+                                                    minimum: 100
+                                                    type: integer
+                                                  type: array
+                                                method:
+                                                  description: |-
+                                                    Method defines the HTTP method used for health checking.
+                                                    Defaults to GET
+                                                  type: string
+                                                path:
+                                                  description: Path defines the HTTP
+                                                    path that will be requested during
+                                                    health checking.
+                                                  maxLength: 1024
+                                                  minLength: 1
+                                                  type: string
+                                              required:
+                                              - path
+                                              type: object
+                                            interval:
+                                              default: 3s
+                                              description: Interval defines the time
+                                                between active health checks.
+                                              format: duration
+                                              type: string
+                                            tcp:
+                                              description: |-
+                                                TCP defines the configuration of tcp health checker.
+                                                It's required while the health checker type is TCP.
+                                              properties:
+                                                receive:
+                                                  description: Receive defines the
+                                                    expected response payload.
+                                                  properties:
+                                                    binary:
+                                                      description: Binary payload
+                                                        base64 encoded.
+                                                      format: byte
+                                                      type: string
+                                                    text:
+                                                      description: Text payload in
+                                                        plain text.
+                                                      type: string
+                                                    type:
+                                                      allOf:
+                                                      - enum:
+                                                        - Text
+                                                        - Binary
+                                                      - enum:
+                                                        - Text
+                                                        - Binary
+                                                      description: Type defines the
+                                                        type of the payload.
+                                                      type: string
+                                                  required:
+                                                  - type
+                                                  type: object
+                                                  x-kubernetes-validations:
+                                                  - message: If payload type is Text,
+                                                      text field needs to be set.
+                                                    rule: 'self.type == ''Text'' ?
+                                                      has(self.text) : !has(self.text)'
+                                                  - message: If payload type is Binary,
+                                                      binary field needs to be set.
+                                                    rule: 'self.type == ''Binary''
+                                                      ? has(self.binary) : !has(self.binary)'
+                                                send:
+                                                  description: Send defines the request
+                                                    payload.
+                                                  properties:
+                                                    binary:
+                                                      description: Binary payload
+                                                        base64 encoded.
+                                                      format: byte
+                                                      type: string
+                                                    text:
+                                                      description: Text payload in
+                                                        plain text.
+                                                      type: string
+                                                    type:
+                                                      allOf:
+                                                      - enum:
+                                                        - Text
+                                                        - Binary
+                                                      - enum:
+                                                        - Text
+                                                        - Binary
+                                                      description: Type defines the
+                                                        type of the payload.
+                                                      type: string
+                                                  required:
+                                                  - type
+                                                  type: object
+                                                  x-kubernetes-validations:
+                                                  - message: If payload type is Text,
+                                                      text field needs to be set.
+                                                    rule: 'self.type == ''Text'' ?
+                                                      has(self.text) : !has(self.text)'
+                                                  - message: If payload type is Binary,
+                                                      binary field needs to be set.
+                                                    rule: 'self.type == ''Binary''
+                                                      ? has(self.binary) : !has(self.binary)'
+                                              type: object
+                                            timeout:
+                                              default: 1s
+                                              description: Timeout defines the time
+                                                to wait for a health check response.
+                                              format: duration
+                                              type: string
+                                            type:
+                                              allOf:
+                                              - enum:
+                                                - HTTP
+                                                - TCP
+                                              - enum:
+                                                - HTTP
+                                                - TCP
+                                              description: Type defines the type of
+                                                health checker.
+                                              type: string
+                                            unhealthyThreshold:
+                                              default: 3
+                                              description: UnhealthyThreshold defines
+                                                the number of unhealthy health checks
+                                                required before a backend host is
+                                                marked unhealthy.
+                                              format: int32
+                                              minimum: 1
+                                              type: integer
+                                          required:
+                                          - type
+                                          type: object
+                                          x-kubernetes-validations:
+                                          - message: If Health Checker type is HTTP,
+                                              http field needs to be set.
+                                            rule: 'self.type == ''HTTP'' ? has(self.http)
+                                              : !has(self.http)'
+                                          - message: If Health Checker type is TCP,
+                                              tcp field needs to be set.
+                                            rule: 'self.type == ''TCP'' ? has(self.tcp)
+                                              : !has(self.tcp)'
+                                        passive:
+                                          description: Passive passive check configuration
+                                          properties:
+                                            baseEjectionTime:
+                                              default: 30s
+                                              description: BaseEjectionTime defines
+                                                the base duration for which a host
+                                                will be ejected on consecutive failures.
+                                              format: duration
+                                              type: string
+                                            consecutive5XxErrors:
+                                              default: 5
+                                              description: Consecutive5xxErrors sets
+                                                the number of consecutive 5xx errors
+                                                triggering ejection.
+                                              format: int32
+                                              type: integer
+                                            consecutiveGatewayErrors:
+                                              default: 0
+                                              description: ConsecutiveGatewayErrors
+                                                sets the number of consecutive gateway
+                                                errors triggering ejection.
+                                              format: int32
+                                              type: integer
+                                            consecutiveLocalOriginFailures:
+                                              default: 5
+                                              description: |-
+                                                ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.
+                                                Parameter takes effect only when split_external_local_origin_errors is set to true.
+                                              format: int32
+                                              type: integer
+                                            interval:
+                                              default: 3s
+                                              description: Interval defines the time
+                                                between passive health checks.
+                                              format: duration
+                                              type: string
+                                            maxEjectionPercent:
+                                              default: 10
+                                              description: MaxEjectionPercent sets
+                                                the maximum percentage of hosts in
+                                                a cluster that can be ejected.
+                                              format: int32
+                                              type: integer
+                                            splitExternalLocalOriginErrors:
+                                              default: false
+                                              description: SplitExternalLocalOriginErrors
+                                                enables splitting of errors between
+                                                external and local origin.
+                                              type: boolean
+                                          type: object
+                                      type: object
+                                    http2:
+                                      description: HTTP2 provides HTTP/2 configuration
+                                        for backend connections.
+                                      properties:
+                                        initialConnectionWindowSize:
+                                          allOf:
+                                          - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          description: |-
+                                            InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.
+                                            If not set, the default value is 1 MiB.
+                                          x-kubernetes-int-or-string: true
+                                        initialStreamWindowSize:
+                                          allOf:
+                                          - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                          - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                          anyOf:
+                                          - type: integer
+                                          - type: string
+                                          description: |-
+                                            InitialStreamWindowSize sets the initial window size for HTTP/2 streams.
+                                            If not set, the default value is 64 KiB(64*1024).
+                                          x-kubernetes-int-or-string: true
+                                        maxConcurrentStreams:
+                                          description: |-
+                                            MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.
+                                            If not set, the default value is 100.
+                                          format: int32
+                                          maximum: 2147483647
+                                          minimum: 1
+                                          type: integer
+                                        onInvalidMessage:
+                                          description: |-
+                                            OnInvalidMessage determines if Envoy will terminate the connection or just the offending stream in the event of HTTP messaging error
+                                            It's recommended for L2 Envoy deployments to set this value to TerminateStream.
+                                            https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/level_two
+                                            Default: TerminateConnection
+                                          type: string
+                                      type: object
+                                    loadBalancer:
+                                      description: |-
+                                        LoadBalancer policy to apply when routing traffic from the gateway to
+                                        the backend endpoints
+                                      properties:
+                                        consistentHash:
+                                          description: |-
+                                            ConsistentHash defines the configuration when the load balancer type is
+                                            set to ConsistentHash
+                                          properties:
+                                            cookie:
+                                              description: Cookie configures the cookie
+                                                hash policy when the consistent hash
+                                                type is set to Cookie.
+                                              properties:
+                                                attributes:
+                                                  additionalProperties:
+                                                    type: string
+                                                  description: Additional Attributes
+                                                    to set for the generated cookie.
+                                                  type: object
+                                                name:
+                                                  description: |-
+                                                    Name of the cookie to hash.
+                                                    If this cookie does not exist in the request, Envoy will generate a cookie and set
+                                                    the TTL on the response back to the client based on Layer 4
+                                                    attributes of the backend endpoint, to ensure that these future requests
+                                                    go to the same backend endpoint. Make sure to set the TTL field for this case.
+                                                  type: string
+                                                ttl:
+                                                  description: |-
+                                                    TTL of the generated cookie if the cookie is not present. This value sets the
+                                                    Max-Age attribute value.
+                                                  type: string
+                                              required:
+                                              - name
+                                              type: object
+                                            header:
+                                              description: Header configures the header
+                                                hash policy when the consistent hash
+                                                type is set to Header.
+                                              properties:
+                                                name:
+                                                  description: Name of the header
+                                                    to hash.
+                                                  type: string
+                                              required:
+                                              - name
+                                              type: object
+                                            tableSize:
+                                              default: 65537
+                                              description: The table size for consistent
+                                                hashing, must be prime number limited
+                                                to 5000011.
+                                              format: int64
+                                              maximum: 5000011
+                                              minimum: 2
+                                              type: integer
+                                            type:
+                                              description: |-
+                                                ConsistentHashType defines the type of input to hash on. Valid Type values are
+                                                "SourceIP",
+                                                "Header",
+                                                "Cookie".
+                                              enum:
+                                              - SourceIP
+                                              - Header
+                                              - Cookie
+                                              type: string
+                                          required:
+                                          - type
+                                          type: object
+                                          x-kubernetes-validations:
+                                          - message: If consistent hash type is header,
+                                              the header field must be set.
+                                            rule: 'self.type == ''Header'' ? has(self.header)
+                                              : !has(self.header)'
+                                          - message: If consistent hash type is cookie,
+                                              the cookie field must be set.
+                                            rule: 'self.type == ''Cookie'' ? has(self.cookie)
+                                              : !has(self.cookie)'
+                                        slowStart:
+                                          description: |-
+                                            SlowStart defines the configuration related to the slow start load balancer policy.
+                                            If set, during slow start window, traffic sent to the newly added hosts will gradually increase.
+                                            Currently this is only supported for RoundRobin and LeastRequest load balancers
+                                          properties:
+                                            window:
+                                              description: |-
+                                                Window defines the duration of the warm up period for newly added host.
+                                                During slow start window, traffic sent to the newly added hosts will gradually increase.
+                                                Currently only supports linear growth of traffic. For additional details,
+                                                see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                              type: string
+                                          required:
+                                          - window
+                                          type: object
+                                        type:
+                                          description: |-
+                                            Type decides the type of Load Balancer policy.
+                                            Valid LoadBalancerType values are
+                                            "ConsistentHash",
+                                            "LeastRequest",
+                                            "Random",
+                                            "RoundRobin".
+                                          enum:
+                                          - ConsistentHash
+                                          - LeastRequest
+                                          - Random
+                                          - RoundRobin
+                                          type: string
+                                      required:
+                                      - type
+                                      type: object
+                                      x-kubernetes-validations:
+                                      - message: If LoadBalancer type is consistentHash,
+                                          consistentHash field needs to be set.
+                                        rule: 'self.type == ''ConsistentHash'' ? has(self.consistentHash)
+                                          : !has(self.consistentHash)'
+                                      - message: Currently SlowStart is only supported
+                                          for RoundRobin and LeastRequest load balancers.
+                                        rule: 'self.type in [''Random'', ''ConsistentHash'']
+                                          ? !has(self.slowStart) : true '
+                                    proxyProtocol:
+                                      description: ProxyProtocol enables the Proxy
+                                        Protocol when communicating with the backend.
+                                      properties:
+                                        version:
+                                          description: |-
+                                            Version of ProxyProtol
+                                            Valid ProxyProtocolVersion values are
+                                            "V1"
+                                            "V2"
+                                          enum:
+                                          - V1
+                                          - V2
+                                          type: string
+                                      required:
+                                      - version
+                                      type: object
+                                    tcpKeepalive:
+                                      description: |-
+                                        TcpKeepalive settings associated with the upstream client connection.
+                                        Disabled by default.
+                                      properties:
+                                        idleTime:
+                                          description: |-
+                                            The duration a connection needs to be idle before keep-alive
+                                            probes start being sent.
+                                            The duration format is
+                                            Defaults to `7200s`.
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                          type: string
+                                        interval:
+                                          description: |-
+                                            The duration between keep-alive probes.
+                                            Defaults to `75s`.
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                          type: string
+                                        probes:
+                                          description: |-
+                                            The total number of unacknowledged probes to send before deciding
+                                            the connection is dead.
+                                            Defaults to 9.
+                                          format: int32
+                                          type: integer
+                                      type: object
+                                    timeout:
+                                      description: Timeout settings for the backend
+                                        connections.
+                                      properties:
+                                        http:
+                                          description: Timeout settings for HTTP.
+                                          properties:
+                                            connectionIdleTimeout:
+                                              description: |-
+                                                The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+                                                Default: 1 hour.
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                              type: string
+                                            maxConnectionDuration:
+                                              description: |-
+                                                The maximum duration of an HTTP connection.
+                                                Default: unlimited.
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                              type: string
+                                          type: object
+                                        tcp:
+                                          description: Timeout settings for TCP.
+                                          properties:
+                                            connectTimeout:
+                                              description: |-
+                                                The timeout for network connection establishment, including TCP and TLS handshakes.
+                                                Default: 10 seconds.
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                              type: string
+                                          type: object
+                                      type: object
+                                  type: object
+                                host:
+                                  description: |-
+                                    Host define the service hostname.
+                                    Deprecated: Use BackendRefs instead.
+                                  type: string
+                                port:
+                                  default: 4317
+                                  description: |-
+                                    Port defines the port the service is exposed on.
+                                    Deprecated: Use BackendRefs instead.
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 0
+                                  type: integer
+                              type: object
+                              x-kubernetes-validations:
+                              - message: host or backendRefs needs to be set
+                                rule: has(self.host) || self.backendRefs.size() >
+                                  0
+                              - message: BackendRefs must be used, backendRef is not
+                                  supported.
+                                rule: '!has(self.backendRef)'
+                              - message: only supports Service kind.
+                                rule: 'has(self.backendRefs) ? self.backendRefs.all(f,
+                                  f.kind == ''Service'') : true'
+                              - message: BackendRefs only supports Core group.
+                                rule: 'has(self.backendRefs) ? (self.backendRefs.all(f,
+                                  f.group == "")) : true'
+                            type:
+                              default: OpenTelemetry
+                              description: |-
+                                Type defines the metric sink type.
+                                EG currently only supports OpenTelemetry.
+                              enum:
+                              - OpenTelemetry
+                              type: string
+                          required:
+                          - type
+                          type: object
+                          x-kubernetes-validations:
+                          - message: If MetricSink type is OpenTelemetry, openTelemetry
+                              field needs to be set.
                             rule: 'self.type == ''OpenTelemetry'' ? has(self.openTelemetry)
                               : !has(self.openTelemetry)'
+                        maxItems: 16
                         type: array
                     type: object
                   tracing:
@@ -10884,11 +13008,91 @@ spec:
                       provider:
                         description: Provider defines the tracing provider.
                         properties:
+                          backendRef:
+                            description: |-
+                              BackendRef references a Kubernetes object that represents the
+                              backend server to which the authorization request will be sent.
+
+
+                              Deprecated: Use BackendRefs instead.
+                            properties:
+                              group:
+                                default: ""
+                                description: |-
+                                  Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                  When unspecified or empty string, core API group is inferred.
+                                maxLength: 253
+                                pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                type: string
+                              kind:
+                                default: Service
+                                description: |-
+                                  Kind is the Kubernetes resource kind of the referent. For example
+                                  "Service".
+
+
+                                  Defaults to "Service" when not specified.
+
+
+                                  ExternalName services can refer to CNAME DNS records that may live
+                                  outside of the cluster and as such are difficult to reason about in
+                                  terms of conformance. They also may not be safe to forward to (see
+                                  CVE-2021-25740 for more information). Implementations SHOULD NOT
+                                  support ExternalName Services.
+
+
+                                  Support: Core (Services with a type other than ExternalName)
+
+
+                                  Support: Implementation-specific (Services with type ExternalName)
+                                maxLength: 63
+                                minLength: 1
+                                pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                type: string
+                              name:
+                                description: Name is the name of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              namespace:
+                                description: |-
+                                  Namespace is the namespace of the backend. When unspecified, the local
+                                  namespace is inferred.
+
+
+                                  Note that when a namespace different than the local namespace is specified,
+                                  a ReferenceGrant object is required in the referent namespace to allow that
+                                  namespace's owner to accept the reference. See the ReferenceGrant
+                                  documentation for details.
+
+
+                                  Support: Core
+                                maxLength: 63
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                type: string
+                              port:
+                                description: |-
+                                  Port specifies the destination port number to use for this resource.
+                                  Port is required when the referent is a Kubernetes Service. In this
+                                  case, the port number is the service port number, not the target port.
+                                  For other resources, destination port might be derived from the referent
+                                  resource or this field.
+                                format: int32
+                                maximum: 65535
+                                minimum: 1
+                                type: integer
+                            required:
+                            - name
+                            type: object
+                            x-kubernetes-validations:
+                            - message: Must have port for Service reference
+                              rule: '(size(self.group) == 0 && self.kind == ''Service'')
+                                ? has(self.port) : true'
                           backendRefs:
                             description: |-
                               BackendRefs references a Kubernetes object that represents the
-                              backend server to which the trace will be sent.
-                              Only Service kind is supported for now.
+                              backend server to which the authorization request will be sent.
                             items:
                               description: BackendRef defines how an ObjectReference
                                 that is specific to BackendRef.
@@ -10966,13 +13170,607 @@ spec:
                               - message: Must have port for Service reference
                                 rule: '(size(self.group) == 0 && self.kind == ''Service'')
                                   ? has(self.port) : true'
-                            maxItems: 1
+                            maxItems: 16
                             type: array
-                            x-kubernetes-validations:
-                            - message: only support Service kind.
-                              rule: self.all(f, f.kind == 'Service')
-                            - message: BackendRefs only supports Core group.
-                              rule: self.all(f, f.group == '')
+                          backendSettings:
+                            description: |-
+                              BackendSettings holds configuration for managing the connection
+                              to the backend.
+                            properties:
+                              circuitBreaker:
+                                description: |-
+                                  Circuit Breaker settings for the upstream connections and requests.
+                                  If not set, circuit breakers will be enabled with the default thresholds
+                                properties:
+                                  maxConnections:
+                                    default: 1024
+                                    description: The maximum number of connections
+                                      that Envoy will establish to the referenced
+                                      backend defined within a xRoute rule.
+                                    format: int64
+                                    maximum: 4294967295
+                                    minimum: 0
+                                    type: integer
