Repository: envoyproxy/gateway

Issue:
TestE2E/PreserveCase flaky
```console
=== RUN   TestE2E/PreserveCase
    conformance.go:72: 2025-05-08T11:25:15.847728215Z: Applying testdata/preserve-case.yaml
    apply.go:275: 2025-05-08T11:25:15.861242602Z: Creating gateway-preserve-case-backend Namespace
    apply.go:275: 2025-05-08T11:25:15.871427685Z: Creating allow-preserve-case ReferenceGrant
    apply.go:275: 2025-05-08T11:25:15.882614393Z: Creating preserve-case ClientTrafficPolicy
    apply.go:275: 2025-05-08T11:25:15.888289118Z: Creating preserve-case HTTPRoute
    apply.go:275: 2025-05-08T11:25:15.903823951Z: Creating preserve-case Deployment
    apply.go:275: 2025-05-08T11:25:15.921650653Z: Creating fasthttp-backend Service
=== RUN   TestE2E/PreserveCase/should_preserve_header_cases_in_both_directions
    helpers.go:611: 2025-05-08T11:25:15.979804281Z: Route gateway-conformance-infra/preserve-case expected 1 Parents got 0
    helpers.go:611: 2025-05-08T11:25:16.960642579Z: Conditions matched expectations
    helpers.go:611: 2025-05-08T11:25:16.960695818Z: Route gateway-conformance-infra/preserve-case Parents matched expectations
    utils.go:58: 2025-05-08T11:25:16.96306644Z: waiting for gateway-preserve-case-backend/[map[app:preserve-case]] to be Running...
    preservecase.go:129: 2025-05-08T11:25:18.974304804Z: Making GET request to http://[fc00:f853:ccd:e793::cb]/preserve?headers=ReSpOnSeHeAdEr
Sending Request:
< GET /preserve?headers=ReSpOnSeHeAdEr HTTP/1.1
< Host: [fc00:f853:ccd:e793::cb]
< User-Agent: Go-http-client/1.1
< SpEcIaL: Header
< X-Echo-Set-Header: 
< Accept-Encoding: gzip
< 
< 

Received Response:
< HTTP/1.1 503 Service Unavailable
< Date: Thu, 08 May 2025 11:25:18 GMT
< Content-Length: 0
< 
< 

    preservecase.go:132: failed to get expected response: unexpected error reading response: unexpected end of JSON input
    preservecase.go:136: case was not preserved for test header: map[]
=== NAME  TestE2E/PreserveCase
    apply.go:283: 2025-05-08T11:25:18.977177117Z: Deleting fasthttp-backend Service
    apply.go:283: 2025-05-08T11:25:19.028798334Z: Deleting preserve-case Deployment
    apply.go:283: 2025-05-08T11:25:19.039109934Z: Deleting preserve-case HTTPRoute
    apply.go:283: 2025-05-08T11:25:19.050509631Z: Deleting preserve-case ClientTrafficPolicy
    apply.go:283: 2025-05-08T11:25:19.065401978Z: Deleting allow-preserve-case ReferenceGrant
    apply.go:283: 2025-05-08T11:25:19.082246632Z: Deleting gateway-preserve-case-backend Namespace
```

Hints from issue comments:

Solution patch:
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index 897b030dc..b4eb87c0f 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -228,63 +228,72 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 					string(gwapiv1.GatewayClassReasonInvalidParameters),
 					msg)
 				r.resources.GatewayClassStatuses.Store(utils.NamespacedName(gc), &gc.Status)
-				return reconcile.Result{}, nil
+				continue
 			}
 		}
 
 		// Add all Gateways, their associated Routes, and referenced resources to the resourceTree
 		if err = r.processGateways(ctx, managedGC, resourceMappings, gwcResource); err != nil {
-			return reconcile.Result{}, err
+			r.log.Error(err, fmt.Sprintf("failed processGateways for gatewayClass %s, skipping it", managedGC.Name))
+			continue
 		}
 
 		if r.eppCRDExists {
 			// Add all EnvoyPatchPolicies to the resourceTree
 			if err = r.processEnvoyPatchPolicies(ctx, gwcResource, resourceMappings); err != nil {
-				return reconcile.Result{}, err
+				r.log.Error(err, fmt.Sprintf("failed processEnvoyPatchPolicies for gatewayClass %s, skipping it", managedGC.Name))
+				continue
 			}
 		}
 		if r.ctpCRDExists {
 			// Add all ClientTrafficPolicies and their referenced resources to the resourceTree
 			if err = r.processClientTrafficPolicies(ctx, gwcResource, resourceMappings); err != nil {
-				return reconcile.Result{}, err
+				r.log.Error(err, fmt.Sprintf("failed processClientTrafficPolicies for gatewayClass %s, skipping it", managedGC.Name))
+				continue
 			}
 		}
 
 		if r.btpCRDExists {
 			// Add all BackendTrafficPolicies to the resourceTree
 			if err = r.processBackendTrafficPolicies(ctx, gwcResource, resourceMappings); err != nil {
-				return reconcile.Result{}, err
+				r.log.Error(err, fmt.Sprintf("failed processBackendTrafficPolicies for gatewayClass %s, skipping it", managedGC.Name))
+				continue
 			}
 		}
 
 		if r.spCRDExists {
 			// Add all SecurityPolicies and their referenced resources to the resourceTree
 			if err = r.processSecurityPolicies(ctx, gwcResource, resourceMappings); err != nil {
-				return reconcile.Result{}, err
+				r.log.Error(err, fmt.Sprintf("failed processSecurityPolicies for gatewayClass %s, skipping it", managedGC.Name))
+				continue
 			}
 		}
 
 		if r.bTLSPolicyCRDExists {
 			// Add all BackendTLSPolies to the resourceTree
 			if err = r.processBackendTLSPolicies(ctx, gwcResource, resourceMappings); err != nil {
-				return reconcile.Result{}, err
+				r.log.Error(err, fmt.Sprintf("failed processBackendTLSPolicies for gatewayClass %s, skipping it", managedGC.Name))
+				continue
 			}
 		}
 