+                                  maxParallelRequests:
+                                    default: 1024
+                                    description: The maximum number of parallel requests
+                                      that Envoy will make to the referenced backend
+                                      defined within a xRoute rule.
+                                    format: int64
+                                    maximum: 4294967295
+                                    minimum: 0
+                                    type: integer
+                                  maxParallelRetries:
+                                    default: 1024
+                                    description: The maximum number of parallel retries
+                                      that Envoy will make to the referenced backend
+                                      defined within a xRoute rule.
+                                    format: int64
+                                    maximum: 4294967295
+                                    minimum: 0
+                                    type: integer
+                                  maxPendingRequests:
+                                    default: 1024
+                                    description: The maximum number of pending requests
+                                      that Envoy will queue to the referenced backend
+                                      defined within a xRoute rule.
+                                    format: int64
+                                    maximum: 4294967295
+                                    minimum: 0
+                                    type: integer
+                                  maxRequestsPerConnection:
+                                    description: |-
+                                      The maximum number of requests that Envoy will make over a single connection to the referenced backend defined within a xRoute rule.
+                                      Default: unlimited.
+                                    format: int64
+                                    maximum: 4294967295
+                                    minimum: 0
+                                    type: integer
+                                type: object
+                              connection:
+                                description: Connection includes backend connection
+                                  settings.
+                                properties:
+                                  bufferLimit:
+                                    allOf:
+                                    - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: |-
+                                      BufferLimit Soft limit on size of the cluster’s connections read and write buffers.
+                                      BufferLimit applies to connection streaming (maybe non-streaming) channel between processes, it's in user space.
+                                      If unspecified, an implementation defined default is applied (32768 bytes).
+                                      For example, 20Mi, 1Gi, 256Ki etc.
+                                      Note: that when the suffix is not provided, the value is interpreted as bytes.
+                                    x-kubernetes-int-or-string: true
+                                  socketBufferLimit:
+                                    allOf:
+                                    - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: |-
+                                      SocketBufferLimit provides configuration for the maximum buffer size in bytes for each socket
+                                      to backend.
+                                      SocketBufferLimit applies to socket streaming channel between TCP/IP stacks, it's in kernel space.
+                                      For example, 20Mi, 1Gi, 256Ki etc.
+                                      Note that when the suffix is not provided, the value is interpreted as bytes.
+                                    x-kubernetes-int-or-string: true
+                                type: object
+                              dns:
+                                description: DNS includes dns resolution settings.
+                                properties:
+                                  dnsRefreshRate:
+                                    description: |-
+                                      DNSRefreshRate specifies the rate at which DNS records should be refreshed.
+                                      Defaults to 30 seconds.
+                                    type: string
+                                  respectDnsTtl:
+                                    description: |-
+                                      RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.
+                                      If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.
+                                      Defaults to true.
+                                    type: boolean
+                                type: object
+                              healthCheck:
+                                description: HealthCheck allows gateway to perform
+                                  active health checking on backends.
+                                properties:
+                                  active:
+                                    description: Active health check configuration
+                                    properties:
+                                      healthyThreshold:
+                                        default: 1
+                                        description: HealthyThreshold defines the
+                                          number of healthy health checks required
+                                          before a backend host is marked healthy.
+                                        format: int32
+                                        minimum: 1
+                                        type: integer
+                                      http:
+                                        description: |-
+                                          HTTP defines the configuration of http health checker.
+                                          It's required while the health checker type is HTTP.
+                                        properties:
+                                          expectedResponse:
+                                            description: ExpectedResponse defines
+                                              a list of HTTP expected responses to
+                                              match.
+                                            properties:
+                                              binary:
+                                                description: Binary payload base64
+                                                  encoded.
+                                                format: byte
+                                                type: string
+                                              text:
+                                                description: Text payload in plain
+                                                  text.
+                                                type: string
+                                              type:
+                                                allOf:
+                                                - enum:
+                                                  - Text
+                                                  - Binary
+                                                - enum:
+                                                  - Text
+                                                  - Binary
+                                                description: Type defines the type
+                                                  of the payload.
+                                                type: string
+                                            required:
+                                            - type
+                                            type: object
+                                            x-kubernetes-validations:
+                                            - message: If payload type is Text, text
+                                                field needs to be set.
+                                              rule: 'self.type == ''Text'' ? has(self.text)
+                                                : !has(self.text)'
+                                            - message: If payload type is Binary,
+                                                binary field needs to be set.
+                                              rule: 'self.type == ''Binary'' ? has(self.binary)
+                                                : !has(self.binary)'
+                                          expectedStatuses:
+                                            description: |-
+                                              ExpectedStatuses defines a list of HTTP response statuses considered healthy.
+                                              Defaults to 200 only
+                                            items:
+                                              description: HTTPStatus defines the
+                                                http status code.
+                                              exclusiveMaximum: true
+                                              maximum: 600
+                                              minimum: 100
+                                              type: integer
+                                            type: array
+                                          method:
+                                            description: |-
+                                              Method defines the HTTP method used for health checking.
+                                              Defaults to GET
+                                            type: string
+                                          path:
+                                            description: Path defines the HTTP path
+                                              that will be requested during health
+                                              checking.
+                                            maxLength: 1024
+                                            minLength: 1
+                                            type: string
+                                        required:
+                                        - path
+                                        type: object
+                                      interval:
+                                        default: 3s
+                                        description: Interval defines the time between
+                                          active health checks.
+                                        format: duration
+                                        type: string
+                                      tcp:
+                                        description: |-
+                                          TCP defines the configuration of tcp health checker.
+                                          It's required while the health checker type is TCP.
+                                        properties:
+                                          receive:
+                                            description: Receive defines the expected
+                                              response payload.
+                                            properties:
+                                              binary:
+                                                description: Binary payload base64
+                                                  encoded.
+                                                format: byte
+                                                type: string
+                                              text:
+                                                description: Text payload in plain
+                                                  text.
+                                                type: string
+                                              type:
+                                                allOf:
+                                                - enum:
+                                                  - Text
+                                                  - Binary
+                                                - enum:
+                                                  - Text
+                                                  - Binary
+                                                description: Type defines the type
+                                                  of the payload.
+                                                type: string
+                                            required:
+                                            - type
+                                            type: object
+                                            x-kubernetes-validations:
+                                            - message: If payload type is Text, text
+                                                field needs to be set.
+                                              rule: 'self.type == ''Text'' ? has(self.text)
+                                                : !has(self.text)'
+                                            - message: If payload type is Binary,
+                                                binary field needs to be set.
+                                              rule: 'self.type == ''Binary'' ? has(self.binary)
+                                                : !has(self.binary)'
+                                          send:
+                                            description: Send defines the request
+                                              payload.
+                                            properties:
+                                              binary:
+                                                description: Binary payload base64
+                                                  encoded.
+                                                format: byte
+                                                type: string
+                                              text:
+                                                description: Text payload in plain
+                                                  text.
+                                                type: string
+                                              type:
+                                                allOf:
+                                                - enum:
+                                                  - Text
+                                                  - Binary
+                                                - enum:
+                                                  - Text
+                                                  - Binary
+                                                description: Type defines the type
+                                                  of the payload.
+                                                type: string
+                                            required:
+                                            - type
+                                            type: object
+                                            x-kubernetes-validations:
+                                            - message: If payload type is Text, text
+                                                field needs to be set.
+                                              rule: 'self.type == ''Text'' ? has(self.text)
+                                                : !has(self.text)'
+                                            - message: If payload type is Binary,
+                                                binary field needs to be set.
+                                              rule: 'self.type == ''Binary'' ? has(self.binary)
+                                                : !has(self.binary)'
+                                        type: object
+                                      timeout:
+                                        default: 1s
+                                        description: Timeout defines the time to wait
+                                          for a health check response.
+                                        format: duration
+                                        type: string
+                                      type:
+                                        allOf:
+                                        - enum:
+                                          - HTTP
+                                          - TCP
+                                        - enum:
+                                          - HTTP
+                                          - TCP
+                                        description: Type defines the type of health
+                                          checker.
+                                        type: string
+                                      unhealthyThreshold:
+                                        default: 3
+                                        description: UnhealthyThreshold defines the
+                                          number of unhealthy health checks required
+                                          before a backend host is marked unhealthy.
+                                        format: int32
+                                        minimum: 1
+                                        type: integer
+                                    required:
+                                    - type
+                                    type: object
+                                    x-kubernetes-validations:
+                                    - message: If Health Checker type is HTTP, http
+                                        field needs to be set.
+                                      rule: 'self.type == ''HTTP'' ? has(self.http)
+                                        : !has(self.http)'
+                                    - message: If Health Checker type is TCP, tcp
+                                        field needs to be set.
+                                      rule: 'self.type == ''TCP'' ? has(self.tcp)
+                                        : !has(self.tcp)'
+                                  passive:
+                                    description: Passive passive check configuration
+                                    properties:
+                                      baseEjectionTime:
+                                        default: 30s
+                                        description: BaseEjectionTime defines the
+                                          base duration for which a host will be ejected
+                                          on consecutive failures.
+                                        format: duration
+                                        type: string
+                                      consecutive5XxErrors:
+                                        default: 5
+                                        description: Consecutive5xxErrors sets the
+                                          number of consecutive 5xx errors triggering
+                                          ejection.
+                                        format: int32
+                                        type: integer
+                                      consecutiveGatewayErrors:
+                                        default: 0
+                                        description: ConsecutiveGatewayErrors sets
+                                          the number of consecutive gateway errors
+                                          triggering ejection.
+                                        format: int32
+                                        type: integer
+                                      consecutiveLocalOriginFailures:
+                                        default: 5
+                                        description: |-
+                                          ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.
+                                          Parameter takes effect only when split_external_local_origin_errors is set to true.
+                                        format: int32
+                                        type: integer
+                                      interval:
+                                        default: 3s
+                                        description: Interval defines the time between
+                                          passive health checks.
+                                        format: duration
+                                        type: string
+                                      maxEjectionPercent:
+                                        default: 10
+                                        description: MaxEjectionPercent sets the maximum
+                                          percentage of hosts in a cluster that can
+                                          be ejected.
+                                        format: int32
+                                        type: integer
+                                      splitExternalLocalOriginErrors:
+                                        default: false
+                                        description: SplitExternalLocalOriginErrors
+                                          enables splitting of errors between external
+                                          and local origin.
+                                        type: boolean
+                                    type: object
+                                type: object
+                              http2:
+                                description: HTTP2 provides HTTP/2 configuration for
+                                  backend connections.
+                                properties:
+                                  initialConnectionWindowSize:
+                                    allOf:
+                                    - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: |-
+                                      InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.
+                                      If not set, the default value is 1 MiB.
+                                    x-kubernetes-int-or-string: true
+                                  initialStreamWindowSize:
+                                    allOf:
+                                    - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                    - pattern: ^[1-9]+[0-9]*([EPTGMK]i|[EPTGMk])?$
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: |-
+                                      InitialStreamWindowSize sets the initial window size for HTTP/2 streams.
+                                      If not set, the default value is 64 KiB(64*1024).
+                                    x-kubernetes-int-or-string: true
+                                  maxConcurrentStreams:
+                                    description: |-
+                                      MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.
+                                      If not set, the default value is 100.
+                                    format: int32
+                                    maximum: 2147483647
+                                    minimum: 1
+                                    type: integer
+                                  onInvalidMessage:
+                                    description: |-
+                                      OnInvalidMessage determines if Envoy will terminate the connection or just the offending stream in the event of HTTP messaging error
+                                      It's recommended for L2 Envoy deployments to set this value to TerminateStream.
+                                      https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/level_two
+                                      Default: TerminateConnection
+                                    type: string
+                                type: object
+                              loadBalancer:
+                                description: |-
+                                  LoadBalancer policy to apply when routing traffic from the gateway to
+                                  the backend endpoints
+                                properties:
+                                  consistentHash:
+                                    description: |-
+                                      ConsistentHash defines the configuration when the load balancer type is
+                                      set to ConsistentHash
+                                    properties:
+                                      cookie:
+                                        description: Cookie configures the cookie
+                                          hash policy when the consistent hash type
+                                          is set to Cookie.
+                                        properties:
+                                          attributes:
+                                            additionalProperties:
+                                              type: string
+                                            description: Additional Attributes to
+                                              set for the generated cookie.
+                                            type: object
+                                          name:
+                                            description: |-
+                                              Name of the cookie to hash.
+                                              If this cookie does not exist in the request, Envoy will generate a cookie and set
+                                              the TTL on the response back to the client based on Layer 4
+                                              attributes of the backend endpoint, to ensure that these future requests
+                                              go to the same backend endpoint. Make sure to set the TTL field for this case.
+                                            type: string
+                                          ttl:
+                                            description: |-
+                                              TTL of the generated cookie if the cookie is not present. This value sets the
+                                              Max-Age attribute value.
+                                            type: string
+                                        required:
+                                        - name
+                                        type: object
+                                      header:
+                                        description: Header configures the header
+                                          hash policy when the consistent hash type
+                                          is set to Header.
+                                        properties:
+                                          name:
+                                            description: Name of the header to hash.
+                                            type: string
+                                        required:
+                                        - name
+                                        type: object
+                                      tableSize:
+                                        default: 65537
+                                        description: The table size for consistent
+                                          hashing, must be prime number limited to
+                                          5000011.
+                                        format: int64
+                                        maximum: 5000011
+                                        minimum: 2
+                                        type: integer
+                                      type:
+                                        description: |-
+                                          ConsistentHashType defines the type of input to hash on. Valid Type values are
+                                          "SourceIP",
+                                          "Header",
+                                          "Cookie".
+                                        enum:
+                                        - SourceIP
+                                        - Header
+                                        - Cookie
+                                        type: string
+                                    required:
+                                    - type
+                                    type: object
+                                    x-kubernetes-validations:
+                                    - message: If consistent hash type is header,
+                                        the header field must be set.
+                                      rule: 'self.type == ''Header'' ? has(self.header)
+                                        : !has(self.header)'
+                                    - message: If consistent hash type is cookie,
+                                        the cookie field must be set.
+                                      rule: 'self.type == ''Cookie'' ? has(self.cookie)
+                                        : !has(self.cookie)'
+                                  slowStart:
+                                    description: |-
+                                      SlowStart defines the configuration related to the slow start load balancer policy.
+                                      If set, during slow start window, traffic sent to the newly added hosts will gradually increase.
+                                      Currently this is only supported for RoundRobin and LeastRequest load balancers
+                                    properties:
+                                      window:
+                                        description: |-
+                                          Window defines the duration of the warm up period for newly added host.
+                                          During slow start window, traffic sent to the newly added hosts will gradually increase.
+                                          Currently only supports linear growth of traffic. For additional details,
+                                          see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                        type: string
+                                    required:
+                                    - window
+                                    type: object
+                                  type:
+                                    description: |-
+                                      Type decides the type of Load Balancer policy.
+                                      Valid LoadBalancerType values are
+                                      "ConsistentHash",
+                                      "LeastRequest",
+                                      "Random",
+                                      "RoundRobin".
+                                    enum:
+                                    - ConsistentHash
+                                    - LeastRequest
+                                    - Random
+                                    - RoundRobin
+                                    type: string
+                                required:
+                                - type
+                                type: object
+                                x-kubernetes-validations:
+                                - message: If LoadBalancer type is consistentHash,
+                                    consistentHash field needs to be set.
+                                  rule: 'self.type == ''ConsistentHash'' ? has(self.consistentHash)
+                                    : !has(self.consistentHash)'
+                                - message: Currently SlowStart is only supported for
+                                    RoundRobin and LeastRequest load balancers.
+                                  rule: 'self.type in [''Random'', ''ConsistentHash'']
+                                    ? !has(self.slowStart) : true '
+                              proxyProtocol:
+                                description: ProxyProtocol enables the Proxy Protocol
+                                  when communicating with the backend.
+                                properties:
+                                  version:
+                                    description: |-
+                                      Version of ProxyProtol
+                                      Valid ProxyProtocolVersion values are
+                                      "V1"
+                                      "V2"
+                                    enum:
+                                    - V1
+                                    - V2
+                                    type: string
+                                required:
+                                - version
+                                type: object
+                              tcpKeepalive:
+                                description: |-
+                                  TcpKeepalive settings associated with the upstream client connection.
+                                  Disabled by default.
+                                properties:
+                                  idleTime:
+                                    description: |-
+                                      The duration a connection needs to be idle before keep-alive
+                                      probes start being sent.
+                                      The duration format is
+                                      Defaults to `7200s`.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                    type: string
+                                  interval:
+                                    description: |-
+                                      The duration between keep-alive probes.
+                                      Defaults to `75s`.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                    type: string
+                                  probes:
+                                    description: |-
+                                      The total number of unacknowledged probes to send before deciding
+                                      the connection is dead.
+                                      Defaults to 9.
+                                    format: int32
+                                    type: integer
+                                type: object
+                              timeout:
+                                description: Timeout settings for the backend connections.
+                                properties:
+                                  http:
+                                    description: Timeout settings for HTTP.
+                                    properties:
+                                      connectionIdleTimeout:
+                                        description: |-
+                                          The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+                                          Default: 1 hour.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                        type: string
+                                      maxConnectionDuration:
+                                        description: |-
+                                          The maximum duration of an HTTP connection.
+                                          Default: unlimited.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                        type: string
+                                    type: object
+                                  tcp:
+                                    description: Timeout settings for TCP.
+                                    properties:
+                                      connectTimeout:
+                                        description: |-
+                                          The timeout for network connection establishment, including TCP and TLS handshakes.
+                                          Default: 10 seconds.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                                        type: string
+                                    type: object
+                                type: object
+                            type: object
                           host:
                             description: |-
                               Host define the provider service hostname.
@@ -11015,6 +13813,14 @@ spec:
                         x-kubernetes-validations:
                         - message: host or backendRefs needs to be set
                           rule: has(self.host) || self.backendRefs.size() > 0
+                        - message: BackendRefs must be used, backendRef is not supported.
+                          rule: '!has(self.backendRef)'
+                        - message: only supports Service kind.
+                          rule: 'has(self.backendRefs) ? self.backendRefs.all(f, f.kind
+                            == ''Service'') : true'
+                        - message: BackendRefs only supports Core group.
+                          rule: 'has(self.backendRefs) ? (self.backendRefs.all(f,
+                            f.group == "")) : true'
                       samplingRate:
                         default: 100
                         description: |-
diff --git a/examples/extension-server/go.mod b/examples/extension-server/go.mod
index a1c8e2fc4..f20e9f23b 100644
--- a/examples/extension-server/go.mod
+++ b/examples/extension-server/go.mod
@@ -30,7 +30,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 // indirect
 	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/sys v0.22.0 // indirect
+	golang.org/x/sys v0.23.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
diff --git a/examples/extension-server/go.sum b/examples/extension-server/go.sum
index e6a6ba81b..2b8472bc0 100644
--- a/examples/extension-server/go.sum
+++ b/examples/extension-server/go.sum
@@ -84,8 +84,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
-golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
+golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
diff --git a/go.mod b/go.mod
index e66adb8a3..e23ce14ff 100644
--- a/go.mod
+++ b/go.mod
@@ -44,7 +44,7 @@ require (
 	go.opentelemetry.io/proto/otlp v1.3.1
 	go.uber.org/zap v1.27.0
 	golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8
-	golang.org/x/sys v0.22.0
+	golang.org/x/sys v0.23.0
 	google.golang.org/grpc v1.65.0
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v3 v3.0.1
diff --git a/go.sum b/go.sum
index ed3fe16fa..cdfd32616 100644
--- a/go.sum
+++ b/go.sum
@@ -1447,8 +1447,8 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
-golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
+golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
diff --git a/internal/gatewayapi/listener.go b/internal/gatewayapi/listener.go
index adbd302b9..b63645a85 100644
--- a/internal/gatewayapi/listener.go
+++ b/internal/gatewayapi/listener.go
@@ -313,7 +313,7 @@ func (t *Translator) processAccessLog(envoyproxy *egv1a1.EnvoyProxy, resources *
 				}
 
 				// TODO: how to get authority from the backendRefs?
-				ds, err := t.processBackendRefs(sink.ALS.BackendRefs, envoyproxy.Namespace, resources, envoyproxy)
+				ds, traffic, err := t.processBackendRefs(sink.ALS.BackendCluster, envoyproxy.Namespace, resources, envoyproxy)
 				if err != nil {
 					return nil, err
 				}
@@ -324,6 +324,7 @@ func (t *Translator) processAccessLog(envoyproxy *egv1a1.EnvoyProxy, resources *
 						Name:     fmt.Sprintf("accesslog_als_%d_%d", i, j), // TODO: rename this, so that we can share backend with tracing?
 						Settings: ds,
 					},
+					Traffic:    traffic,
 					Type:       sink.ALS.Type,
 					CELMatches: validExprs,
 				}
@@ -350,20 +351,20 @@ func (t *Translator) processAccessLog(envoyproxy *egv1a1.EnvoyProxy, resources *
 					continue
 				}
 
-				// TODO: remove support for Host/Port in v1.2
-				al := &ir.OpenTelemetryAccessLog{
-					CELMatches: validExprs,
-					Resources:  sink.OpenTelemetry.Resources,
-				}
-
 				// TODO: how to get authority from the backendRefs?
-				ds, err := t.processBackendRefs(sink.OpenTelemetry.BackendRefs, envoyproxy.Namespace, resources, envoyproxy)
+				ds, traffic, err := t.processBackendRefs(sink.OpenTelemetry.BackendCluster, envoyproxy.Namespace, resources, envoyproxy)
 				if err != nil {
 					return nil, err
 				}
-				al.Destination = ir.RouteDestination{
-					Name:     fmt.Sprintf("accesslog_otel_%d_%d", i, j), // TODO: rename this, so that we can share backend with tracing?
-					Settings: ds,
+				// TODO: remove support for Host/Port in v1.2
+				al := &ir.OpenTelemetryAccessLog{
+					CELMatches: validExprs,
+					Resources:  sink.OpenTelemetry.Resources,
+					Destination: ir.RouteDestination{
+						Name:     fmt.Sprintf("accesslog_otel_%d_%d", i, j), // TODO: rename this, so that we can share backend with tracing?
+						Settings: ds,
+					},
+					Traffic: traffic,
 				}
 
 				if len(ds) == 0 {
@@ -401,7 +402,7 @@ func (t *Translator) processTracing(gw *gwapiv1.Gateway, envoyproxy *egv1a1.Envo
 	tracing := envoyproxy.Spec.Telemetry.Tracing
 
 	// TODO: how to get authority from the backendRefs?
-	ds, err := t.processBackendRefs(tracing.Provider.BackendRefs, envoyproxy.Namespace, resources, envoyproxy)
+	ds, traffic, err := t.processBackendRefs(tracing.Provider.BackendCluster, envoyproxy.Namespace, resources, envoyproxy)
 	if err != nil {
 		return nil, err
 	}
@@ -440,6 +441,7 @@ func (t *Translator) processTracing(gw *gwapiv1.Gateway, envoyproxy *egv1a1.Envo
 			Settings: ds,
 		},
 		Provider: tracing.Provider,
+		Traffic:  traffic,
 	}, nil
 }
 
@@ -455,7 +457,7 @@ func (t *Translator) processMetrics(envoyproxy *egv1a1.EnvoyProxy, resources *Re
 			continue
 		}
 
-		_, err := t.processBackendRefs(sink.OpenTelemetry.BackendRefs, envoyproxy.Namespace, resources, envoyproxy)
+		_, _, err := t.processBackendRefs(sink.OpenTelemetry.BackendCluster, envoyproxy.Namespace, resources, envoyproxy)
 		if err != nil {
 			return nil, err
 		}
@@ -467,25 +469,29 @@ func (t *Translator) processMetrics(envoyproxy *egv1a1.EnvoyProxy, resources *Re
 	}, nil
 }
 
-func (t *Translator) processBackendRefs(backendRefs []egv1a1.BackendRef, namespace string, resources *Resources, envoyProxy *egv1a1.EnvoyProxy) ([]*ir.DestinationSetting, error) {
-	result := make([]*ir.DestinationSetting, 0, len(backendRefs))
-	for _, ref := range backendRefs {
+func (t *Translator) processBackendRefs(backendCluster egv1a1.BackendCluster, namespace string, resources *Resources, envoyProxy *egv1a1.EnvoyProxy) ([]*ir.DestinationSetting, *ir.TrafficFeatures, error) {
+	traffic, err := translateTrafficFeatures(backendCluster.BackendSettings)
+	if err != nil {
+		return nil, nil, err
+	}
+	result := make([]*ir.DestinationSetting, 0, len(backendCluster.BackendRefs))
+	for _, ref := range backendCluster.BackendRefs {
 		ns := NamespaceDerefOr(ref.Namespace, namespace)
 		kind := KindDerefOr(ref.Kind, KindService)
 		if kind != KindService {
-			return nil, errors.New("only service kind is supported for backendRefs")
+			return nil, nil, errors.New("only service kind is supported for backendRefs")
 		}
 		if err := validateBackendService(ref.BackendObjectReference, resources, ns, corev1.ProtocolTCP); err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		ds := t.processServiceDestinationSetting(ref.BackendObjectReference, ns, ir.TCP, resources, envoyProxy)
 		result = append(result, ds)
 	}
 	if len(result) == 0 {
-		return nil, nil
+		return nil, traffic, nil
 	}
-	return result, nil
+	return result, traffic, nil
 }
 
 func destinationSettingFromHostAndPort(host string, port uint32) []*ir.DestinationSetting {
diff --git a/internal/infrastructure/kubernetes/proxy/resource.go b/internal/infrastructure/kubernetes/proxy/resource.go
index 5045de639..406694be9 100644
--- a/internal/infrastructure/kubernetes/proxy/resource.go
+++ b/internal/infrastructure/kubernetes/proxy/resource.go
@@ -226,9 +226,9 @@ func expectedProxyContainers(infra *ir.ProxyInfra,
 					},
 				},
 				TimeoutSeconds:   1,
-				PeriodSeconds:    10,
+				PeriodSeconds:    5,
 				SuccessThreshold: 1,
-				FailureThreshold: 3,
+				FailureThreshold: 1,
 			},
 			Lifecycle: &corev1.Lifecycle{
 				PreStop: &corev1.LifecycleHandler{
diff --git a/internal/infrastructure/kubernetes/ratelimit/resource.go b/internal/infrastructure/kubernetes/ratelimit/resource.go
index 162396f62..b2fd1c3f6 100644
--- a/internal/infrastructure/kubernetes/ratelimit/resource.go
+++ b/internal/infrastructure/kubernetes/ratelimit/resource.go
@@ -184,9 +184,9 @@ func expectedRateLimitContainers(rateLimit *egv1a1.RateLimit, rateLimitDeploymen
 					},
 				},
 				TimeoutSeconds:   1,
-				PeriodSeconds:    10,
+				PeriodSeconds:    5,
 				SuccessThreshold: 1,
-				FailureThreshold: 3,
+				FailureThreshold: 1,
 			},
 		},
 	}
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index 5e9cb6ac4..6ba04e5e2 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -1657,6 +1657,7 @@ type ALSAccessLog struct {
 	CELMatches  []string                          `json:"celMatches,omitempty" yaml:"celMatches,omitempty"`
 	LogName     string                            `json:"name" yaml:"name"`
 	Destination RouteDestination                  `json:"destination,omitempty" yaml:"destination,omitempty"`
+	Traffic     *TrafficFeatures                  `json:"traffic,omitempty" yaml:"traffic,omitempty"`
 	Type        egv1a1.ALSEnvoyProxyAccessLogType `json:"type" yaml:"type"`
 	Text        *string                           `json:"text,omitempty" yaml:"text,omitempty"`
 	Attributes  map[string]string                 `json:"attributes,omitempty" yaml:"attributes,omitempty"`
@@ -1680,6 +1681,7 @@ type OpenTelemetryAccessLog struct {
 	Attributes  map[string]string `json:"attributes,omitempty" yaml:"attributes,omitempty"`
 	Resources   map[string]string `json:"resources,omitempty" yaml:"resources,omitempty"`
 	Destination RouteDestination  `json:"destination,omitempty" yaml:"destination,omitempty"`
+	Traffic     *TrafficFeatures  `json:"traffic,omitempty" yaml:"traffic,omitempty"`
 }
 
 // EnvoyPatchPolicy defines the intermediate representation of the EnvoyPatchPolicy resource.
@@ -1738,6 +1740,7 @@ type Tracing struct {
 	SamplingRate float64                     `json:"samplingRate,omitempty"`
 	CustomTags   map[string]egv1a1.CustomTag `json:"customTags,omitempty"`
 	Destination  RouteDestination            `json:"destination,omitempty"`
+	Traffic      *TrafficFeatures            `json:"traffic,omitempty"`
 	Provider     egv1a1.TracingProvider      `json:"provider"`
 }
 
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index 7d453c5f5..c51c386ee 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -25,6 +25,11 @@ func (in *ALSAccessLog) DeepCopyInto(out *ALSAccessLog) {
 		copy(*out, *in)
 	}
 	in.Destination.DeepCopyInto(&out.Destination)
+	if in.Traffic != nil {
+		in, out := &in.Traffic, &out.Traffic
+		*out = new(TrafficFeatures)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.Text != nil {
 		in, out := &in.Text, &out.Text
 		*out = new(string)
@@ -1830,6 +1835,11 @@ func (in *OpenTelemetryAccessLog) DeepCopyInto(out *OpenTelemetryAccessLog) {
 		}
 	}
 	in.Destination.DeepCopyInto(&out.Destination)
+	if in.Traffic != nil {
+		in, out := &in.Traffic, &out.Traffic
+		*out = new(TrafficFeatures)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenTelemetryAccessLog.
@@ -2837,6 +2847,11 @@ func (in *Tracing) DeepCopyInto(out *Tracing) {
 		}
 	}
 	in.Destination.DeepCopyInto(&out.Destination)
+	if in.Traffic != nil {
+		in, out := &in.Traffic, &out.Traffic
+		*out = new(TrafficFeatures)
+		(*in).DeepCopyInto(*out)
+	}
 	in.Provider.DeepCopyInto(&out.Provider)
 }
 
diff --git a/internal/xds/translator/accesslog.go b/internal/xds/translator/accesslog.go
index 01c448b65..8acb6e4b0 100644
--- a/internal/xds/translator/accesslog.go
+++ b/internal/xds/translator/accesslog.go
@@ -478,14 +478,27 @@ func processClusterForAccessLog(tCtx *types.ResourceVersionTable, al *ir.AccessL
 	if al == nil {
 		return nil
 	}
-
 	// add clusters for ALS access logs
 	for _, als := range al.ALS {
+		traffic := als.Traffic
+		// Make sure that there are safe defaults for the traffic
+		if traffic == nil {
+			traffic = &ir.TrafficFeatures{}
+		}
 		if err := addXdsCluster(tCtx, &xdsClusterArgs{
-			name:         als.Destination.Name,
-			settings:     als.Destination.Settings,
-			tSocket:      nil,
-			endpointType: EndpointTypeStatic,
+			name:              als.Destination.Name,
+			settings:          als.Destination.Settings,
+			tSocket:           nil,
+			endpointType:      EndpointTypeStatic,
+			loadBalancer:      traffic.LoadBalancer,
+			proxyProtocol:     traffic.ProxyProtocol,
+			circuitBreaker:    traffic.CircuitBreaker,
+			healthCheck:       traffic.HealthCheck,
+			timeout:           traffic.Timeout,
+			tcpkeepalive:      traffic.TCPKeepalive,
+			backendConnection: traffic.BackendConnection,
+			dns:               traffic.DNS,
+			http2Settings:     traffic.HTTP2,
 		}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
 			return err
 		}
@@ -493,12 +506,27 @@ func processClusterForAccessLog(tCtx *types.ResourceVersionTable, al *ir.AccessL
 