 		if r.eepCRDExists {
 			// Add all EnvoyExtensionPolicies and their referenced resources to the resourceTree
 			if err = r.processEnvoyExtensionPolicies(ctx, gwcResource, resourceMappings); err != nil {
-				return reconcile.Result{}, err
+				r.log.Error(err, fmt.Sprintf("failed processEnvoyExtensionPolicies for gatewayClass %s, skipping it", managedGC.Name))
+				continue
 			}
 		}
 
 		if err = r.processExtensionServerPolicies(ctx, gwcResource); err != nil {
-			return reconcile.Result{}, err
+			r.log.Error(err, fmt.Sprintf("failed processExtensionServerPolicies for gatewayClass %s, skipping it", managedGC.Name))
+			continue
 		}
 
 		if r.backendCRDExists {
 			if err = r.processBackends(ctx, gwcResource); err != nil {
-				return reconcile.Result{}, err
+				r.log.Error(err, fmt.Sprintf("failed processBackends for gatewayClass %s, skipping it", managedGC.Name))
+				continue
 			}
 		}
 
@@ -300,9 +309,9 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 			if err != nil {
 				r.log.Error(err, "unable to find the namespace")
 				if kerrors.IsNotFound(err) {
-					return reconcile.Result{}, nil
+					continue
 				}
-				return reconcile.Result{}, err
+				continue
 			}
 
 			gwcResource.Namespaces = append(gwcResource.Namespaces, namespace)
@@ -326,20 +335,20 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 		r.resources.GatewayClassStatuses.Store(utils.NamespacedName(gc), &gc.Status)
 
 		if len(gwcResource.Gateways) == 0 {
-			r.log.Info("No gateways found for accepted gatewayclass")
+			r.log.Info("No gateways found for accepted gatewayClass")
 
 			// If needed, remove the finalizer from the accepted GatewayClass.
 			if err := r.removeFinalizer(ctx, managedGC); err != nil {
-				r.log.Error(err, fmt.Sprintf("failed to remove finalizer from gatewayclass %s",
+				r.log.Error(err, fmt.Sprintf("failed to remove finalizer from gatewayClass %s",
 					managedGC.Name))
-				return reconcile.Result{}, err
+				continue
 			}
 		} else {
 			// finalize the accepted GatewayClass.
 			if err := r.addFinalizer(ctx, managedGC); err != nil {
-				r.log.Error(err, fmt.Sprintf("failed adding finalizer to gatewayclass %s",
+				r.log.Error(err, fmt.Sprintf("failed adding finalizer to gatewayClass %s",
 					managedGC.Name))
-				return reconcile.Result{}, err
+				continue
 			}
 		}
 	}
@@ -1046,7 +1055,7 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 	if err := r.client.List(ctx, gatewayList, &client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(classGatewayIndex, managedGC.Name),
 	}); err != nil {
-		r.log.Info("no associated Gateways found for GatewayClass", "name", managedGC.Name)
+		r.log.Error(err, "failed to list gateways for gatewayClass %s", managedGC.Name)
 		return err
 	}
 
diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go
index bae4e0d0a..78c09a7e0 100644
--- a/internal/xds/translator/listener.go
+++ b/internal/xds/translator/listener.go
@@ -517,6 +517,16 @@ func buildEarlyHeaderMutation(headers *ir.HeaderSettings) []*corev3.TypedExtensi
 }
 
 func addServerNamesMatch(xdsListener *listenerv3.Listener, filterChain *listenerv3.FilterChain, hostnames []string) error {
+	// Skip adding ServerNames match for:
+	// 1. nil listeners
+	// 2. UDP (QUIC) listeners used for HTTP3
+	// 3. wildcard hostnames
+	if xdsListener == nil || (xdsListener.GetAddress() != nil &&
+		xdsListener.GetAddress().GetSocketAddress() != nil &&
+		xdsListener.GetAddress().GetSocketAddress().GetProtocol() == corev3.SocketAddress_UDP) {
+		return nil
+	}
+
 	// Dont add a filter chain match if the hostname is a wildcard character.
 	if len(hostnames) > 0 && hostnames[0] != "*" {
 		filterChain.FilterChainMatch = &listenerv3.FilterChainMatch{
diff --git a/release-notes/v1.3.3.yaml b/release-notes/v1.3.3.yaml
new file mode 100644
index 000000000..9b45e4f5e
--- /dev/null
+++ b/release-notes/v1.3.3.yaml
@@ -0,0 +1,14 @@
+date: May 8, 2025
+
+bug fixes: |
+  Fix issue where ReferenceGrant from SecurityPolicy to the referenced RemoteJWKS backend was not respected.
+  Fix HTTPRoute precedence by correctly considering header and query match types.
+  Fix to return an error if direct response size exceeds the limit.
+  Fix to avoid adding the TLS inspector filter to QUIC listeners.
+  Fix to continue processing remaining GatewayClasses after encountering an error.
+  Add validation for header values.
+
+# Other notable changes not covered by the above sections.
+Other changes: |
+  Bumped envoy to v1.33.3.
+  Bumped ratelimit to 3e085e5b.
diff --git a/site/content/en/news/releases/notes/v1.3.3.md b/site/content/en/news/releases/notes/v1.3.3.md
new file mode 100644
index 000000000..1f8b83fc3
--- /dev/null
+++ b/site/content/en/news/releases/notes/v1.3.3.md
@@ -0,0 +1,19 @@
+---
+title: "v1.3.3"
+publishdate: 2025-05-08
+---
+
+Date: May 8, 2025
+
+## Bug fixes
+- Fix issue where ReferenceGrant from SecurityPolicy to the referenced RemoteJWKS backend was not respected.
+- Fix HTTPRoute precedence by correctly considering header and query match types.
+- Fix to return an error if direct response size exceeds the limit.
+- Fix to avoid adding the TLS inspector filter to QUIC listeners.
+- Fix to continue processing remaining GatewayClasses after encountering an error.
+- Add validation for header values.
+
+## Other changes
+- Bumped envoy to v1.33.3.
+- Bumped ratelimit to 3e085e5b.
+