 	// add clusters for Open Telemetry access logs
 	for _, otel := range al.OpenTelemetry {
+		traffic := otel.Traffic
+		// Make sure that there are safe defaults for the traffic
+		if traffic == nil {
+			traffic = &ir.TrafficFeatures{}
+		}
+
 		if err := addXdsCluster(tCtx, &xdsClusterArgs{
-			name:         otel.Destination.Name,
-			settings:     otel.Destination.Settings,
-			tSocket:      nil,
-			endpointType: EndpointTypeDNS,
-			metrics:      metrics,
+			name:              otel.Destination.Name,
+			settings:          otel.Destination.Settings,
+			tSocket:           nil,
+			endpointType:      EndpointTypeDNS,
+			metrics:           metrics,
+			loadBalancer:      traffic.LoadBalancer,
+			proxyProtocol:     traffic.ProxyProtocol,
+			circuitBreaker:    traffic.CircuitBreaker,
+			healthCheck:       traffic.HealthCheck,
+			timeout:           traffic.Timeout,
+			tcpkeepalive:      traffic.TCPKeepalive,
+			backendConnection: traffic.BackendConnection,
+			dns:               traffic.DNS,
+			http2Settings:     traffic.HTTP2,
 		}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
 			return err
 		}
diff --git a/internal/xds/translator/tracing.go b/internal/xds/translator/tracing.go
index b2a52ec6a..ad9a3ecc0 100644
--- a/internal/xds/translator/tracing.go
+++ b/internal/xds/translator/tracing.go
@@ -160,12 +160,26 @@ func processClusterForTracing(tCtx *types.ResourceVersionTable, tracing *ir.Trac
 		return nil
 	}
 
+	traffic := tracing.Traffic
+	// Make sure that there are safe defaults for the traffic
+	if traffic == nil {
+		traffic = &ir.TrafficFeatures{}
+	}
 	if err := addXdsCluster(tCtx, &xdsClusterArgs{
-		name:         tracing.Destination.Name,
-		settings:     tracing.Destination.Settings,
-		tSocket:      nil,
-		endpointType: EndpointTypeDNS,
-		metrics:      metrics,
+		name:              tracing.Destination.Name,
+		settings:          tracing.Destination.Settings,
+		tSocket:           nil,
+		endpointType:      EndpointTypeDNS,
+		metrics:           metrics,
+		loadBalancer:      traffic.LoadBalancer,
+		proxyProtocol:     traffic.ProxyProtocol,
+		circuitBreaker:    traffic.CircuitBreaker,
+		healthCheck:       traffic.HealthCheck,
+		timeout:           traffic.Timeout,
+		tcpkeepalive:      traffic.TCPKeepalive,
+		backendConnection: traffic.BackendConnection,
+		dns:               traffic.DNS,
+		http2Settings:     traffic.HTTP2,
 	}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
 		return err
 	}
diff --git a/site/content/en/docs/install/install-yaml.md b/site/content/en/docs/install/install-yaml.md
index e675f15fb..c0a8d1caa 100644
--- a/site/content/en/docs/install/install-yaml.md
+++ b/site/content/en/docs/install/install-yaml.md
@@ -13,7 +13,7 @@ installation, it is recommended that you use helm.
 
 Envoy Gateway is designed to run in Kubernetes for production. The most essential requirements are:
 
-* Kubernetes 1.25 or later
+* Kubernetes 1.27 or later
 * The `kubectl` command-line tool
 
 {{% alert title="Compatibility Matrix" color="warning" %}}
@@ -37,3 +37,31 @@ Refer to the [Developer Guide](../../contributions/develop) to learn more.
 2. Next Steps
 
    Envoy Gateway should now be successfully installed and running, but in order to experience more abilities of Envoy Gateway, you can refer to [Tasks](/latest/tasks).
+
+## Upgrading from v1.0
+
+Due to breaking changes in Gateway API v1.1, some manual migration steps are required to upgrade Envoy Gateway to v1.1.
+
+1. Delete `BackendTLSPolicy` CRD (and resources):
+
+```shell
+kubectl delete crd backendtlspolicies.gateway.networking.k8s.io
+```
+
+2. Update Gateway-API and Envoy Gateway CRDs:
+
+```shell
+helm pull oci://docker.io/envoyproxy/gateway-helm --version {{< yaml-version >}} --untar
+kubectl apply --force-conflicts --server-side -f ./gateway-helm/crds/gatewayapi-crds.yaml
+kubectl apply --force-conflicts --server-side -f ./gateway-helm/crds/generated
+```
+
+3. Update your `BackendTLSPolicy` and `GRPCRoute` resources according to Gateway-API [v1.1 Upgrade Notes](https://gateway-api.sigs.k8s.io/guides/#v11-upgrade-notes)
+
+4. Update your Envoy Gateway xPolicy resources: remove the namespace section from targetRef.
+
+5. Install Envoy Gateway {{< yaml-version >}}:
+
+```shell
+helm upgrade eg oci://docker.io/envoyproxy/gateway-helm --version {{< yaml-version >}} -n envoy-gateway-system
+```
diff --git a/site/content/en/docs/tasks/quickstart.md b/site/content/en/docs/tasks/quickstart.md
index 03d7b6de8..802b7989a 100644
--- a/site/content/en/docs/tasks/quickstart.md
+++ b/site/content/en/docs/tasks/quickstart.md
@@ -92,34 +92,6 @@ curl --verbose --header "Host: www.example.com" http://localhost:8888/get
 {{% /tab %}}
 {{< /tabpane >}}
 
-## v1.1 Upgrade Notes
-
-Due to breaking changes in the Gateway API v1.1, some manual migration steps are required to upgrade Envoy Gateway to v1.1. 
-
-Delete `BackendTLSPolicy` CRD (and resources): 
-
-```shell
-kubectl delete crd backendtlspolicies.gateway.networking.k8s.io
-```
-
-Update Gateway-API and Envoy Gateway CRDs:
-
-```shell
-helm pull oci://docker.io/envoyproxy/gateway-helm --version v1.1.0 --untar
-kubectl apply -f ./gateway-helm/crds/gatewayapi-crds.yaml
-kubectl apply -f ./gateway-helm/crds/generated
-```
-
-Update your `BackendTLSPolicy` and `GRPCRoute` resources according to Gateway-API [v1.1 Upgrade Notes](https://gateway-api.sigs.k8s.io/guides/#v11-upgrade-notes)
-
-Update your Envoy Gateway xPolicy resources: remove the namespace section from targetRef. 
-
-Install Envoy Gateway v1.1.0:
-
-```shell
-helm upgrade eg oci://docker.io/envoyproxy/gateway-helm --version v1.1.0 -n envoy-gateway-system 
-```
-
 ## What to explore next?
 
 In this quickstart, you have:
diff --git a/site/content/en/v1.1/install/install-yaml.md b/site/content/en/v1.1/install/install-yaml.md
index e675f15fb..c0a8d1caa 100644
--- a/site/content/en/v1.1/install/install-yaml.md
+++ b/site/content/en/v1.1/install/install-yaml.md
@@ -13,7 +13,7 @@ installation, it is recommended that you use helm.
 
 Envoy Gateway is designed to run in Kubernetes for production. The most essential requirements are:
 
-* Kubernetes 1.25 or later
+* Kubernetes 1.27 or later
 * The `kubectl` command-line tool
 
 {{% alert title="Compatibility Matrix" color="warning" %}}
@@ -37,3 +37,31 @@ Refer to the [Developer Guide](../../contributions/develop) to learn more.
 2. Next Steps
 
    Envoy Gateway should now be successfully installed and running, but in order to experience more abilities of Envoy Gateway, you can refer to [Tasks](/latest/tasks).
+
+## Upgrading from v1.0
+
+Due to breaking changes in Gateway API v1.1, some manual migration steps are required to upgrade Envoy Gateway to v1.1.
+
+1. Delete `BackendTLSPolicy` CRD (and resources):
+
+```shell
+kubectl delete crd backendtlspolicies.gateway.networking.k8s.io
+```
+
+2. Update Gateway-API and Envoy Gateway CRDs:
+
+```shell
+helm pull oci://docker.io/envoyproxy/gateway-helm --version {{< yaml-version >}} --untar
+kubectl apply --force-conflicts --server-side -f ./gateway-helm/crds/gatewayapi-crds.yaml
+kubectl apply --force-conflicts --server-side -f ./gateway-helm/crds/generated
+```
+
+3. Update your `BackendTLSPolicy` and `GRPCRoute` resources according to Gateway-API [v1.1 Upgrade Notes](https://gateway-api.sigs.k8s.io/guides/#v11-upgrade-notes)
+
+4. Update your Envoy Gateway xPolicy resources: remove the namespace section from targetRef.
+
+5. Install Envoy Gateway {{< yaml-version >}}:
+
+```shell
+helm upgrade eg oci://docker.io/envoyproxy/gateway-helm --version {{< yaml-version >}} -n envoy-gateway-system
+```
diff --git a/site/content/en/v1.1/tasks/quickstart.md b/site/content/en/v1.1/tasks/quickstart.md
index 03d7b6de8..802b7989a 100644
--- a/site/content/en/v1.1/tasks/quickstart.md
+++ b/site/content/en/v1.1/tasks/quickstart.md
@@ -92,34 +92,6 @@ curl --verbose --header "Host: www.example.com" http://localhost:8888/get
 {{% /tab %}}
 {{< /tabpane >}}
 
-## v1.1 Upgrade Notes
-
-Due to breaking changes in the Gateway API v1.1, some manual migration steps are required to upgrade Envoy Gateway to v1.1. 
-
-Delete `BackendTLSPolicy` CRD (and resources): 
-
-```shell
-kubectl delete crd backendtlspolicies.gateway.networking.k8s.io
-```
-
-Update Gateway-API and Envoy Gateway CRDs:
-
-```shell
-helm pull oci://docker.io/envoyproxy/gateway-helm --version v1.1.0 --untar
-kubectl apply -f ./gateway-helm/crds/gatewayapi-crds.yaml
-kubectl apply -f ./gateway-helm/crds/generated
-```
-
-Update your `BackendTLSPolicy` and `GRPCRoute` resources according to Gateway-API [v1.1 Upgrade Notes](https://gateway-api.sigs.k8s.io/guides/#v11-upgrade-notes)
-
-Update your Envoy Gateway xPolicy resources: remove the namespace section from targetRef. 
-
-Install Envoy Gateway v1.1.0:
-
-```shell
-helm upgrade eg oci://docker.io/envoyproxy/gateway-helm --version v1.1.0 -n envoy-gateway-system 
-```
-
 ## What to explore next?
 
 In this quickstart, you have:



Test patch:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.in.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.in.yaml
new file mode 100644
index 000000000..72d40451a
--- /dev/null
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.in.yaml
@@ -0,0 +1,196 @@
+envoyProxyForGatewayClass:
+  apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: envoy-gateway-system
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+        - format:
+            type: Text
+            text: |
+              [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+          sinks:
+          - type: File
+            file:
+              path: /dev/stdout
+          - type: ALS
+            als:
+              logName: accesslog
+              backendSettings:
+                http2:
+                  initialStreamWindowSize: 128Ki
+                  initialConnectionWindowSize: 2Mi
+                  maxConcurrentStreams: 200
+                  onInvalidMessage: TerminateStream
+                loadBalancer:
+                  type: ConsistentHash
+                  consistentHash:
+                    type: Header
+                    header:
+                      name: X-some-header
+                proxyProtocol:
+                  version: V2
+                tcpKeepalive:
+                  probes: 7
+                healthCheck:
+                  passive:
+                    consecutiveGatewayErrors: 4
+                    interval: 5s
+                circuitBreaker:
+                  maxConnections: 2048
+                timeout:
+                  tcp:
+                    connectTimeout: 15s
+                connection:
+                  bufferLimit: 20Mi
+              backendRefs:
+              - name: envoy-als
+                namespace: monitoring
+                port: 9000
+              http:
+                requestHeaders:
+                - x-client-ip-address
+                responseHeaders:
+                - cache-control
+                responseTrailers:
+                - expires
+              type: HTTP
+          - type: ALS
+            als:
+              backendRefs:
+              - name: envoy-als
+                namespace: monitoring
+                port: 9000
+              type: TCP
+          - type: OpenTelemetry
+            openTelemetry:
+              backendSettings:
+                http2:
+                  initialStreamWindowSize: 128Ki
+                  initialConnectionWindowSize: 2Mi
+                  maxConcurrentStreams: 200
+                  onInvalidMessage: TerminateStream
+                loadBalancer:
+                  type: ConsistentHash
+                  consistentHash:
+                    type: Header
+                    header:
+                      name: X-some-header
+                proxyProtocol:
+                  version: V2
+                tcpKeepalive:
+                  probes: 7
+                healthCheck:
+                  passive:
+                    consecutiveGatewayErrors: 4
+                    interval: 5s
+                circuitBreaker:
+                  maxConnections: 2048
+                timeout:
+                  tcp:
+                    connectTimeout: 15s
+                connection:
+                  bufferLimit: 20Mi
+              host: otel-collector.monitoring.svc.cluster.local
+              port: 4317
+              resources:
+                k8s.cluster.name: "cluster-1"
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-dev"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+services:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    name: envoy-als
+    namespace: monitoring
+  spec:
+    type: ClusterIP
+    ports:
+    - name: grpc
+      port: 9000
+      appProtocol: grpc
+      protocol: TCP
+      targetPort: 9000
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-envoy-als
+    namespace: monitoring
+    labels:
+      kubernetes.io/service-name: envoy-als
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    appProtocol: grpc
+    port: 9090
+  endpoints:
+  - addresses:
+    - "10.240.0.10"
+    conditions:
+      ready: true
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml
new file mode 100644
index 000000000..28ef831b0
--- /dev/null
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml
@@ -0,0 +1,326 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: gateway.envoyproxy.io/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: envoy-gateway-system
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-dev
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  text: |
+                    [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+                  type: Text
+                sinks:
+                - file:
+                    path: /dev/stdout
+                  type: File
+                - als:
+                    backendRefs:
+                    - name: envoy-als
+                      namespace: monitoring
+                      port: 9000
+                    backendSettings:
+                      circuitBreaker:
+                        maxConnections: 2048
+                      connection:
+                        bufferLimit: 20Mi
+                      healthCheck:
+                        passive:
+                          consecutiveGatewayErrors: 4
+                          interval: 5s
+                      http2:
+                        initialConnectionWindowSize: 2Mi
+                        initialStreamWindowSize: 128Ki
+                        maxConcurrentStreams: 200
+                        onInvalidMessage: TerminateStream
+                      loadBalancer:
+                        consistentHash:
+                          header:
+                            name: X-some-header
+                          type: Header
+                        type: ConsistentHash
+                      proxyProtocol:
+                        version: V2
+                      tcpKeepalive:
+                        probes: 7
+                      timeout:
+                        tcp:
+                          connectTimeout: 15s
+                    http:
+                      requestHeaders:
+                      - x-client-ip-address
+                      responseHeaders:
+                      - cache-control
+                      responseTrailers:
+                      - expires
+                    logName: accesslog
+                    type: HTTP
+                  type: ALS
+                - als:
+                    backendRefs:
+                    - name: envoy-als
+                      namespace: monitoring
+                      port: 9000
+                    type: TCP
+                  type: ALS
+                - openTelemetry:
+                    backendSettings:
+                      circuitBreaker:
+                        maxConnections: 2048
+                      connection:
+                        bufferLimit: 20Mi
+                      healthCheck:
+                        passive:
+                          consecutiveGatewayErrors: 4
+                          interval: 5s
+                      http2:
+                        initialConnectionWindowSize: 2Mi
+                        initialStreamWindowSize: 128Ki
+                        maxConcurrentStreams: 200
+                        onInvalidMessage: TerminateStream
+                      loadBalancer:
+                        consistentHash:
+                          header:
+                            name: X-some-header
+                          type: Header
+                        type: ConsistentHash
+                      proxyProtocol:
+                        version: V2
+                      tcpKeepalive:
+                        probes: 7
+                      timeout:
+                        tcp:
+                          connectTimeout: 15s
+                    host: otel-collector.monitoring.svc.cluster.local
+                    port: 4317
+                    resources:
+                      k8s.cluster.name: cluster-1
+                  type: OpenTelemetry
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      als:
+      - destination:
+          name: accesslog_als_0_1
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.240.0.10
+              port: 9090
+            protocol: GRPC
+        http:
+          requestHeaders:
+          - x-client-ip-address
+          responseHeaders:
+          - cache-control
+          responseTrailers:
+          - expires
+        name: accesslog
+        text: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+        traffic:
+          backendConnection:
+            bufferLimit: 20971520
+          circuitBreaker:
+            maxConnections: 2048
+          healthCheck:
+            passive:
+              consecutiveGatewayErrors: 4
+              interval: 5s
+          http2:
+            initialConnectionWindowSize: 131072
+            initialStreamWindowSize: 2097152
+            maxConcurrentStreams: 200
+            resetStreamOnError: true
+          loadBalancer:
+            consistentHash:
+              header:
+                name: X-some-header
+          proxyProtocol:
+            version: V2
+          tcpKeepalive:
+            probes: 7
+          timeout:
+            tcp:
+              connectTimeout: 15s
+        type: HTTP
+      - destination:
+          name: accesslog_als_0_2
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.240.0.10
+              port: 9090
+            protocol: GRPC
+        name: envoy-gateway-system/test
+        text: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+        type: TCP
+      openTelemetry:
+      - authority: otel-collector.monitoring.svc.cluster.local
+        destination:
+          name: accesslog_otel_0_3
+          settings:
+          - endpoints:
+            - host: otel-collector.monitoring.svc.cluster.local
+              port: 4317
+            protocol: GRPC
+            weight: 1
+        resources:
+          k8s.cluster.name: cluster-1
+        text: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+        traffic:
+          backendConnection:
+            bufferLimit: 20971520
+          circuitBreaker:
+            maxConnections: 2048
+          healthCheck:
+            passive:
+              consecutiveGatewayErrors: 4
+              interval: 5s
+          http2:
+            initialConnectionWindowSize: 131072
+            initialStreamWindowSize: 2097152
+            maxConcurrentStreams: 200
+            resetStreamOnError: true
+          loadBalancer:
+            consistentHash:
+              header:
+                name: X-some-header
+          proxyProtocol:
+            version: V2
+          tcpKeepalive:
+            probes: 7
+          timeout:
+            tcp:
+              connectTimeout: 15s
+      text:
+      - format: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+        path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/internal/gatewayapi/testdata/envoyproxy-tracing-backend.in.yaml b/internal/gatewayapi/testdata/envoyproxy-tracing-backend.in.yaml
index 9cd3485ce..4c06c5341 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tracing-backend.in.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tracing-backend.in.yaml
@@ -9,6 +9,33 @@ envoyProxyForGatewayClass:
       tracing:
         samplingRate: 100
         provider:
+          backendSettings:
+            http2:
+              initialStreamWindowSize: 128Ki
+              initialConnectionWindowSize: 2Mi
+              maxConcurrentStreams: 200
+              onInvalidMessage: TerminateStream
+            loadBalancer:
+              type: ConsistentHash
+              consistentHash:
+                type: Header
+                header:
+                  name: X-some-header
+            proxyProtocol:
+              version: V2
+            tcpKeepalive:
+              probes: 7
+            healthCheck:
+              passive:
+                consecutiveGatewayErrors: 4
+                interval: 5s
+            circuitBreaker:
+              maxConnections: 2048
+            timeout:
+              tcp:
+                connectTimeout: 15s
+            connection:
+              bufferLimit: 20Mi
           backendRefs:
           - name: otel-collector
             namespace: monitoring
diff --git a/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml
index 70e07bd18..b3a44d78f 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml
@@ -106,6 +106,33 @@ infraIR:
                 - name: otel-collector
                   namespace: monitoring
                   port: 4317
+                backendSettings:
+                  circuitBreaker:
+                    maxConnections: 2048
+                  connection:
+                    bufferLimit: 20Mi
+                  healthCheck:
+                    passive:
+                      consecutiveGatewayErrors: 4
+                      interval: 5s
+                  http2:
+                    initialConnectionWindowSize: 2Mi
+                    initialStreamWindowSize: 128Ki
+                    maxConcurrentStreams: 200
+                    onInvalidMessage: TerminateStream
+                  loadBalancer:
+                    consistentHash:
+                      header:
+                        name: X-some-header
+                      type: Header
+                    type: ConsistentHash
+                  proxyProtocol:
+                    version: V2
+                  tcpKeepalive:
+                    probes: 7
+                  timeout:
+                    tcp:
+                      connectTimeout: 15s
                 type: OpenTelemetry
               samplingRate: 100
         status: {}
@@ -156,6 +183,58 @@ xdsIR:
         - name: otel-collector
           namespace: monitoring
           port: 4317
+        backendSettings:
+          circuitBreaker:
+            maxConnections: 2048
+          connection:
+            bufferLimit: 20Mi
+          healthCheck:
+            passive:
+              consecutiveGatewayErrors: 4
+              interval: 5s
+          http2:
+            initialConnectionWindowSize: 2Mi
+            initialStreamWindowSize: 128Ki
+            maxConcurrentStreams: 200
+            onInvalidMessage: TerminateStream
+          loadBalancer:
+            consistentHash:
+              header:
+                name: X-some-header
+              type: Header
+            type: ConsistentHash
+          proxyProtocol:
+            version: V2
+          tcpKeepalive:
+            probes: 7
+          timeout:
+            tcp:
+              connectTimeout: 15s
         type: OpenTelemetry
       samplingRate: 100
       serviceName: gateway-1.envoy-gateway
+      traffic:
+        backendConnection:
+          bufferLimit: 20971520
+        circuitBreaker:
+          maxConnections: 2048
+        healthCheck:
+          passive:
+            consecutiveGatewayErrors: 4
+            interval: 5s
+        http2:
+          initialConnectionWindowSize: 131072
+          initialStreamWindowSize: 2097152
+          maxConcurrentStreams: 200
+          resetStreamOnError: true
+        loadBalancer:
+          consistentHash:
+            header:
+              name: X-some-header
+        proxyProtocol:
+          version: V2
+        tcpKeepalive:
+          probes: 7
+        timeout:
+          tcp:
+            connectTimeout: 15s
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml
index 062297731..7f1bc6c41 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml
@@ -74,12 +74,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
index 8f2752be0..992328202 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
@@ -258,12 +258,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
index 1d5a93c5b..b59b07a08 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
@@ -256,12 +256,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
index 7ee2909f8..0808d5c01 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
@@ -241,12 +241,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
index 7190df8f8..73bc60633 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
@@ -212,12 +212,12 @@ spec:
           name: EnvoyHTTPSPort
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
index 3ceb7cee0..4f2f396b7 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
@@ -260,12 +260,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
index 9b8a0fcaf..5391a4938 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
@@ -252,12 +252,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
index 970f58ba1..169eeb593 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
@@ -241,12 +241,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
index 3bb5ccbe6..725055a9f 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
@@ -242,12 +242,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
index 060e0d42b..b993f3bfb 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
@@ -260,12 +260,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
index ffc184f3f..c43c64302 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
@@ -246,12 +246,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml
index 850b8a251..568aa4164 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml
@@ -74,12 +74,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
index e75a89be5..612363ca2 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
@@ -243,12 +243,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
index 424eae5f2..a0324cb54 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
@@ -241,12 +241,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
index fb4fc761b..c31ea2450 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
@@ -241,12 +241,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
index 96a1e21f9..a0ebcf2e9 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
@@ -241,12 +241,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
index 7436383cc..e1d7c76a0 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
@@ -241,12 +241,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
index e98fd7311..b985e8d0f 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
@@ -77,12 +77,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
index edcfa7b53..445bf70d2 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
@@ -78,12 +78,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
index 88983936f..8af199519 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -263,12 +263,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
index 07ceadcfb..902de5049 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -263,12 +263,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
index 4000dacbd..992d976f4 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
@@ -261,12 +261,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
index 44777d51a..3bd69459a 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
@@ -245,12 +245,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
index bee1b5393..fa7078ae6 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
@@ -216,12 +216,12 @@ spec:
           name: EnvoyHTTPSPort
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
index e84fd418e..21ddbb9e6 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
@@ -265,12 +265,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
index 460de06f2..f3fca2808 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
@@ -256,12 +256,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
index 5fe7b4930..8d70d4d85 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
@@ -245,12 +245,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
index 9ab5e2cc0..9f70f8bb6 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
@@ -246,12 +246,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
index 51f0ccc3a..1395e60cb 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
@@ -265,12 +265,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
index cfc2685d4..1bb027eac 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
@@ -250,12 +250,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
index c01d19873..44e637081 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
@@ -78,12 +78,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
index ef9f75cc6..397b43b97 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
@@ -245,12 +245,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
index 81d0cbac1..a1aa0917b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
@@ -247,12 +247,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
index 83f2881be..572588700 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
@@ -245,12 +245,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
index f1dc2a9bc..2dd83e8e3 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
@@ -245,12 +245,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
index cc8f66c7e..72d297ca1 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
@@ -245,12 +245,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
index 4083f99d3..20fcb8589 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
@@ -245,12 +245,12 @@ spec:
           name: metrics
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /ready
             port: 19001
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/custom.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/custom.yaml
index c750b09a0..ebde9a4c4 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/custom.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/custom.yaml
@@ -87,12 +87,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default-env.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default-env.yaml
index c750b09a0..ebde9a4c4 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default-env.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default-env.yaml
@@ -87,12 +87,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default.yaml
index 277d5e649..b010414bd 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default.yaml
@@ -88,12 +88,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/disable-prometheus.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/disable-prometheus.yaml
index 0cbbd6dbb..449ed2c1d 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/disable-prometheus.yaml
@@ -84,12 +84,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing-custom.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing-custom.yaml
index 1d53f34a9..cbb129feb 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing-custom.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing-custom.yaml
@@ -103,12 +103,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing.yaml
index 56bd0a7df..867c5df1b 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing.yaml
@@ -103,12 +103,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/extension-env.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/extension-env.yaml
index 4468e0df0..e0bf55b5d 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/extension-env.yaml
@@ -91,12 +91,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/override-env.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/override-env.yaml
index 826deab69..03ff65426 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/override-env.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/override-env.yaml
@@ -87,12 +87,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/patch-deployment.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/patch-deployment.yaml
index 790de9e15..b7dea3664 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/patch-deployment.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/patch-deployment.yaml
@@ -88,12 +88,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/redis-tls-settings.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/redis-tls-settings.yaml
index e3e723c1d..9af52d675 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/redis-tls-settings.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/redis-tls-settings.yaml
@@ -95,12 +95,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/tolerations.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/tolerations.yaml
index 5cbedb988..7c965aa04 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/tolerations.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/tolerations.yaml
@@ -95,12 +95,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/volumes.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/volumes.yaml
index fcee6df45..4f69dea32 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/volumes.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/volumes.yaml
@@ -95,12 +95,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-node-selector.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-node-selector.yaml
index 1365ac63f..5d525b44d 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-node-selector.yaml
@@ -88,12 +88,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-topology-spread-constraints.yaml
index 1558a925c..e9a5fdd66 100644
--- a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-topology-spread-constraints.yaml
@@ -88,12 +88,12 @@ spec:
           name: grpc
           protocol: TCP
         readinessProbe:
-          failureThreshold: 3
+          failureThreshold: 1
           httpGet:
             path: /healthcheck
             port: 8080
             scheme: HTTP
-          periodSeconds: 10
+          periodSeconds: 5
           successThreshold: 1
           timeoutSeconds: 1
         resources:
diff --git a/internal/provider/kubernetes/predicates_test.go b/internal/provider/kubernetes/predicates_test.go
index 3f097f3f9..d5ac876f4 100644
--- a/internal/provider/kubernetes/predicates_test.go
+++ b/internal/provider/kubernetes/predicates_test.go
@@ -471,12 +471,14 @@ func TestValidateServiceForReconcile(t *testing.T) {
 								{
 									Type: egv1a1.ProxyAccessLogSinkTypeOpenTelemetry,
 									OpenTelemetry: &egv1a1.OpenTelemetryEnvoyProxyAccessLog{
-										BackendRefs: []egv1a1.BackendRef{
-											{
-												BackendObjectReference: gwapiv1.BackendObjectReference{
-													Name:      "otel-collector",
-													Namespace: ptr.To(gwapiv1.Namespace("default")),
-													Port:      ptr.To(gwapiv1.PortNumber(4317)),
+										BackendCluster: egv1a1.BackendCluster{
+											BackendRefs: []egv1a1.BackendRef{
+												{
+													BackendObjectReference: gwapiv1.BackendObjectReference{
+														Name:      "otel-collector",
+														Namespace: ptr.To(gwapiv1.Namespace("default")),
+														Port:      ptr.To(gwapiv1.PortNumber(4317)),
+													},
 												},
 											},
 										},
@@ -491,12 +493,14 @@ func TestValidateServiceForReconcile(t *testing.T) {
 						{
 							Type: egv1a1.MetricSinkTypeOpenTelemetry,
 							OpenTelemetry: &egv1a1.ProxyOpenTelemetrySink{
-								BackendRefs: []egv1a1.BackendRef{
-									{
-										BackendObjectReference: gwapiv1.BackendObjectReference{
-											Name:      "otel-collector",
-											Namespace: ptr.To(gwapiv1.Namespace("default")),
-											Port:      ptr.To(gwapiv1.PortNumber(4317)),
+								BackendCluster: egv1a1.BackendCluster{
+									BackendRefs: []egv1a1.BackendRef{
+										{
+											BackendObjectReference: gwapiv1.BackendObjectReference{
+												Name:      "otel-collector",
+												Namespace: ptr.To(gwapiv1.Namespace("default")),
+												Port:      ptr.To(gwapiv1.PortNumber(4317)),
+											},
 										},
 									},
 								},
@@ -507,12 +511,14 @@ func TestValidateServiceForReconcile(t *testing.T) {
 				Tracing: &egv1a1.ProxyTracing{
 					Provider: egv1a1.TracingProvider{
 						Type: egv1a1.TracingProviderTypeOpenTelemetry,
-						BackendRefs: []egv1a1.BackendRef{
-							{
-								BackendObjectReference: gwapiv1.BackendObjectReference{
-									Name:      "otel-collector",
-									Namespace: ptr.To(gwapiv1.Namespace("default")),
-									Port:      ptr.To(gwapiv1.PortNumber(4317)),
+						BackendCluster: egv1a1.BackendCluster{
+							BackendRefs: []egv1a1.BackendRef{
+								{
+									BackendObjectReference: gwapiv1.BackendObjectReference{
+										Name:      "otel-collector",
+										Namespace: ptr.To(gwapiv1.Namespace("default")),
+										Port:      ptr.To(gwapiv1.PortNumber(4317)),
+									},
 								},
 							},
 						},
diff --git a/internal/xds/bootstrap/bootstrap_test.go b/internal/xds/bootstrap/bootstrap_test.go
index 19e020c49..2023a7096 100644
--- a/internal/xds/bootstrap/bootstrap_test.go
+++ b/internal/xds/bootstrap/bootstrap_test.go
@@ -86,12 +86,14 @@ func TestGetRenderedBootstrapConfig(t *testing.T) {
 							OpenTelemetry: &egv1a1.ProxyOpenTelemetrySink{
 								Host: ptr.To("otel-collector.monitoring.svc"),
 								Port: 4317,
-								BackendRefs: []egv1a1.BackendRef{
-									{
-										BackendObjectReference: gwapiv1.BackendObjectReference{
-											Name:      "otel-collector",
-											Namespace: ptr.To(gwapiv1.Namespace("monitoring")),
-											Port:      ptr.To(gwapiv1.PortNumber(4317)),
+								BackendCluster: egv1a1.BackendCluster{
+									BackendRefs: []egv1a1.BackendRef{
+										{
+											BackendObjectReference: gwapiv1.BackendObjectReference{
+												Name:      "otel-collector",
+												Namespace: ptr.To(gwapiv1.Namespace("monitoring")),
+												Port:      ptr.To(gwapiv1.PortNumber(4317)),
+											},
 										},
 									},
 								},
diff --git a/internal/xds/translator/testdata/in/xds-ir/accesslog-als-tcp.yaml b/internal/xds/translator/testdata/in/xds-ir/accesslog-als-tcp.yaml
index 2d8f0c6aa..4b437f443 100644
--- a/internal/xds/translator/testdata/in/xds-ir/accesslog-als-tcp.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/accesslog-als-tcp.yaml
@@ -17,6 +17,27 @@ accesslog:
           port: 9000
         protocol: GRPC
         weight: 1
+    traffic:
+      backendConnection:
+        bufferLimit: 20971520
+      circuitBreaker:
+        maxConnections: 2048
+      healthCheck:
+        passive:
+          baseEjectionTime: 30s
+          consecutiveGatewayErrors: 4
+          consecutive5XxErrors: 5
+          consecutiveLocalOriginFailures: 5
+          interval: 5s
+          maxEjectionPercent: 10
+          splitExternalLocalOriginErrors: false
+      proxyProtocol:
+        version: V2
+      tcpKeepalive:
+        probes: 7
+      timeout:
+        tcp:
+          connectTimeout: 15s
     attributes:
       attr1: value1
       attr2: value2
diff --git a/internal/xds/translator/testdata/in/xds-ir/tracing.yaml b/internal/xds/translator/testdata/in/xds-ir/tracing.yaml
index 0f3555524..2bd8aff1b 100644
--- a/internal/xds/translator/testdata/in/xds-ir/tracing.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/tracing.yaml
@@ -25,6 +25,27 @@ tracing:
       - host: "otel-collector.default.svc.cluster.local"
         port: 4317
       protocol: "GRPC"
+  traffic:
+    backendConnection:
+      bufferLimit: 20971520
+    circuitBreaker:
+      maxConnections: 2048
+    healthCheck:
+      passive:
+        baseEjectionTime: 30s
+        consecutiveGatewayErrors: 4
+        consecutive5XxErrors: 5
+        consecutiveLocalOriginFailures: 5
+        interval: 5s
+        maxEjectionPercent: 10
+        splitExternalLocalOriginErrors: false
+    proxyProtocol:
+      version: V2
+    tcpKeepalive:
+      probes: 7
+    timeout:
+      tcp:
+        connectTimeout: 15s
   provider:
     host: otel-collector.monitoring.svc.cluster.local
     port: 4317
diff --git a/internal/xds/translator/testdata/out/xds-ir/accesslog-als-tcp.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/accesslog-als-tcp.clusters.yaml
index 9603f302b..be515fc1a 100755
--- a/internal/xds/translator/testdata/out/xds-ir/accesslog-als-tcp.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/accesslog-als-tcp.clusters.yaml
@@ -1,9 +1,10 @@
 - circuitBreakers:
     thresholds:
-    - maxRetries: 1024
+    - maxConnections: 2048
+      maxRetries: 1024
   commonLbConfig:
     localityWeightedLbConfig: {}
-  connectTimeout: 10s
+  connectTimeout: 15s
   dnsLookupFamily: V4_ONLY
   edsClusterConfig:
     edsConfig:
@@ -12,8 +13,24 @@
     serviceName: accesslog/monitoring/envoy-als/port/9000
   lbPolicy: LEAST_REQUEST
   name: accesslog/monitoring/envoy-als/port/9000
-  outlierDetection: {}
-  perConnectionBufferLimitBytes: 32768
+  outlierDetection:
+    baseEjectionTime: 30s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 4
+    consecutiveLocalOriginFailure: 5
+    interval: 5s
+    maxEjectionPercent: 10
+  perConnectionBufferLimitBytes: 20971520
+  transportSocket:
+    name: envoy.transport_sockets.upstream_proxy_protocol
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
+      config:
+        version: V2
+      transportSocket:
+        name: envoy.transport_sockets.raw_buffer
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
   type: EDS
   typedExtensionProtocolOptions:
     envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@@ -22,3 +39,6 @@
         http2ProtocolOptions:
           initialConnectionWindowSize: 1048576
           initialStreamWindowSize: 65536
+  upstreamConnectionOptions:
+    tcpKeepalive:
+      keepaliveProbes: 7
diff --git a/internal/xds/translator/testdata/out/xds-ir/tracing.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/tracing.clusters.yaml
index dce48b2c0..4d4196115 100644
--- a/internal/xds/translator/testdata/out/xds-ir/tracing.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/tracing.clusters.yaml
@@ -17,10 +17,11 @@
   type: EDS
 - circuitBreakers:
     thresholds:
-    - maxRetries: 1024
+    - maxConnections: 2048
+      maxRetries: 1024
   commonLbConfig:
     localityWeightedLbConfig: {}
-  connectTimeout: 10s
+  connectTimeout: 15s
   dnsLookupFamily: V4_ONLY
   dnsRefreshRate: 30s
   lbPolicy: LEAST_REQUEST
@@ -38,9 +39,25 @@
       locality:
         region: tracing-0/backend/0
   name: tracing-0
-  outlierDetection: {}
-  perConnectionBufferLimitBytes: 32768
+  outlierDetection:
+    baseEjectionTime: 30s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 4
+    consecutiveLocalOriginFailure: 5
+    interval: 5s
+    maxEjectionPercent: 10
+  perConnectionBufferLimitBytes: 20971520
   respectDnsTtl: true
+  transportSocket:
+    name: envoy.transport_sockets.upstream_proxy_protocol
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
+      config:
+        version: V2
+      transportSocket:
+        name: envoy.transport_sockets.raw_buffer
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
   type: STRICT_DNS
   typedExtensionProtocolOptions:
     envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@@ -49,3 +66,6 @@
         http2ProtocolOptions:
           initialConnectionWindowSize: 1048576
           initialStreamWindowSize: 65536
+  upstreamConnectionOptions:
+    tcpKeepalive:
+      keepaliveProbes: 7
diff --git a/internal/xds/translator/translator_test.go b/internal/xds/translator/translator_test.go
index 44d6d127b..f5918b4bc 100644
--- a/internal/xds/translator/translator_test.go
+++ b/internal/xds/translator/translator_test.go
@@ -127,7 +127,6 @@ func TestTranslateXds(t *testing.T) {
 				},
 				FilterOrder: x.FilterOrder,
 			}
-
 			tCtx, err := tr.Translate(x)
 			if !strings.HasSuffix(inputFileName, "partial-invalid") && len(cfg.errMsg) == 0 {
 				t.Logf(inputFileName)
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 6ff3e2ed4..516864db2 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -68,7 +68,9 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  true  | BackendRefs references a Kubernetes object that represents the gRPC service to which<br />the access logs will be sent. Currently only Service is supported. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `logName` | _string_ |  false  | LogName defines the friendly name of the access log to be returned in<br />StreamAccessLogsMessage.Identifier. This allows the access log server<br />to differentiate between different access logs coming from the same Envoy. |
 | `type` | _[ALSEnvoyProxyAccessLogType](#alsenvoyproxyaccesslogtype)_ |  true  | Type defines the type of accesslog. Supported types are "HTTP" and "TCP". |
 | `http` | _[ALSEnvoyProxyHTTPAccessLogConfig](#alsenvoyproxyhttpaccesslogconfig)_ |  false  | HTTP defines additional configuration specific to HTTP access logs. |
@@ -128,7 +130,7 @@ _Appears in:_
 