Test patch:
diff --git a/internal/xds/translator/server_names_match_test.go b/internal/xds/translator/server_names_match_test.go
new file mode 100644
index 000000000..ce2f8b108
--- /dev/null
+++ b/internal/xds/translator/server_names_match_test.go
@@ -0,0 +1,134 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package translator
+
+import (
+	"testing"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAddServerNamesMatch(t *testing.T) {
+	tests := []struct {
+		name               string
+		xdsListener        *listenerv3.Listener
+		hostnames          []string
+		expectFilterChain  bool
+		expectTLSInspector bool
+		expectServerNames  []string
+	}{
+		{
+			name:               "nil listener",
+			xdsListener:        nil,
+			hostnames:          []string{"example.com"},
+			expectFilterChain:  false,
+			expectTLSInspector: false,
+			expectServerNames:  nil,
+		},
+		{
+			name: "UDP (QUIC) listener for HTTP3",
+			xdsListener: &listenerv3.Listener{
+				Address: &corev3.Address{
+					Address: &corev3.Address_SocketAddress{
+						SocketAddress: &corev3.SocketAddress{
+							Protocol: corev3.SocketAddress_UDP,
+							Address:  "0.0.0.0",
+							PortSpecifier: &corev3.SocketAddress_PortValue{
+								PortValue: 443,
+							},
+						},
+					},
+				},
+			},
+			hostnames:          []string{"example.com"},
+			expectFilterChain:  false,
+			expectTLSInspector: false,
+			expectServerNames:  nil,
+		},
+		{
+			name: "TCP listener with non-wildcard hostnames",
+			xdsListener: &listenerv3.Listener{
+				Address: &corev3.Address{
+					Address: &corev3.Address_SocketAddress{
+						SocketAddress: &corev3.SocketAddress{
+							Protocol: corev3.SocketAddress_TCP,
+							Address:  "0.0.0.0",
+							PortSpecifier: &corev3.SocketAddress_PortValue{
+								PortValue: 443,
+							},
+						},
+					},
+				},
+			},
+			hostnames:          []string{"example.com", "api.example.com"},
+			expectFilterChain:  true,
+			expectTLSInspector: true,
+			expectServerNames:  []string{"example.com", "api.example.com"},
+		},
+		{
+			name: "TCP listener with wildcard hostname",
+			xdsListener: &listenerv3.Listener{
+				Address: &corev3.Address{
+					Address: &corev3.Address_SocketAddress{
+						SocketAddress: &corev3.SocketAddress{
+							Protocol: corev3.SocketAddress_TCP,
+							Address:  "0.0.0.0",
+							PortSpecifier: &corev3.SocketAddress_PortValue{
+								PortValue: 443,
+							},
+						},
+					},
+				},
+			},
+			hostnames:          []string{"*"},
+			expectFilterChain:  false,
+			expectTLSInspector: false,
+			expectServerNames:  nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			filterChain := &listenerv3.FilterChain{}
+
+			err := addServerNamesMatch(tt.xdsListener, filterChain, tt.hostnames)
+			require.NoError(t, err)
+
+			// Check if filter chain match was added
+			if tt.expectFilterChain {
+				require.NotNil(t, filterChain.FilterChainMatch)
+				require.Equal(t, tt.expectServerNames, filterChain.FilterChainMatch.ServerNames)
+			} else {
+				require.Nil(t, filterChain.FilterChainMatch)
+			}
+
+			// Check if TLS inspector was added
+			if tt.xdsListener != nil && tt.expectTLSInspector {
+				hasTLSInspector := false
+				for _, filter := range tt.xdsListener.ListenerFilters {
+					if filter.Name == wellknown.TlsInspector {
+						hasTLSInspector = true
+						break
+					}
+				}
+				require.True(t, hasTLSInspector, "TLS inspector filter should be added")
+			} else if tt.xdsListener != nil {
+				// For non-nil listeners that shouldn't have TLS inspector
+				hasTLSInspector := false
+				for _, filter := range tt.xdsListener.ListenerFilters {
+					if filter.Name == wellknown.TlsInspector {
+						hasTLSInspector = true
+						break
+					}
+				}
+				require.False(t, hasTLSInspector, "TLS inspector filter should not be added")
+			}
+		})
+	}
+}
diff --git a/test/e2e/tests/preservecase.go b/test/e2e/tests/preservecase.go
index 1754186f3..41d731168 100644
--- a/test/e2e/tests/preservecase.go
+++ b/test/e2e/tests/preservecase.go
@@ -16,13 +16,16 @@ import (
 	"net/http/httputil"
 	"regexp"
 	"testing"
+	"time"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/wait"
 	"sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/tlog"
 )
 
 func init() {
@@ -113,27 +116,37 @@ var PreserveCaseTest = suite.ConformanceTest{
 			gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
 
 			WaitForPods(t, suite.Client, "gateway-preserve-case-backend", map[string]string{"app": "preserve-case"}, corev1.PodRunning, PodReady)
-			// Can't use the standard method for checking the response, since the remote side isn't the
-			// conformance echo server and it returns a differently formatted response.
-			expectedResponse := http.ExpectedResponse{
-				Request: http.Request{
-					Path: "/preserve?headers=ReSpOnSeHeAdEr",
-					Headers: map[string]string{
-						"SpEcIaL": "Header",
-					},
-				},
-				Namespace: ns,
-			}
 