 #### ActiveHealthCheckPayload
 
-_Underlying type:_ _[struct{Type ActiveHealthCheckPayloadType "json:\"type\" yaml:\"type\""; Text *string "json:\"text,omitempty\" yaml:\"text,omitempty\""; Binary []byte "json:\"binary,omitempty\" yaml:\"binary,omitempty\""}](#struct{type-activehealthcheckpayloadtype-"json:\"type\"-yaml:\"type\"";-text-*string-"json:\"text,omitempty\"-yaml:\"text,omitempty\"";-binary-[]byte-"json:\"binary,omitempty\"-yaml:\"binary,omitempty\""})_
+
 
 ActiveHealthCheckPayload defines the encoding of the payload bytes in the payload.
 
@@ -136,8 +138,26 @@ _Appears in:_
 - [HTTPActiveHealthChecker](#httpactivehealthchecker)
 - [TCPActiveHealthChecker](#tcpactivehealthchecker)
 
+| Field | Type | Required | Description |
+| ---   | ---  | ---      | ---         |
+| `type` | _[ActiveHealthCheckPayloadType](#activehealthcheckpayloadtype)_ |  true  | Type defines the type of the payload. |
+| `text` | _string_ |  false  | Text payload in plain text. |
+| `binary` | _integer array_ |  false  | Binary payload base64 encoded. |
 
 
+#### ActiveHealthCheckPayloadType
+
+_Underlying type:_ _string_
+
+ActiveHealthCheckPayloadType is the type of the payload.
+
+_Appears in:_
+- [ActiveHealthCheckPayload](#activehealthcheckpayload)
+
+| Value | Description |
+| ----- | ----------- |
+| `Text` | ActiveHealthCheckPayloadTypeText defines the Text type payload.<br /> | 
+| `Binary` | ActiveHealthCheckPayloadTypeBinary defines the Binary type payload.<br /> | 
 
 
 #### ActiveHealthCheckerType
@@ -264,9 +284,13 @@ to a backend. This can include multiple endpoints, and settings that apply for
 managing the connection to all these endpoints.
 
 _Appears in:_
+- [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog)
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
+- [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
+- [TracingProvider](#tracingprovider)
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
@@ -279,19 +303,6 @@ _Appears in:_
 
 
 
-#### BackendConnection
-
-
-
-BackendConnection allows users to configure connection-level settings of backend
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `bufferLimit` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | BufferLimit Soft limit on size of the cluster’s connections read and write buffers.<br />BufferLimit applies to connection streaming (maybe non-streaming) channel between processes, it's in user space.<br />If unspecified, an implementation defined default is applied (32768 bytes).<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note: that when the suffix is not provided, the value is interpreted as bytes. |
 
 
 #### BackendEndpoint
@@ -528,23 +539,6 @@ _Appears in:_
 | `allowCredentials` | _boolean_ |  true  | AllowCredentials indicates whether a request can include user credentials<br />like cookies, authentication headers, or TLS client certificates. |
 
 
-#### CircuitBreaker
-
-
-
-CircuitBreaker defines the Circuit Breaker configuration.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `maxConnections` | _integer_ |  false  | The maximum number of connections that Envoy will establish to the referenced backend defined within a xRoute rule. |
-| `maxPendingRequests` | _integer_ |  false  | The maximum number of pending requests that Envoy will queue to the referenced backend defined within a xRoute rule. |
-| `maxParallelRequests` | _integer_ |  false  | The maximum number of parallel requests that Envoy will make to the referenced backend defined within a xRoute rule. |
-| `maxParallelRetries` | _integer_ |  false  | The maximum number of parallel retries that Envoy will make to the referenced backend defined within a xRoute rule. |
-| `maxRequestsPerConnection` | _integer_ |  false  | The maximum number of requests that Envoy will make over a single connection to the referenced backend defined within a xRoute rule.<br />Default: unlimited. |
 
 
 #### ClaimToHeader
@@ -715,11 +709,15 @@ ClusterSettings provides the various knobs that can be set to control how traffi
 backend will be configured.
 
 _Appears in:_
+- [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog)
 - [BackendCluster](#backendcluster)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
+- [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
+- [TracingProvider](#tracingprovider)
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
@@ -879,20 +877,6 @@ _Appears in:_
 | `RequestHeader` | CustomTagTypeRequestHeader adds value from request header to each span.<br /> | 
 
 
-#### DNS
-
-
-
-
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `dnsRefreshRate` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  true  | DNSRefreshRate specifies the rate at which DNS records should be refreshed.<br />Defaults to 30 seconds. |
-| `respectDnsTtl` | _boolean_ |  true  | RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.<br />If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.<br />Defaults to true. |
 
 
 #### EnvironmentCustomTag
@@ -1822,23 +1806,6 @@ _Appears in:_
 | `http10` | _[HTTP10Settings](#http10settings)_ |  false  | HTTP10 turns on support for HTTP/1.0 and HTTP/0.9 requests. |
 
 
-#### HTTP2Settings
-
-
-
-HTTP2Settings provides HTTP/2 configuration for listeners and backends.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClientTrafficPolicySpec](#clienttrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `initialStreamWindowSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | InitialStreamWindowSize sets the initial window size for HTTP/2 streams.<br />If not set, the default value is 64 KiB(64*1024). |
-| `initialConnectionWindowSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.<br />If not set, the default value is 1 MiB. |
-| `maxConcurrentStreams` | _integer_ |  false  | MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.<br />If not set, the default value is 100. |
-| `onInvalidMessage` | _[InvalidMessageAction](#invalidmessageaction)_ |  false  | OnInvalidMessage determines if Envoy will terminate the connection or just the offending stream in the event of HTTP messaging error<br />It's recommended for L2 Envoy deployments to set this value to TerminateStream.<br />https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/level_two<br />Default: TerminateConnection |
 
 
 #### HTTP3Settings
@@ -1996,21 +1963,6 @@ _Appears in:_
 | `preserveXRequestID` | _boolean_ |  false  | PreserveXRequestID configures Envoy to keep the X-Request-ID header if passed for a request that is edge<br />(Edge request is the request from external clients to front Envoy) and not reset it, which is the current Envoy behaviour.<br />It defaults to false. |
 
 
-#### HealthCheck
-
-
-
-HealthCheck configuration to decide which endpoints
-are healthy and can be used for routing.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `active` | _[ActiveHealthCheck](#activehealthcheck)_ |  false  | Active health check configuration |
-| `passive` | _[PassiveHealthCheck](#passivehealthcheck)_ |  false  | Passive passive check configuration |
 
 
 #### HealthCheckSettings
@@ -2425,21 +2377,6 @@ _Appears in:_
 | `value` | _string_ |  true  | Value defines the hard-coded value to add to each span. |
 
 
-#### LoadBalancer
-
-
-
-LoadBalancer defines the load balancer policy to be applied.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `type` | _[LoadBalancerType](#loadbalancertype)_ |  true  | Type decides the type of Load Balancer policy.<br />Valid LoadBalancerType values are<br />"ConsistentHash",<br />"LeastRequest",<br />"Random",<br />"RoundRobin". |
-| `consistentHash` | _[ConsistentHash](#consistenthash)_ |  false  | ConsistentHash defines the configuration when the load balancer type is<br />set to ConsistentHash |
-| `slowStart` | _[SlowStart](#slowstart)_ |  false  | SlowStart defines the configuration related to the slow start load balancer policy.<br />If set, during slow start window, traffic sent to the newly added hosts will gradually increase.<br />Currently this is only supported for RoundRobin and LeastRequest load balancers |
 
 
 #### LoadBalancerType
@@ -2575,9 +2512,11 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  | Host define the extension service hostname.<br />Deprecated: Use BackendRefs instead. |
 | `port` | _integer_ |  false  | Port defines the port the extension service is exposed on.<br />Deprecated: Use BackendRefs instead. |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the access log will be sent.<br />Only Service kind is supported for now. |
 | `resources` | _object (keys:string, values:string)_ |  false  | Resources is a set of labels that describe the source of a log entry, including envoy node info.<br />It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/). |
 
 
@@ -2932,9 +2871,11 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  | Host define the service hostname.<br />Deprecated: Use BackendRefs instead. |
 | `port` | _integer_ |  false  | Port defines the port the service is exposed on.<br />Deprecated: Use BackendRefs instead. |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the metric will be sent.<br />Only Service kind is supported for now. |
 
 
 #### ProxyPrometheusProvider
@@ -2952,20 +2893,6 @@ _Appears in:_
 | `compression` | _[Compression](#compression)_ |  false  | Configure the compression on Prometheus endpoint. Compression is useful in situations when bandwidth is scarce and large payloads can be effectively compressed at the expense of higher CPU load. |
 
 
-#### ProxyProtocol
-
-
-
-ProxyProtocol defines the configuration related to the proxy protocol
-when communicating with the backend.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `version` | _[ProxyProtocolVersion](#proxyprotocolversion)_ |  true  | Version of ProxyProtol<br />Valid ProxyProtocolVersion values are<br />"V1"<br />"V2" |
 
 
 #### ProxyProtocolVersion
@@ -3571,22 +3498,6 @@ _Appears in:_
 | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no<br />bytes sent or received on either the upstream or downstream connection.<br />Default: 1 hour. |
 
 
-#### TCPKeepalive
-
-
-
-TCPKeepalive define the TCP Keepalive configuration.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClientTrafficPolicySpec](#clienttrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `probes` | _integer_ |  false  | The total number of unacknowledged probes to send before deciding<br />the connection is dead.<br />Defaults to 9. |
-| `idleTime` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | The duration a connection needs to be idle before keep-alive<br />probes start being sent.<br />The duration format is<br />Defaults to `7200s`. |
-| `interval` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | The duration between keep-alive probes.<br />Defaults to `75s`. |
 
 
 #### TCPTimeout
@@ -3663,20 +3574,6 @@ _Appears in:_
 | `matchLabels` | _object (keys:string, values:string)_ |  true  | MatchLabels are the set of label selectors for identifying the targeted resource |
 
 
-#### Timeout
-
-
-
-Timeout defines configuration for timeouts related to connections.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `tcp` | _[TCPTimeout](#tcptimeout)_ |  false  | Timeout settings for TCP. |
-| `http` | _[HTTPTimeout](#httptimeout)_ |  false  | Timeout settings for HTTP. |
 
 
 #### TracingProvider
@@ -3690,10 +3587,12 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `type` | _[TracingProviderType](#tracingprovidertype)_ |  true  | Type defines the tracing provider type. |
 | `host` | _string_ |  false  | Host define the provider service hostname.<br />Deprecated: Use BackendRefs instead. |
 | `port` | _integer_ |  false  | Port defines the port the provider service is exposed on.<br />Deprecated: Use BackendRefs instead. |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the trace will be sent.<br />Only Service kind is supported for now. |
 | `zipkin` | _[ZipkinTracingProvider](#zipkintracingprovider)_ |  false  | Zipkin defines the Zipkin tracing provider configuration |
 
 
diff --git a/site/content/en/latest/install/install-yaml.md b/site/content/en/latest/install/install-yaml.md
index e675f15fb..c0a8d1caa 100644
--- a/site/content/en/latest/install/install-yaml.md
+++ b/site/content/en/latest/install/install-yaml.md
@@ -13,7 +13,7 @@ installation, it is recommended that you use helm.
 