-			var rt nethttp.RoundTripper
-			req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
-			respBody, err := casePreservingRoundTrip(req, rt, suite)
+			err := wait.PollUntilContextTimeout(context.TODO(), time.Second, suite.TimeoutConfig.DeleteTimeout, true, func(ctx context.Context) (bool, error) {
+				// Can't use the standard method for checking the response, since the remote side isn't the
+				// conformance echo server and it returns a differently formatted response.
+				expectedResponse := http.ExpectedResponse{
+					Request: http.Request{
+						Path: "/preserve?headers=ReSpOnSeHeAdEr",
+						Headers: map[string]string{
+							"SpEcIaL": "Header",
+						},
+					},
+					Namespace: ns,
+				}
+
+				var rt nethttp.RoundTripper
+				req := http.MakeRequest(t, &expectedResponse, gwAddr, "HTTP", "http")
+				respBody, err := casePreservingRoundTrip(req, rt, suite)
+				if err != nil {
+					tlog.Logf(t, "failed to get expected response: %v", err)
+					return false, nil
+				}
+
+				if _, found := respBody["SpEcIaL"]; !found {
+					tlog.Logf(t, "case was not preserved for test header: %+v", respBody)
+					return false, nil
+				}
+
+				return true, nil
+			})
 			if err != nil {
-				t.Errorf("failed to get expected response: %v", err)
-			}
-
-			if _, found := respBody["SpEcIaL"]; !found {
-				t.Errorf("case was not preserved for test header: %+v", respBody)
+				tlog.Errorf(t, "failed to get expected response: %v", err)
 			}
 		})
 	},
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/api_key_auth b/test/fuzz/testdata/FuzzGatewayAPIToXDS/api_key_auth
new file mode 100644
index 000000000..b7622cf03
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/api_key_auth
@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: apikey-secret
+stringData:
+  client1: supersecret
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: apikey-auth-example
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
+  apiKeyAuth:
+    credentialRefs:
+    - group: ""
+      kind: Secret
+      name: apikey-secret
+    extractFrom:
+    - headers:
+      - x-api-key
\ No newline at end of file
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/backend_routing b/test/fuzz/testdata/FuzzGatewayAPIToXDS/backend_routing
new file mode 100644
index 000000000..365992602
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/backend_routing
@@ -0,0 +1,46 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envoy-gateway-config
+  namespace: envoy-gateway-system
+data:
+  envoy-gateway.yaml: |
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyGateway
+    provider:
+      type: Kubernetes
+    gateway:
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    extensionApis:
+      enableBackend: true
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - "www.example.com"
+  rules:
+    - backendRefs:
+        - group: gateway.envoyproxy.io
+          kind: Backend
+          name: httpbin
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+  name: httpbin
+  namespace: default
+spec:
+  endpoints:
+    - fqdn:
+        hostname: httpbin.org
+        port: 80
\ No newline at end of file
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/basic_auth b/test/fuzz/testdata/FuzzGatewayAPIToXDS/basic_auth
new file mode 100644
index 000000000..51d692a4b
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/basic_auth
@@ -0,0 +1,13 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: basic-auth-example
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
+  basicAuth:
+    users:
+      name: "basic-auth"
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/circuit_breaker b/test/fuzz/testdata/FuzzGatewayAPIToXDS/circuit_breaker
new file mode 100644
index 000000000..bc1768662
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/circuit_breaker
@@ -0,0 +1,13 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: circuitbreaker-for-route
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
+  circuitBreaker:
+    maxPendingRequests: 0
+    maxParallelRequests: 10
\ No newline at end of file
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/client_traffic_policy b/test/fuzz/testdata/FuzzGatewayAPIToXDS/client_traffic_policy
new file mode 100644
index 000000000..5e861ddbc
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/client_traffic_policy
@@ -0,0 +1,84 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-tcp-keepalive-policy
+  namespace: default
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
+  tcpKeepalive:
+    idleTime: 20m
+    interval: 60s
+    probes: 3
+
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-proxy-protocol-policy
+  namespace: default
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
+  enableProxyProtocol: true
+
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: http-client-ip-detection
+  namespace: default
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
+  clientIPDetection:
+    xForwardedFor:
+      numTrustedHops: 2
+
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: client-timeout
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
+  timeout:
+    http:
+      requestReceivedTimeout: 2s
+
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: client-timeout
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
+  timeout:
+    http:
+      idleTimeout: 5s
+
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: client-timeout
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
+  connection:
+    bufferLimit: 1024
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/configmap b/test/fuzz/testdata/FuzzGatewayAPIToXDS/configmap
deleted file mode 100644
index e19bde2cc..000000000
--- a/test/fuzz/testdata/FuzzGatewayAPIToXDS/configmap
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: configmap
-  namespace: default
-data:
-  player_initial_lives: "3"
-  game.properties: |
-    enemy.types=aliens,monsters
-    player.maximum-lives=5
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/connection_limit b/test/fuzz/testdata/FuzzGatewayAPIToXDS/connection_limit
new file mode 100644
index 000000000..27d045886
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/connection_limit
@@ -0,0 +1,14 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: connection-limit-ctp
+  namespace: default
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
+  connection:
+    connectionLimit:
+      value: 5
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/cors b/test/fuzz/testdata/FuzzGatewayAPIToXDS/cors
new file mode 100644
index 000000000..09c0b94ae
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/cors
@@ -0,0 +1,23 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: cors-example
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: backend
+  cors:
+    allowOrigins:
+    - "http://*.foo.com"
+    - "http://*.foo.com:80"
+    allowMethods:
+    - GET
+    - POST
+    allowHeaders:
+    - "x-header-1"
+    - "x-header-2"
+    exposeHeaders:
+    - "x-header-3"
+    - "x-header-4"
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/direct_response b/test/fuzz/testdata/FuzzGatewayAPIToXDS/direct_response
new file mode 100644
index 000000000..3f7370a85
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/direct_response
@@ -0,0 +1,65 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: direct-response
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /inline
+    filters:
+    - type: ExtensionRef
+      extensionRef:
+        group: gateway.envoyproxy.io
+        kind: HTTPRouteFilter
+        name: direct-response-inline
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /value-ref
+    filters:
+    - type: ExtensionRef
+      extensionRef:
+        group: gateway.envoyproxy.io
+        kind: HTTPRouteFilter
+        name: direct-response-value-ref
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: value-ref-response
+data:
+  response.body: '{"error": "Internal Server Error"}'
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: HTTPRouteFilter
+metadata:
+  name: direct-response-inline
+spec:
+  directResponse:
+    contentType: text/plain