 Envoy Gateway is designed to run in Kubernetes for production. The most essential requirements are:
 
-* Kubernetes 1.25 or later
+* Kubernetes 1.27 or later
 * The `kubectl` command-line tool
 
 {{% alert title="Compatibility Matrix" color="warning" %}}
@@ -37,3 +37,31 @@ Refer to the [Developer Guide](../../contributions/develop) to learn more.
 2. Next Steps
 
    Envoy Gateway should now be successfully installed and running, but in order to experience more abilities of Envoy Gateway, you can refer to [Tasks](/latest/tasks).
+
+## Upgrading from v1.0
+
+Due to breaking changes in Gateway API v1.1, some manual migration steps are required to upgrade Envoy Gateway to v1.1.
+
+1. Delete `BackendTLSPolicy` CRD (and resources):
+
+```shell
+kubectl delete crd backendtlspolicies.gateway.networking.k8s.io
+```
+
+2. Update Gateway-API and Envoy Gateway CRDs:
+
+```shell
+helm pull oci://docker.io/envoyproxy/gateway-helm --version {{< yaml-version >}} --untar
+kubectl apply --force-conflicts --server-side -f ./gateway-helm/crds/gatewayapi-crds.yaml
+kubectl apply --force-conflicts --server-side -f ./gateway-helm/crds/generated
+```
+
+3. Update your `BackendTLSPolicy` and `GRPCRoute` resources according to Gateway-API [v1.1 Upgrade Notes](https://gateway-api.sigs.k8s.io/guides/#v11-upgrade-notes)
+
+4. Update your Envoy Gateway xPolicy resources: remove the namespace section from targetRef.
+
+5. Install Envoy Gateway {{< yaml-version >}}:
+
+```shell
+helm upgrade eg oci://docker.io/envoyproxy/gateway-helm --version {{< yaml-version >}} -n envoy-gateway-system
+```
diff --git a/site/content/en/latest/tasks/quickstart.md b/site/content/en/latest/tasks/quickstart.md
index 03d7b6de8..802b7989a 100644
--- a/site/content/en/latest/tasks/quickstart.md
+++ b/site/content/en/latest/tasks/quickstart.md
@@ -92,34 +92,6 @@ curl --verbose --header "Host: www.example.com" http://localhost:8888/get
 {{% /tab %}}
 {{< /tabpane >}}
 
-## v1.1 Upgrade Notes
-
-Due to breaking changes in the Gateway API v1.1, some manual migration steps are required to upgrade Envoy Gateway to v1.1. 
-
-Delete `BackendTLSPolicy` CRD (and resources): 
-
-```shell
-kubectl delete crd backendtlspolicies.gateway.networking.k8s.io
-```
-
-Update Gateway-API and Envoy Gateway CRDs:
-
-```shell
-helm pull oci://docker.io/envoyproxy/gateway-helm --version v1.1.0 --untar
-kubectl apply -f ./gateway-helm/crds/gatewayapi-crds.yaml
-kubectl apply -f ./gateway-helm/crds/generated
-```
-
-Update your `BackendTLSPolicy` and `GRPCRoute` resources according to Gateway-API [v1.1 Upgrade Notes](https://gateway-api.sigs.k8s.io/guides/#v11-upgrade-notes)
-
-Update your Envoy Gateway xPolicy resources: remove the namespace section from targetRef. 
-
-Install Envoy Gateway v1.1.0:
-
-```shell
-helm upgrade eg oci://docker.io/envoyproxy/gateway-helm --version v1.1.0 -n envoy-gateway-system 
-```
-
 ## What to explore next?
 
 In this quickstart, you have:
diff --git a/site/content/zh/latest/api/extension_types.md b/site/content/zh/latest/api/extension_types.md
index 6ff3e2ed4..516864db2 100644
--- a/site/content/zh/latest/api/extension_types.md
+++ b/site/content/zh/latest/api/extension_types.md
@@ -68,7 +68,9 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  true  | BackendRefs references a Kubernetes object that represents the gRPC service to which<br />the access logs will be sent. Currently only Service is supported. |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `logName` | _string_ |  false  | LogName defines the friendly name of the access log to be returned in<br />StreamAccessLogsMessage.Identifier. This allows the access log server<br />to differentiate between different access logs coming from the same Envoy. |
 | `type` | _[ALSEnvoyProxyAccessLogType](#alsenvoyproxyaccesslogtype)_ |  true  | Type defines the type of accesslog. Supported types are "HTTP" and "TCP". |
 | `http` | _[ALSEnvoyProxyHTTPAccessLogConfig](#alsenvoyproxyhttpaccesslogconfig)_ |  false  | HTTP defines additional configuration specific to HTTP access logs. |
@@ -128,7 +130,7 @@ _Appears in:_
 
 #### ActiveHealthCheckPayload
 
-_Underlying type:_ _[struct{Type ActiveHealthCheckPayloadType "json:\"type\" yaml:\"type\""; Text *string "json:\"text,omitempty\" yaml:\"text,omitempty\""; Binary []byte "json:\"binary,omitempty\" yaml:\"binary,omitempty\""}](#struct{type-activehealthcheckpayloadtype-"json:\"type\"-yaml:\"type\"";-text-*string-"json:\"text,omitempty\"-yaml:\"text,omitempty\"";-binary-[]byte-"json:\"binary,omitempty\"-yaml:\"binary,omitempty\""})_
+
 
 ActiveHealthCheckPayload defines the encoding of the payload bytes in the payload.
 
@@ -136,8 +138,26 @@ _Appears in:_
 - [HTTPActiveHealthChecker](#httpactivehealthchecker)
 - [TCPActiveHealthChecker](#tcpactivehealthchecker)
 
+| Field | Type | Required | Description |
+| ---   | ---  | ---      | ---         |
+| `type` | _[ActiveHealthCheckPayloadType](#activehealthcheckpayloadtype)_ |  true  | Type defines the type of the payload. |
+| `text` | _string_ |  false  | Text payload in plain text. |
+| `binary` | _integer array_ |  false  | Binary payload base64 encoded. |
 
 
+#### ActiveHealthCheckPayloadType
+
+_Underlying type:_ _string_
+
+ActiveHealthCheckPayloadType is the type of the payload.
+
+_Appears in:_
+- [ActiveHealthCheckPayload](#activehealthcheckpayload)
+
+| Value | Description |
+| ----- | ----------- |
+| `Text` | ActiveHealthCheckPayloadTypeText defines the Text type payload.<br /> | 
+| `Binary` | ActiveHealthCheckPayloadTypeBinary defines the Binary type payload.<br /> | 
 
 
 #### ActiveHealthCheckerType
@@ -264,9 +284,13 @@ to a backend. This can include multiple endpoints, and settings that apply for
 managing the connection to all these endpoints.
 
 _Appears in:_
+- [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog)
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
+- [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
+- [TracingProvider](#tracingprovider)
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
@@ -279,19 +303,6 @@ _Appears in:_
 
 
 
-#### BackendConnection
-
-
-
-BackendConnection allows users to configure connection-level settings of backend
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `bufferLimit` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | BufferLimit Soft limit on size of the cluster’s connections read and write buffers.<br />BufferLimit applies to connection streaming (maybe non-streaming) channel between processes, it's in user space.<br />If unspecified, an implementation defined default is applied (32768 bytes).<br />For example, 20Mi, 1Gi, 256Ki etc.<br />Note: that when the suffix is not provided, the value is interpreted as bytes. |
 
 
 #### BackendEndpoint
@@ -528,23 +539,6 @@ _Appears in:_
 | `allowCredentials` | _boolean_ |  true  | AllowCredentials indicates whether a request can include user credentials<br />like cookies, authentication headers, or TLS client certificates. |
 
 
-#### CircuitBreaker
-
-
-
-CircuitBreaker defines the Circuit Breaker configuration.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `maxConnections` | _integer_ |  false  | The maximum number of connections that Envoy will establish to the referenced backend defined within a xRoute rule. |
-| `maxPendingRequests` | _integer_ |  false  | The maximum number of pending requests that Envoy will queue to the referenced backend defined within a xRoute rule. |
-| `maxParallelRequests` | _integer_ |  false  | The maximum number of parallel requests that Envoy will make to the referenced backend defined within a xRoute rule. |
-| `maxParallelRetries` | _integer_ |  false  | The maximum number of parallel retries that Envoy will make to the referenced backend defined within a xRoute rule. |
-| `maxRequestsPerConnection` | _integer_ |  false  | The maximum number of requests that Envoy will make over a single connection to the referenced backend defined within a xRoute rule.<br />Default: unlimited. |
 
 
 #### ClaimToHeader
@@ -715,11 +709,15 @@ ClusterSettings provides the various knobs that can be set to control how traffi
 backend will be configured.
 
 _Appears in:_
+- [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog)
 - [BackendCluster](#backendcluster)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ExtProc](#extproc)
 - [GRPCExtAuthService](#grpcextauthservice)
 - [HTTPExtAuthService](#httpextauthservice)
+- [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
+- [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
+- [TracingProvider](#tracingprovider)
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
@@ -879,20 +877,6 @@ _Appears in:_
 | `RequestHeader` | CustomTagTypeRequestHeader adds value from request header to each span.<br /> | 
 
 
-#### DNS
-
-
-
-
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `dnsRefreshRate` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  true  | DNSRefreshRate specifies the rate at which DNS records should be refreshed.<br />Defaults to 30 seconds. |
-| `respectDnsTtl` | _boolean_ |  true  | RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.<br />If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.<br />Defaults to true. |
 
 
 #### EnvironmentCustomTag
@@ -1822,23 +1806,6 @@ _Appears in:_
 | `http10` | _[HTTP10Settings](#http10settings)_ |  false  | HTTP10 turns on support for HTTP/1.0 and HTTP/0.9 requests. |
 
 
-#### HTTP2Settings
-
-
-
-HTTP2Settings provides HTTP/2 configuration for listeners and backends.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClientTrafficPolicySpec](#clienttrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `initialStreamWindowSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | InitialStreamWindowSize sets the initial window size for HTTP/2 streams.<br />If not set, the default value is 64 KiB(64*1024). |
-| `initialConnectionWindowSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#quantity-resource-api)_ |  false  | InitialConnectionWindowSize sets the initial window size for HTTP/2 connections.<br />If not set, the default value is 1 MiB. |
-| `maxConcurrentStreams` | _integer_ |  false  | MaxConcurrentStreams sets the maximum number of concurrent streams allowed per connection.<br />If not set, the default value is 100. |
-| `onInvalidMessage` | _[InvalidMessageAction](#invalidmessageaction)_ |  false  | OnInvalidMessage determines if Envoy will terminate the connection or just the offending stream in the event of HTTP messaging error<br />It's recommended for L2 Envoy deployments to set this value to TerminateStream.<br />https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/level_two<br />Default: TerminateConnection |
 
 
 #### HTTP3Settings
@@ -1996,21 +1963,6 @@ _Appears in:_
 | `preserveXRequestID` | _boolean_ |  false  | PreserveXRequestID configures Envoy to keep the X-Request-ID header if passed for a request that is edge<br />(Edge request is the request from external clients to front Envoy) and not reset it, which is the current Envoy behaviour.<br />It defaults to false. |
 
 
-#### HealthCheck
-
-
-
-HealthCheck configuration to decide which endpoints
-are healthy and can be used for routing.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `active` | _[ActiveHealthCheck](#activehealthcheck)_ |  false  | Active health check configuration |
-| `passive` | _[PassiveHealthCheck](#passivehealthcheck)_ |  false  | Passive passive check configuration |
 
 
 #### HealthCheckSettings
@@ -2425,21 +2377,6 @@ _Appears in:_
 | `value` | _string_ |  true  | Value defines the hard-coded value to add to each span. |
 
 
-#### LoadBalancer
-
-
-
-LoadBalancer defines the load balancer policy to be applied.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `type` | _[LoadBalancerType](#loadbalancertype)_ |  true  | Type decides the type of Load Balancer policy.<br />Valid LoadBalancerType values are<br />"ConsistentHash",<br />"LeastRequest",<br />"Random",<br />"RoundRobin". |
-| `consistentHash` | _[ConsistentHash](#consistenthash)_ |  false  | ConsistentHash defines the configuration when the load balancer type is<br />set to ConsistentHash |
-| `slowStart` | _[SlowStart](#slowstart)_ |  false  | SlowStart defines the configuration related to the slow start load balancer policy.<br />If set, during slow start window, traffic sent to the newly added hosts will gradually increase.<br />Currently this is only supported for RoundRobin and LeastRequest load balancers |
 
 
 #### LoadBalancerType
@@ -2575,9 +2512,11 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  | Host define the extension service hostname.<br />Deprecated: Use BackendRefs instead. |
 | `port` | _integer_ |  false  | Port defines the port the extension service is exposed on.<br />Deprecated: Use BackendRefs instead. |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the access log will be sent.<br />Only Service kind is supported for now. |
 | `resources` | _object (keys:string, values:string)_ |  false  | Resources is a set of labels that describe the source of a log entry, including envoy node info.<br />It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/). |
 
 
@@ -2932,9 +2871,11 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  | Host define the service hostname.<br />Deprecated: Use BackendRefs instead. |
 | `port` | _integer_ |  false  | Port defines the port the service is exposed on.<br />Deprecated: Use BackendRefs instead. |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the metric will be sent.<br />Only Service kind is supported for now. |
 
 
 #### ProxyPrometheusProvider
@@ -2952,20 +2893,6 @@ _Appears in:_
 | `compression` | _[Compression](#compression)_ |  false  | Configure the compression on Prometheus endpoint. Compression is useful in situations when bandwidth is scarce and large payloads can be effectively compressed at the expense of higher CPU load. |
 
 
-#### ProxyProtocol
-
-
-
-ProxyProtocol defines the configuration related to the proxy protocol
-when communicating with the backend.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `version` | _[ProxyProtocolVersion](#proxyprotocolversion)_ |  true  | Version of ProxyProtol<br />Valid ProxyProtocolVersion values are<br />"V1"<br />"V2" |
 
 
 #### ProxyProtocolVersion
@@ -3571,22 +3498,6 @@ _Appears in:_
 | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no<br />bytes sent or received on either the upstream or downstream connection.<br />Default: 1 hour. |
 
 
-#### TCPKeepalive
-
-
-
-TCPKeepalive define the TCP Keepalive configuration.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClientTrafficPolicySpec](#clienttrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `probes` | _integer_ |  false  | The total number of unacknowledged probes to send before deciding<br />the connection is dead.<br />Defaults to 9. |
-| `idleTime` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | The duration a connection needs to be idle before keep-alive<br />probes start being sent.<br />The duration format is<br />Defaults to `7200s`. |
-| `interval` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | The duration between keep-alive probes.<br />Defaults to `75s`. |
 
 
 #### TCPTimeout
@@ -3663,20 +3574,6 @@ _Appears in:_
 | `matchLabels` | _object (keys:string, values:string)_ |  true  | MatchLabels are the set of label selectors for identifying the targeted resource |
 
 
-#### Timeout
-
-
-
-Timeout defines configuration for timeouts related to connections.
-
-_Appears in:_
-- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
-
-| Field | Type | Required | Description |
-| ---   | ---  | ---      | ---         |
-| `tcp` | _[TCPTimeout](#tcptimeout)_ |  false  | Timeout settings for TCP. |
-| `http` | _[HTTPTimeout](#httptimeout)_ |  false  | Timeout settings for HTTP. |
 