+    statusCode: 503
+    body:
+      type: Inline
+      inline: "Oops! Your request is not found."
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: HTTPRouteFilter
+metadata:
+  name: direct-response-value-ref
+spec:
+  directResponse:
+    contentType: application/json
+    statusCode: 500
+    body:
+      type: ValueRef
+      valueRef:
+        group: ""
+        kind: ConfigMap
+        name: value-ref-response
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/envoy_patch_policy b/test/fuzz/testdata/FuzzGatewayAPIToXDS/envoy_patch_policy
new file mode 100644
index 000000000..5210a33fc
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/envoy_patch_policy
@@ -0,0 +1,31 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyPatchPolicy
+metadata:
+  name: custom-response-patch-policy
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  type: JSONPatch
+  jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      # The listener name is of the form <GatewayNamespace>/<GatewayName>/<GatewayListenerName>
+      name: default/eg/http
+      operation:
+        op: add
+        path: "/default_filter_chain/filters/0/typed_config/local_reply_config"
+        value:
+          mappers:
+          - filter:
+              status_code_filter:
+                comparison:
+                  op: EQ
+                  value:
+                    default_value: 404
+                    runtime_key: key_b
+            status_code: 406
+            body:
+              inline_string: "could not find what you are looking for"
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/extension_server b/test/fuzz/testdata/FuzzGatewayAPIToXDS/extension_server
new file mode 100644
index 000000000..05a95e218
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/extension_server
@@ -0,0 +1,54 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: myapp
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /myapp
+    backendRefs:
+    - name: backend
+      port: 3000
+
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyExtensionPolicy
+metadata:
+  name: ext-proc-example
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
+  extProc:
+    - backendRefs:
+        - name: grpc-ext-proc
+          port: 9002
+      processingMode:
+        request: {}
+        response:
+          body: Streamed
+
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: grpc-ext-proc-btls
+spec:
+  targetRefs:
+    - group: ''
+      kind: Service
+      name: grpc-ext-proc
+  validation:
+    caCertificateRefs:
+      - name: grpc-ext-proc-ca
+        group: ''
+        kind: ConfigMap
+    hostname: grpc-ext-proc.envoygateway
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/external_auth b/test/fuzz/testdata/FuzzGatewayAPIToXDS/external_auth
new file mode 100644
index 000000000..2ec8f89d2
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/external_auth
@@ -0,0 +1,34 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: myapp
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /myapp
+    backendRefs:
+    - name: backend
+      port: 3000
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: ext-auth-example
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: myapp
+  extAuth:
+    http:
+      backendRefs:
+        - name: http-ext-auth
+          port: 9002
+      headersToBackend: ["x-current-user"]
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/failover b/test/fuzz/testdata/FuzzGatewayAPIToXDS/failover
new file mode 100644
index 000000000..cb5882064
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/failover
@@ -0,0 +1,201 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: active
+  labels:
+    app: active
+    service: active
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+  selector:
+    app: active
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: active
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: active
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: active
+        version: v1
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: active
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: passive
+  labels:
+    app: passive
+    service: passive
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+  selector:
+    app: passive
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: passive
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: passive
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: passive
+        version: v1
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: passive
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+  name: passive
+spec:
+  fallback: true
+  endpoints:
+    - fqdn:
+        hostname: passive.default.svc.cluster.local
+        port: 3000
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+  name: active
+spec:
+  endpoints:
+  - fqdn:
+      hostname: active.default.svc.cluster.local
+      port: 3000
+---
+
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ha-example
+  namespace: default
+spec:
+  hostnames:
+  - www.example.com
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+  rules:
+  - backendRefs:
+    - group: gateway.envoyproxy.io
+      kind: Backend
+      name: active
+      namespace: default
+      port: 3000
+    - group: gateway.envoyproxy.io
+      kind: Backend
+      name: passive
+      namespace: default
+      port: 3000
+    matches:
+    - path:
+        type: PathPrefix
+        value: /test
+
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: passive-health-check
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: ha-example
+  healthCheck:
+    passive:
+      baseEjectionTime: 10s
+      interval: 2s
+      maxEjectionPercent: 100
+      consecutive5XxErrors: 1
+      consecutiveGatewayErrors: 0
+      consecutiveLocalOriginFailures: 1
+      splitExternalLocalOriginErrors: false
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: active
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: active
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: active
+        version: v1
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: active
+          ports:
+            - containerPort: 3000
+          env:
+            - name: HTTP_PORT
+              value: "5000"
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/fault_injection b/test/fuzz/testdata/FuzzGatewayAPIToXDS/fault_injection
new file mode 100644
index 000000000..8691a60c0
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/fault_injection
@@ -0,0 +1,69 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: fault-injection-50-percent-abort
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: foo
+  faultInjection:
+    abort:
+      httpStatus: 501
+      percentage: 50
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: fault-injection-delay
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: bar
+  faultInjection:
+    delay:
+      fixedDelay: 2s
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: foo
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /foo
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: bar
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /bar
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/global_rate_limit b/test/fuzz/testdata/FuzzGatewayAPIToXDS/global_rate_limit
new file mode 100644
index 000000000..d4f91e5cd
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/global_rate_limit
@@ -0,0 +1,71 @@
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: redis-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: redis-system
+  labels:
+    app: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - image: redis:6.0.6
+        imagePullPolicy: IfNotPresent
+        name: redis
+        resources:
+          limits:
+            cpu: 1500m
+            memory: 512Mi
+          requests:
+            cpu: 200m
+            memory: 256Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: redis-system
+  labels:
+    app: redis
+  annotations:
+spec:
+  ports:
+  - name: redis
+    port: 6379
+    protocol: TCP
+    targetPort: 6379
+  selector:
+    app: redis
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envoy-gateway-config
+  namespace: envoy-gateway-system
+data:
+  envoy-gateway.yaml: |
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyGateway
+    provider:
+      type: Kubernetes
+    gateway:
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    rateLimit:
+      backend:
+        type: Redis
+        redis:
+          url: redis.redis-system.svc.cluster.local:6379
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/gateway_and_grpcroute b/test/fuzz/testdata/FuzzGatewayAPIToXDS/grpc_routing
similarity index 100%
rename from test/fuzz/testdata/FuzzGatewayAPIToXDS/gateway_and_grpcroute
rename to test/fuzz/testdata/FuzzGatewayAPIToXDS/grpc_routing
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/grpcroute b/test/fuzz/testdata/FuzzGatewayAPIToXDS/grpcroute
deleted file mode 100644
index dfb260f20..000000000
--- a/test/fuzz/testdata/FuzzGatewayAPIToXDS/grpcroute
+++ /dev/null
@@ -1,22 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: GRPCRoute
-metadata:
-  name: backend
-  namespace: default
-spec:
-  parentRefs:
-    - name: eg
-      sectionName: grpc
-  hostnames:
-    - "www.grpc-example.com"
-  rules:
-    - matches:
-        - method:
-            service: com.example.Things
-            method: DoThing
-          headers:
-            - name: com.example.Header
-              value: foobar
-      backendRefs:
-        - name: providedBackend
-          port: 9000
\ No newline at end of file
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_redirect b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_redirect
new file mode 100644
index 000000000..eeffdfb6f
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_redirect
@@ -0,0 +1,99 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-to-https-filter-redirect
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - redirect.example
+  rules:
+    - filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: https
+          statusCode: 301
+          hostname: www.example.com
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: eg
+spec:
+  gatewayClassName: eg
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    # hostname: "*.example.com"
+  - name: https
+    port: 443
+    protocol: HTTPS
+    # hostname: "*.example.com"
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - kind: Secret
+        name: example-com
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: tls-redirect
+spec:
+  parentRefs:
+    - name: eg
+      sectionName: http
+  hostnames:
+    # - "*.example.com" # catch all hostnames
+    - "www.example.com"
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+spec:
+  parentRefs:
+    - name: eg
+      sectionName: https
+  hostnames:
+    - "www.example.com"
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backend
+          port: 3000
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-filter-path-redirect
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - path.redirect.example
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /get
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          path:
+            type: ReplaceFullPath
+            replaceFullPath: /status/200
+          statusCode: 302
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_request_header b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_request_header
new file mode 100644
index 000000000..f4144da1d
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_request_header
@@ -0,0 +1,52 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - headers.example
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: backend
+          port: 3000
+          weight: 1
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            add:
+              - name: early-added-header
+                value: late
+              - name: early-set-header
+                value: late
+              - name: early-removed-header
+                value: late
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-early-headers
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  headers:
+    earlyRequestHeaders:
+      add:
+        - name: "early-added-header"
+          value: "early"
+      set:
+        - name: "early-set-header"
+          value: "early"
+      remove:
+        - "early-removed-header"
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_response_header b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_response_header
new file mode 100644
index 000000000..dfe93b95c
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_response_header
@@ -0,0 +1,32 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    filters:
+    - type: ResponseHeaderModifier
+      responseHeaderModifier:
+        add:
+        - name: "add-header-1"
+          value: "foo"
+        set:
+        - name: "set-header-1"
+          value: "bar"
+        remove:
+        - "removed-header"
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/gateway_and_httproute b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_routing
similarity index 100%
rename from test/fuzz/testdata/FuzzGatewayAPIToXDS/gateway_and_httproute
rename to test/fuzz/testdata/FuzzGatewayAPIToXDS/http_routing
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_timeout b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_timeout
new file mode 100644
index 000000000..8c1d02860
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_timeout
@@ -0,0 +1,25 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+spec:
+  hostnames:
+  - timeout.example.com
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /
+    timeouts:
+      request: "2s"
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_traffic_splitting b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_traffic_splitting
new file mode 100644
index 000000000..ba6c4c4a3
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_traffic_splitting
@@ -0,0 +1,53 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backend-2
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend-2
+  labels:
+    app: backend-2
+    service: backend-2
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+  selector:
+    app: backend-2
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-2
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend-2
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend-2
+        version: v1
+    spec:
+      serviceAccountName: backend-2
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: backend-2
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_url_rewrite b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_url_rewrite
new file mode 100644
index 000000000..2005eb752
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/http_url_rewrite
@@ -0,0 +1,36 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-filter-url-regex-rewrite
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - path.regex.rewrite.example
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: "/"
+      filters:
+        - type: ExtensionRef
+          extensionRef:
+            group: gateway.envoyproxy.io
+            kind: HTTPRouteFilter
+            name: regex-path-rewrite
+      backendRefs:
+        - name: backend
+          port: 3000
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: HTTPRouteFilter
+metadata:
+  name: regex-path-rewrite
+spec:
+  urlRewrite:
+    path:
+      type: ReplaceRegexMatch
+      replaceRegexMatch:
+        pattern: '^/service/([^/]+)(/.*)$'
+        substitution: '\2/instance/\1'
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/httproute b/test/fuzz/testdata/FuzzGatewayAPIToXDS/httproute
deleted file mode 100644
index 5fd38114f..000000000
--- a/test/fuzz/testdata/FuzzGatewayAPIToXDS/httproute
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: backend
-  namespace: default
-spec:
-  parentRefs:
-    - name: eg
-  hostnames:
-    - "www.example.com"
-  rules:
-    - backendRefs:
-        - name: providedBackend
-          port: 8000
\ No newline at end of file
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/ip_allowlist b/test/fuzz/testdata/FuzzGatewayAPIToXDS/ip_allowlist