 
 #### TracingProvider
@@ -3690,10 +3587,12 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
+| `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)_ |  true  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br /><br />Deprecated: Use BackendRefs instead. |
+| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
+| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `type` | _[TracingProviderType](#tracingprovidertype)_ |  true  | Type defines the tracing provider type. |
 | `host` | _string_ |  false  | Host define the provider service hostname.<br />Deprecated: Use BackendRefs instead. |
 | `port` | _integer_ |  false  | Port defines the port the provider service is exposed on.<br />Deprecated: Use BackendRefs instead. |
-| `backendRefs` | _[BackendRef](#backendref) array_ |  false  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the trace will be sent.<br />Only Service kind is supported for now. |
 | `zipkin` | _[ZipkinTracingProvider](#zipkintracingprovider)_ |  false  | Zipkin defines the Zipkin tracing provider configuration |
 
 
diff --git a/test/cel-validation/envoyproxy_test.go b/test/cel-validation/envoyproxy_test.go
index 4d914a7e9..76ba74340 100644
--- a/test/cel-validation/envoyproxy_test.go
+++ b/test/cel-validation/envoyproxy_test.go
@@ -488,11 +488,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 										{
 											Type: egv1a1.ProxyAccessLogSinkTypeALS,
 											ALS: &egv1a1.ALSEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Port: ptr.To(gwapiv1.PortNumber(9000)),
+												BackendCluster: egv1a1.BackendCluster{
+													BackendRefs: []egv1a1.BackendRef{
+														{
+															BackendObjectReference: gwapiv1.BackendObjectReference{
+																Name: "fake-service",
+																Port: ptr.To(gwapiv1.PortNumber(9000)),
+															},
 														},
 													},
 												},
@@ -519,11 +521,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 										{
 											Type: egv1a1.ProxyAccessLogSinkTypeALS,
 											ALS: &egv1a1.ALSEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Port: ptr.To(gwapiv1.PortNumber(9000)),
+												BackendCluster: egv1a1.BackendCluster{
+													BackendRefs: []egv1a1.BackendRef{
+														{
+															BackendObjectReference: gwapiv1.BackendObjectReference{
+																Name: "fake-service",
+																Port: ptr.To(gwapiv1.PortNumber(9000)),
+															},
 														},
 													},
 												},
@@ -552,11 +556,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 										{
 											Type: egv1a1.ProxyAccessLogSinkTypeALS,
 											ALS: &egv1a1.ALSEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Kind: ptr.To(gwapiv1.Kind("foo")),
+												BackendCluster: egv1a1.BackendCluster{
+													BackendRefs: []egv1a1.BackendRef{
+														{
+															BackendObjectReference: gwapiv1.BackendObjectReference{
+																Name: "fake-service",
+																Kind: ptr.To(gwapiv1.Kind("foo")),
+															},
 														},
 													},
 												},
@@ -584,11 +590,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 										{
 											Type: egv1a1.ProxyAccessLogSinkTypeALS,
 											ALS: &egv1a1.ALSEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name:  "fake-service",
-															Group: ptr.To(gwapiv1.Group("foo")),
+												BackendCluster: egv1a1.BackendCluster{
+													BackendRefs: []egv1a1.BackendRef{
+														{
+															BackendObjectReference: gwapiv1.BackendObjectReference{
+																Name:  "fake-service",
+																Group: ptr.To(gwapiv1.Group("foo")),
+															},
 														},
 													},
 												},
@@ -626,7 +634,7 @@ func TestEnvoyProxyProvider(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"Invalid value: \"null\""},
+			wantErrors: []string{"Invalid value: \"object\": must have at least one backend in backendRefs"},
 		},
 		{
 			desc: "invalid-accesslog-ALS-empty-backendrefs",
@@ -640,44 +648,8 @@ func TestEnvoyProxyProvider(t *testing.T) {
 										{
 											Type: egv1a1.ProxyAccessLogSinkTypeALS,
 											ALS: &egv1a1.ALSEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{},
-												Type:        egv1a1.ALSEnvoyProxyAccessLogTypeHTTP,
-											},
-										},
-									},
-								},
-							},
-						},
-					},
-				}
-			},
-			wantErrors: []string{"should have at least 1 items"},
-		},
-		{
-			desc: "invalid-accesslog-ALS-multi-backendrefs",
-			mutate: func(envoy *egv1a1.EnvoyProxy) {
-				envoy.Spec = egv1a1.EnvoyProxySpec{
-					Telemetry: &egv1a1.ProxyTelemetry{
-						AccessLog: &egv1a1.ProxyAccessLog{
-							Settings: []egv1a1.ProxyAccessLogSetting{
-								{
-									Sinks: []egv1a1.ProxyAccessLogSink{
-										{
-											Type: egv1a1.ProxyAccessLogSinkTypeALS,
-											ALS: &egv1a1.ALSEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Port: ptr.To(gwapiv1.PortNumber(8080)),
-														},
-													},
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Port: ptr.To(gwapiv1.PortNumber(8080)),
-														},
-													},
+												BackendCluster: egv1a1.BackendCluster{
+													BackendRefs: []egv1a1.BackendRef{},
 												},
 												Type: egv1a1.ALSEnvoyProxyAccessLogTypeHTTP,
 											},
@@ -689,7 +661,7 @@ func TestEnvoyProxyProvider(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"must have at most 1 items"},
+			wantErrors: []string{"must have at least one backend in backendRefs"},
 		},
 		{
 			desc: "accesslog-OpenTelemetry",
@@ -735,11 +707,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 										{
 											Type: egv1a1.ProxyAccessLogSinkTypeOpenTelemetry,
 											OpenTelemetry: &egv1a1.OpenTelemetryEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Kind: ptr.To(gwapiv1.Kind("foo")),
+												BackendCluster: egv1a1.BackendCluster{
+													BackendRefs: []egv1a1.BackendRef{
+														{
+															BackendObjectReference: gwapiv1.BackendObjectReference{
+																Name: "fake-service",
+																Kind: ptr.To(gwapiv1.Kind("foo")),
+															},
 														},
 													},
 												},
@@ -752,7 +726,7 @@ func TestEnvoyProxyProvider(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"only support Service Kind."},
+			wantErrors: []string{"Invalid value: \"object\": BackendRefs only supports Service kind."},
 		},
 		{
 			desc: "invalid-accesslog-backendref-group",
@@ -770,11 +744,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 										{
 											Type: egv1a1.ProxyAccessLogSinkTypeOpenTelemetry,
 											OpenTelemetry: &egv1a1.OpenTelemetryEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name:  "fake-service",
-															Group: ptr.To(gwapiv1.Group("foo")),
+												BackendCluster: egv1a1.BackendCluster{
+													BackendRefs: []egv1a1.BackendRef{
+														{
+															BackendObjectReference: gwapiv1.BackendObjectReference{
+																Name:  "fake-service",
+																Group: ptr.To(gwapiv1.Group("foo")),
+															},
 														},
 													},
 												},
@@ -805,12 +781,14 @@ func TestEnvoyProxyProvider(t *testing.T) {
 										{
 											Type: egv1a1.ProxyAccessLogSinkTypeOpenTelemetry,
 											OpenTelemetry: &egv1a1.OpenTelemetryEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Kind: ptr.To(gwapiv1.Kind("Service")),
-															Port: ptr.To(gwapiv1.PortNumber(8080)),
+												BackendCluster: egv1a1.BackendCluster{
+													BackendRefs: []egv1a1.BackendRef{
+														{
+															BackendObjectReference: gwapiv1.BackendObjectReference{
+																Name: "fake-service",
+																Kind: ptr.To(gwapiv1.Kind("Service")),
+																Port: ptr.To(gwapiv1.PortNumber(8080)),
+															},
 														},
 													},
 												},
@@ -824,49 +802,6 @@ func TestEnvoyProxyProvider(t *testing.T) {
 				}
 			},
 		},
-		{
-			desc: "multi-accesslog-backendref",
-			mutate: func(envoy *egv1a1.EnvoyProxy) {
-				envoy.Spec = egv1a1.EnvoyProxySpec{
-					Telemetry: &egv1a1.ProxyTelemetry{
-						AccessLog: &egv1a1.ProxyAccessLog{
-							Settings: []egv1a1.ProxyAccessLogSetting{
-								{
-									Format: &egv1a1.ProxyAccessLogFormat{
-										Type: "Text",
-										Text: ptr.To("[%START_TIME%]"),
-									},
-									Sinks: []egv1a1.ProxyAccessLogSink{
-										{
-											Type: egv1a1.ProxyAccessLogSinkTypeOpenTelemetry,
-											OpenTelemetry: &egv1a1.OpenTelemetryEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Kind: ptr.To(gwapiv1.Kind("Service")),
-															Port: ptr.To(gwapiv1.PortNumber(8080)),
-														},
-													},
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Kind: ptr.To(gwapiv1.Kind("Service")),
-															Port: ptr.To(gwapiv1.PortNumber(8080)),
-														},
-													},
-												},
-											},
-										},
-									},
-								},
-							},
-						},
-					},
-				}
-			},
-			wantErrors: []string{"must have at most 1 items"},
-		},
 		{
 			desc: "accesslog-backendref-empty-kind",
 			mutate: func(envoy *egv1a1.EnvoyProxy) {
@@ -883,11 +818,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 										{
 											Type: egv1a1.ProxyAccessLogSinkTypeOpenTelemetry,
 											OpenTelemetry: &egv1a1.OpenTelemetryEnvoyProxyAccessLog{
-												BackendRefs: []egv1a1.BackendRef{
-													{
-														BackendObjectReference: gwapiv1.BackendObjectReference{
-															Name: "fake-service",
-															Port: ptr.To(gwapiv1.PortNumber(8080)),
+												BackendCluster: egv1a1.BackendCluster{
+													BackendRefs: []egv1a1.BackendRef{
+														{
+															BackendObjectReference: gwapiv1.BackendObjectReference{
+																Name: "fake-service",
+																Port: ptr.To(gwapiv1.PortNumber(8080)),
+															},
 														},
 													},
 												},
@@ -993,11 +930,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 								{
 									Type: egv1a1.MetricSinkTypeOpenTelemetry,
 									OpenTelemetry: &egv1a1.ProxyOpenTelemetrySink{
-										BackendRefs: []egv1a1.BackendRef{
-											{
-												BackendObjectReference: gwapiv1.BackendObjectReference{
-													Name: "fake-service",
-													Port: ptr.To(gwapiv1.PortNumber(8080)),
+										BackendCluster: egv1a1.BackendCluster{
+											BackendRefs: []egv1a1.BackendRef{
+												{
+													BackendObjectReference: gwapiv1.BackendObjectReference{
+														Name: "fake-service",
+														Port: ptr.To(gwapiv1.PortNumber(8080)),
+													},
 												},
 											},
 										},
@@ -1010,39 +949,6 @@ func TestEnvoyProxyProvider(t *testing.T) {
 			},
 			wantErrors: []string{},
 		},
-		{
-			desc: "ProxyMetrics-sinks-multi-backendref",
-			mutate: func(envoy *egv1a1.EnvoyProxy) {
-				envoy.Spec = egv1a1.EnvoyProxySpec{
-					Telemetry: &egv1a1.ProxyTelemetry{
-						Metrics: &egv1a1.ProxyMetrics{
-							Sinks: []egv1a1.ProxyMetricSink{
-								{
-									Type: egv1a1.MetricSinkTypeOpenTelemetry,
-									OpenTelemetry: &egv1a1.ProxyOpenTelemetrySink{
-										BackendRefs: []egv1a1.BackendRef{
-											{
-												BackendObjectReference: gwapiv1.BackendObjectReference{
-													Name: "fake-service",
-													Port: ptr.To(gwapiv1.PortNumber(8080)),
-												},
-											},
-											{
-												BackendObjectReference: gwapiv1.BackendObjectReference{
-													Name: "fake-service",
-													Port: ptr.To(gwapiv1.PortNumber(8080)),
-												},
-											},
-										},
-									},
-								},
-							},
-						},
-					},
-				}
-			},
-			wantErrors: []string{"must have at most 1 items"},
-		},
 		{
 			desc: "ProxyMetrics-sinks-backendref-empty-kind",
 			mutate: func(envoy *egv1a1.EnvoyProxy) {
@@ -1053,11 +959,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 								{
 									Type: egv1a1.MetricSinkTypeOpenTelemetry,
 									OpenTelemetry: &egv1a1.ProxyOpenTelemetrySink{
-										BackendRefs: []egv1a1.BackendRef{
-											{
-												BackendObjectReference: gwapiv1.BackendObjectReference{
-													Name: "fake-service",
-													Port: ptr.To(gwapiv1.PortNumber(8080)),
+										BackendCluster: egv1a1.BackendCluster{
+											BackendRefs: []egv1a1.BackendRef{
+												{
+													BackendObjectReference: gwapiv1.BackendObjectReference{
+														Name: "fake-service",
+														Port: ptr.To(gwapiv1.PortNumber(8080)),
+													},
 												},
 											},
 										},
@@ -1080,12 +988,14 @@ func TestEnvoyProxyProvider(t *testing.T) {
 								{
 									Type: egv1a1.MetricSinkTypeOpenTelemetry,
 									OpenTelemetry: &egv1a1.ProxyOpenTelemetrySink{
-										BackendRefs: []egv1a1.BackendRef{
-											{
-												BackendObjectReference: gwapiv1.BackendObjectReference{
-													Name: "fake-service",
-													Kind: ptr.To(gwapiv1.Kind("foo")),
-													Port: ptr.To(gwapiv1.PortNumber(8080)),
+										BackendCluster: egv1a1.BackendCluster{
+											BackendRefs: []egv1a1.BackendRef{
+												{
+													BackendObjectReference: gwapiv1.BackendObjectReference{
+														Name: "fake-service",
+														Kind: ptr.To(gwapiv1.Kind("foo")),
+														Port: ptr.To(gwapiv1.PortNumber(8080)),
+													},
 												},
 											},
 										},
@@ -1096,7 +1006,7 @@ func TestEnvoyProxyProvider(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"only support Service Kind."},
+			wantErrors: []string{"only supports Service Kind."},
 		},
 		{
 			desc: "ProxyMetrics-sinks-invalid-backendref-group",
@@ -1108,12 +1018,14 @@ func TestEnvoyProxyProvider(t *testing.T) {
 								{
 									Type: egv1a1.MetricSinkTypeOpenTelemetry,
 									OpenTelemetry: &egv1a1.ProxyOpenTelemetrySink{
-										BackendRefs: []egv1a1.BackendRef{
-											{
-												BackendObjectReference: gwapiv1.BackendObjectReference{
-													Name:  "fake-service",
-													Group: ptr.To(gwapiv1.Group("foo")),
-													Port:  ptr.To(gwapiv1.PortNumber(8080)),
+										BackendCluster: egv1a1.BackendCluster{
+											BackendRefs: []egv1a1.BackendRef{
+												{
+													BackendObjectReference: gwapiv1.BackendObjectReference{
+														Name:  "fake-service",
+														Group: ptr.To(gwapiv1.Group("foo")),
+														Port:  ptr.To(gwapiv1.PortNumber(8080)),
+													},
 												},
 											},
 										},
@@ -1134,11 +1046,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 						Tracing: &egv1a1.ProxyTracing{
 							Provider: egv1a1.TracingProvider{
 								Type: egv1a1.TracingProviderTypeOpenTelemetry,
-								BackendRefs: []egv1a1.BackendRef{
-									{
-										BackendObjectReference: gwapiv1.BackendObjectReference{
-											Name: "fake-service",
-											Kind: ptr.To(gwapiv1.Kind("foo")),
+								BackendCluster: egv1a1.BackendCluster{
+									BackendRefs: []egv1a1.BackendRef{
+										{
+											BackendObjectReference: gwapiv1.BackendObjectReference{
+												Name: "fake-service",
+												Kind: ptr.To(gwapiv1.Kind("foo")),
+											},
 										},
 									},
 								},
@@ -1147,7 +1061,7 @@ func TestEnvoyProxyProvider(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"only support Service Kind."},
+			wantErrors: []string{"only supports Service Kind."},
 		},
 		{
 			desc: "tracing-backendref-empty-kind",
@@ -1157,11 +1071,13 @@ func TestEnvoyProxyProvider(t *testing.T) {
 						Tracing: &egv1a1.ProxyTracing{
 							Provider: egv1a1.TracingProvider{
 								Type: egv1a1.TracingProviderTypeOpenTelemetry,
-								BackendRefs: []egv1a1.BackendRef{
-									{
-										BackendObjectReference: gwapiv1.BackendObjectReference{
-											Name: "fake-service",
-											Port: ptr.To(gwapiv1.PortNumber(8080)),
+								BackendCluster: egv1a1.BackendCluster{
+									BackendRefs: []egv1a1.BackendRef{
+										{
+											BackendObjectReference: gwapiv1.BackendObjectReference{
+												Name: "fake-service",
+												Port: ptr.To(gwapiv1.PortNumber(8080)),
+											},
 										},
 									},
 								},
@@ -1179,42 +1095,14 @@ func TestEnvoyProxyProvider(t *testing.T) {
 						Tracing: &egv1a1.ProxyTracing{
 							Provider: egv1a1.TracingProvider{
 								Type: egv1a1.TracingProviderTypeOpenTelemetry,
-								BackendRefs: []egv1a1.BackendRef{
-									{
-										BackendObjectReference: gwapiv1.BackendObjectReference{
-											Name: "fake-service",
-											Kind: ptr.To(gwapiv1.Kind("Service")),
-											Port: ptr.To(gwapiv1.PortNumber(8080)),
-										},
-									},
-								},
-							},
-						},
-					},
-				}
-			},
-		},
-		{
-			desc: "tracing-multi-backendref",
-			mutate: func(envoy *egv1a1.EnvoyProxy) {
-				envoy.Spec = egv1a1.EnvoyProxySpec{
-					Telemetry: &egv1a1.ProxyTelemetry{
-						Tracing: &egv1a1.ProxyTracing{
-							Provider: egv1a1.TracingProvider{
-								Type: egv1a1.TracingProviderTypeOpenTelemetry,
-								BackendRefs: []egv1a1.BackendRef{
-									{
-										BackendObjectReference: gwapiv1.BackendObjectReference{
-											Name: "fake-service",
-											Kind: ptr.To(gwapiv1.Kind("Service")),
-											Port: ptr.To(gwapiv1.PortNumber(8080)),
-										},
-									},
-									{
-										BackendObjectReference: gwapiv1.BackendObjectReference{
-											Name: "fake-service",
-											Kind: ptr.To(gwapiv1.Kind("Service")),
-											Port: ptr.To(gwapiv1.PortNumber(8080)),
+								BackendCluster: egv1a1.BackendCluster{
+									BackendRefs: []egv1a1.BackendRef{
+										{
+											BackendObjectReference: gwapiv1.BackendObjectReference{
+												Name: "fake-service",
+												Kind: ptr.To(gwapiv1.Kind("Service")),
+												Port: ptr.To(gwapiv1.PortNumber(8080)),
+											},
 										},
 									},
 								},
@@ -1223,7 +1111,6 @@ func TestEnvoyProxyProvider(t *testing.T) {
 					},
 				}
 			},
-			wantErrors: []string{"must have at most 1 items"},
 		},
 		{
 			desc: "tracing-empty-backend",