new file mode 100644
index 000000000..0e46a848d
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/ip_allowlist
@@ -0,0 +1,30 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: authorization-client-ip
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: backend
+  authorization:
+    defaultAction: Deny
+    rules:
+    - action: Allow
+      principal:
+        clientCIDRs:
+        - 10.0.1.0/24
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-client-ip-detection
+spec:
+  clientIPDetection:
+    xForwardedFor:
+      numTrustedHops: 1
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: eg
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/jwt_auth b/test/fuzz/testdata/FuzzGatewayAPIToXDS/jwt_auth
new file mode 100644
index 000000000..df3f1030e
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/jwt_auth
@@ -0,0 +1,56 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: jwt-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: foo
+  jwt:
+    providers:
+    - name: example
+      remoteJWKS:
+        backendRefs:
+          - group: gateway.envoyproxy.io
+            kind: Backend
+            name: remote-jwks
+            port: 443
+        backendSettings:
+          retry:
+            numRetries: 3
+            perRetry:
+              backOff:
+                baseInterval: 1s
+                maxInterval: 5s
+            retryOn:
+              triggers: ["5xx", "gateway-error", "reset"]
+        uri: https://foo.bar.com/jwks.json
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+  name: remote-jwks
+spec:
+  endpoints:
+  - fqdn:
+      hostname: foo.bar.com
+      port: 443
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: remote-jwks-btls
+spec:
+  targetRefs:
+  - group: gateway.envoyproxy.io
+    kind: Backend
+    name: remote-jwks
+    sectionName: "443"
+  validation:
+    caCertificateRefs:
+    - name: remote-jwks-server-ca
+      group: ""
+      kind: ConfigMap
+    hostname: foo.bar.com
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/jwt_claim_based_auth b/test/fuzz/testdata/FuzzGatewayAPIToXDS/jwt_claim_based_auth
new file mode 100644
index 000000000..deb74cd4c
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/jwt_claim_based_auth
@@ -0,0 +1,31 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: authorization-jwt-claim
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: backend
+  jwt:
+    providers:
+    - name: example
+      issuer: https://foo.bar.com
+      remoteJWKS:
+        uri: https://raw.githubusercontent.com/envoyproxy/gateway/refs/heads/main/examples/kubernetes/jwt/jwks.json
+  authorization:
+    defaultAction: Deny
+    rules:
+    - name: "allow"
+      action: Allow
+      principal:
+        jwt:
+          provider: example
+          scopes: ["read", "add", "modify"]
+          claims:
+          - name: user.name
+            values: ["John Doe"]
+          - name: user.roles
+            valueType: StringArray
+            values: ["admin"]
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/load_balancing b/test/fuzz/testdata/FuzzGatewayAPIToXDS/load_balancing
new file mode 100644
index 000000000..033edcb5f
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/load_balancing
@@ -0,0 +1,32 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: round-robin-policy
+  namespace: default
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: round-robin-route
+  loadBalancer:
+    type: RoundRobin
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: round-robin-route
+  namespace: default
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - "www.example.com"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /round
+      backendRefs:
+        - name: backend
+          port: 3000
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/local_ratelimit b/test/fuzz/testdata/FuzzGatewayAPIToXDS/local_ratelimit
new file mode 100644
index 000000000..cb310fa98
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/local_ratelimit
@@ -0,0 +1,41 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: policy-httproute
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: http-ratelimit
+  rateLimit:
+    type: Local
+    local:
+      rules:
+      - clientSelectors:
+        - headers:
+          - name: x-user-id
+            value: one
+        limit:
+          requests: 3
+          unit: Hour
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-ratelimit
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - ratelimit.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/mtls_client_to_gateway b/test/fuzz/testdata/FuzzGatewayAPIToXDS/mtls_client_to_gateway
new file mode 100644
index 000000000..0f223a7d3
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/mtls_client_to_gateway
@@ -0,0 +1,17 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-mtls
+  namespace: default
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  tls:
+    clientValidation:
+      caCertificateRefs:
+      - kind: "Secret"
+        group: ""
+        name: "example-ca-cert"
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/mtls_gateway_to_backend b/test/fuzz/testdata/FuzzGatewayAPIToXDS/mtls_gateway_to_backend
new file mode 100644
index 000000000..38463cc75
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/mtls_gateway_to_backend
@@ -0,0 +1,24 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: eg
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: custom-proxy-config
+    namespace: envoy-gateway-system
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  backendTLS:
+    clientCertificateRef:
+      kind: Secret
+      name: example-client-cert
+      namespace: envoy-gateway-system
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/multi_tenancy b/test/fuzz/testdata/FuzzGatewayAPIToXDS/multi_tenancy
new file mode 100644
index 000000000..acef74011
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/multi_tenancy
@@ -0,0 +1,97 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: eg-marketing
+spec:
+  controllerName: gateway.envoyproxy.io/marketing-gatewayclass-controller
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: eg
+  namespace: marketing
+spec:
+  gatewayClassName: eg-marketing
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 8080
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backend
+  namespace: marketing
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: marketing
+  labels:
+    app: backend
+    service: backend
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+  selector:
+    app: backend
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: marketing
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend
+        version: v1
+    spec:
+      serviceAccountName: backend
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: backend
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+  namespace: marketing
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - "www.marketing.example.com"
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backend
+          port: 3000
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/oidc_auth b/test/fuzz/testdata/FuzzGatewayAPIToXDS/oidc_auth
new file mode 100644
index 000000000..8d48cad0e
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/oidc_auth
@@ -0,0 +1,17 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: myapp
+spec:
+  parentRefs:
+  - name: eg
+  hostnames: ["www.example.com"]
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /myapp
+    backendRefs:
+    - name: backend
+      port: 3000
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/proxy_metrics b/test/fuzz/testdata/FuzzGatewayAPIToXDS/proxy_metrics
new file mode 100644
index 000000000..8700ff962
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/proxy_metrics
@@ -0,0 +1,27 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: eg
+  namespace: envoy-gateway-system
+spec:
+  gatewayClassName: eg
+  infrastructure:
+    parametersRef:
+      group: gateway.envoyproxy.io
+      kind: EnvoyProxy
+      name: prometheus
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: prometheus
+  namespace: envoy-gateway-system
+spec:
+  telemetry:
+    metrics:
+      prometheus:
+        disable: true
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/proxy_tracing b/test/fuzz/testdata/FuzzGatewayAPIToXDS/proxy_tracing
new file mode 100644
index 000000000..b9c8baa43
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/proxy_tracing
@@ -0,0 +1,50 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: eg
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: otel
+    namespace: envoy-gateway-system
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: otel
+  namespace: envoy-gateway-system
+spec:
+  telemetry:
+    tracing:
+      # sample 1% of requests
+      samplingRate: 1
+      provider:
+        backendRefs:
+        - name: otel-collector
+          namespace: monitoring
+          port: 4317
+        type: OpenTelemetry
+      customTags:
+        # This is an example of using a literal as a tag value
+        provider:
+          type: Literal
+          literal:
+            value: "otel"
+        "k8s.pod.name":
+          type: Environment
+          environment:
+            name: ENVOY_POD_NAME
+            defaultValue: "-"
+        "k8s.namespace.name":
+          type: Environment
+          environment:
+            name: ENVOY_GATEWAY_NAMESPACE
+            defaultValue: "envoy-gateway-system"
+        # This is an example of using a header value as a tag value
+        header1:
+          type: RequestHeader
+          requestHeader:
+            name: X-Header-1
+            defaultValue: "-"
\ No newline at end of file
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/response_override b/test/fuzz/testdata/FuzzGatewayAPIToXDS/response_override
new file mode 100644
index 000000000..6727e23eb
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/response_override
@@ -0,0 +1,43 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: response-override
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: backend
+  responseOverride:
+    - match:
+        statusCodes:
+          - type: Value
+            value: 404
+      response:
+        contentType: text/plain
+        body:
+          type: Inline
+          inline: "Oops! Your request is not found."
+    - match:
+        statusCodes:
+          - type: Value
+            value: 500
+          - type: Range
+            range:
+              start: 501
+              end: 511
+      response:
+        contentType: application/json
+        body:
+          type: ValueRef
+          valueRef:
+            group: ""
+            kind: ConfigMap
+            name: response-override-config
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: response-override-config
+data:
+  response.body: '{"error": "Internal Server Error"}'
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/retry b/test/fuzz/testdata/FuzzGatewayAPIToXDS/retry
new file mode 100644
index 000000000..b5e1cbfa0
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/retry
@@ -0,0 +1,23 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: retry-for-route
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: backend
+  retry:
+    numRetries: 5
+    perRetry:
+      backOff:
+        baseInterval: 100ms
+        maxInterval: 10s
+      timeout: 250ms
+    retryOn:
+      httpStatusCodes:
+        - 500
+      triggers:
+        - connect-failure
+        - retriable-status-codes
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/secure_gateway b/test/fuzz/testdata/FuzzGatewayAPIToXDS/secure_gateway
new file mode 100644
index 000000000..8d48cad0e
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/secure_gateway
@@ -0,0 +1,17 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: myapp
+spec:
+  parentRefs:
+  - name: eg
+  hostnames: ["www.example.com"]
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /myapp
+    backendRefs:
+    - name: backend
+      port: 3000
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/session_persistence b/test/fuzz/testdata/FuzzGatewayAPIToXDS/session_persistence
new file mode 100644
index 000000000..3da6f0676
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/session_persistence
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: cookie
+spec:
+  parentRefs:
+    - name: eg
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: backend
+          port: 3000
+      sessionPersistence:
+        sessionName: Session-A
+        type: Cookie
+        absoluteTimeout: 10s
+        cookieConfig:
+          lifetimeType: Permanent
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: header
+spec:
+  parentRefs:
+    - name: eg
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: backend
+          port: 3000
+      sessionPersistence:
+        sessionName: Session-A
+        type: Header
+        absoluteTimeout: 10s
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/gateway_and_tcproute b/test/fuzz/testdata/FuzzGatewayAPIToXDS/tcp_routing
similarity index 100%
rename from test/fuzz/testdata/FuzzGatewayAPIToXDS/gateway_and_tcproute
rename to test/fuzz/testdata/FuzzGatewayAPIToXDS/tcp_routing
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/tcproute b/test/fuzz/testdata/FuzzGatewayAPIToXDS/tcproute
deleted file mode 100644
index 1ba7b4590..000000000
--- a/test/fuzz/testdata/FuzzGatewayAPIToXDS/tcproute
+++ /dev/null
@@ -1,13 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1alpha2
-kind: TCPRoute
-metadata:
-  name: backend
-  namespace: default
-spec:
-  parentRefs:
-    - name: eg
-      sectionName: tcp
-  rules:
-    - backendRefs:
-        - name: backend
-          port: 3000
\ No newline at end of file
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/tls_gateway_to_backend b/test/fuzz/testdata/FuzzGatewayAPIToXDS/tls_gateway_to_backend
new file mode 100644
index 000000000..e1e005612
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/tls_gateway_to_backend
@@ -0,0 +1,35 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: backend
+    service: backend
+  name: tls-backend
+  namespace: default
+spec:
+  selector:
+    app: backend
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8443
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: enable-backend-tls
+  namespace: default
+spec:
+  targetRefs:
+  - group: ''
+    kind: Service
+    name: tls-backend
+    sectionName: https
+  validation:
+    caCertificateRefs:
+    - name: example-ca
+      group: ''
+      kind: ConfigMap
+    hostname: www.example.com
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/gateway_and_udproute b/test/fuzz/testdata/FuzzGatewayAPIToXDS/udp_routing
similarity index 100%
rename from test/fuzz/testdata/FuzzGatewayAPIToXDS/gateway_and_udproute
rename to test/fuzz/testdata/FuzzGatewayAPIToXDS/udp_routing
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/udproute b/test/fuzz/testdata/FuzzGatewayAPIToXDS/udproute
deleted file mode 100644
index 9dea136e8..000000000
--- a/test/fuzz/testdata/FuzzGatewayAPIToXDS/udproute
+++ /dev/null
@@ -1,13 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1alpha2
-kind: UDPRoute
-metadata:
-  name: backend
-  namespace: default
-spec:
-  parentRefs:
-    - name: eg
-      sectionName: udp
-  rules:
-    - backendRefs:
-        - name: backend
-          port: 3000
\ No newline at end of file
diff --git a/test/fuzz/testdata/FuzzGatewayAPIToXDS/wasm_extension b/test/fuzz/testdata/FuzzGatewayAPIToXDS/wasm_extension
new file mode 100644
index 000000000..49e588fd4
--- /dev/null
+++ b/test/fuzz/testdata/FuzzGatewayAPIToXDS/wasm_extension
@@ -0,0 +1,18 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyExtensionPolicy
+metadata:
+  name: wasm-test
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: backend
+  wasm:
+  - name: wasm-filter
+    rootID: my_root_id
+    code:
+      type: HTTP
+      http:
+        url: https://raw.githubusercontent.com/envoyproxy/examples/main/wasm-cc/lib/envoy_filter_http_wasm_example.wasm
+        sha256: 79c9f85128bb0177b6511afa85d587224efded376ac0ef76df56595f1e6315c0