Repository: envoyproxy/gateway

Issue:
Update "Customize Filter Order" documentation
The filter names listed there https://gateway.envoyproxy.io/docs/tasks/operations/customize-envoyproxy/#customize-filter-order are outdated, notably Lua is missing for example 
___

> cc [@zhaohuabing](https://github.com/zhaohuabing) do you happen to know why Lua is not present in the default ordering in EG https://gateway.envoyproxy.io/docs/tasks/operations/customize-envoyproxy/#customize-filter-order? I think it should be the same as Wasm or ExtProc rather than no default order
> 
> It's in the API https://gateway.envoyproxy.io/docs/api/extension_types/#envoyfilter . The doc on the EG website is outdated. 

 _Originally posted by @zhaohuabing in [ai-gateway#1469](https://github.com/envoyproxy/ai-gateway/issues/1469#issuecomment-3475882484)_

Hints from issue comments:

Solution patch:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f1b71766b..6edca5c9d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb  # v3.29.5
+      uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee  # v3.29.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@4e94bd11f71e507f7f87df81788dff88d1dacbfb  # v3.29.5
+      uses: github/codeql-action/autobuild@0499de31b99561a6d14a36a5f662c2a54f91beee  # v3.29.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb  # v3.29.5
+      uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee  # v3.29.5
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/license-scan.yml b/.github/workflows/license-scan.yml
index d0bf94982..b43ac588e 100644
--- a/.github/workflows/license-scan.yml
+++ b/.github/workflows/license-scan.yml
@@ -18,7 +18,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - name: Run scanner
-      uses: google/osv-scanner-action/osv-scanner-action@e92b5d07338d4f0ba0981dffed17c48976ca4730  # v2.2.3
+      uses: google/osv-scanner-action/osv-scanner-action@9bb69575e74019c2ad085a1860787043adf47ccb  # v2.2.4
       with:
         scan-args: |-  # See allowed licenses at https://github.com/cncf/foundation/blob/main/policies-guidance/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
           --licenses=Apache-2.0,0BSD,BSD-2-Clause,BSD-2-Clause-FreeBSD,BSD-3-Clause,MIT,MIT-0,ISC,OpenSSL,OpenSSL-standalone,PSF-2.0,Python-2.0,Python-2.0.1,PostgreSQL,SSLeay-standalone,UPL-1.0,X11,Zlib
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 0c28e1509..db05aef01 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -19,7 +19,7 @@ permissions:
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@e92b5d07338d4f0ba0981dffed17c48976ca4730"  # v2.2.3
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9bb69575e74019c2ad085a1860787043adf47ccb"  # v2.2.4
     with:
       scan-args: |-
         --recursive
@@ -32,7 +32,7 @@ jobs:
 
   scan-pr:
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@e92b5d07338d4f0ba0981dffed17c48976ca4730"  # v2.2.3
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9bb69575e74019c2ad085a1860787043adf47ccb"  # v2.2.4
     with:
       scan-args: |-
         --recursive
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index bc87e003b..edf878bcb 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb  # v3.29.5
+      uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee  # v3.29.5
       with:
         sarif_file: results.sarif
diff --git a/api/v1alpha1/envoyproxy_types.go b/api/v1alpha1/envoyproxy_types.go
index 4b8645a98..0db874ef3 100644
--- a/api/v1alpha1/envoyproxy_types.go
+++ b/api/v1alpha1/envoyproxy_types.go
@@ -106,6 +106,8 @@ type EnvoyProxySpec struct {
 	//
 	// - envoy.filters.http.ext_authz
 	//
+	// - envoy.filters.http.api_key_auth
+	//
 	// - envoy.filters.http.basic_auth
 	//
 	// - envoy.filters.http.oauth2
@@ -114,6 +116,8 @@ type EnvoyProxySpec struct {
 	//
 	// - envoy.filters.http.stateful_session
 	//
+	// - envoy.filters.http.buffer
+	//
 	// - envoy.filters.http.lua
 	//
 	// - envoy.filters.http.ext_proc
@@ -126,8 +130,16 @@ type EnvoyProxySpec struct {
 	//
 	// - envoy.filters.http.ratelimit
 	//
+	// - envoy.filters.http.grpc_web
+	//
+	// - envoy.filters.http.grpc_stats
+	//
 	// - envoy.filters.http.custom_response
 	//
+	// - envoy.filters.http.credential_injector
+	//
+	// - envoy.filters.http.compressor
+	//
 	// - envoy.filters.http.router
 	//
 	// Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
@@ -222,7 +234,7 @@ type FilterPosition struct {
 }
 
 // EnvoyFilter defines the type of Envoy HTTP filter.
-// +kubebuilder:validation:Enum=envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.custom_response;envoy.filters.http.compressor
+// +kubebuilder:validation:Enum=envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.buffer;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.grpc_web;envoy.filters.http.grpc_stats;envoy.filters.http.custom_response;envoy.filters.http.credential_injector;envoy.filters.http.compressor
 type EnvoyFilter string
 
 const (
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 40a504d7e..c75d4d6f6 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -292,6 +292,8 @@ spec:
 
                   - envoy.filters.http.ext_authz
 
+                  - envoy.filters.http.api_key_auth
+
                   - envoy.filters.http.basic_auth
 
                   - envoy.filters.http.oauth2
@@ -300,6 +302,8 @@ spec:
 
                   - envoy.filters.http.stateful_session
 
+                  - envoy.filters.http.buffer
+
                   - envoy.filters.http.lua
 
                   - envoy.filters.http.ext_proc
@@ -312,8 +316,16 @@ spec:
 
                   - envoy.filters.http.ratelimit
 
+                  - envoy.filters.http.grpc_web
+
+                  - envoy.filters.http.grpc_stats
+
                   - envoy.filters.http.custom_response
 
+                  - envoy.filters.http.credential_injector
+
+                  - envoy.filters.http.compressor
+
                   - envoy.filters.http.router
 
                   Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
@@ -335,13 +347,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                     before:
@@ -358,13 +374,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                     name:
@@ -379,13 +399,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                   required:
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 02f18ac84..2d329615a 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -291,6 +291,8 @@ spec:
 
                   - envoy.filters.http.ext_authz
 
+                  - envoy.filters.http.api_key_auth
+
                   - envoy.filters.http.basic_auth
 
                   - envoy.filters.http.oauth2
@@ -299,6 +301,8 @@ spec:
 
                   - envoy.filters.http.stateful_session
 
+                  - envoy.filters.http.buffer
+
                   - envoy.filters.http.lua
 
                   - envoy.filters.http.ext_proc
@@ -311,8 +315,16 @@ spec:
 
                   - envoy.filters.http.ratelimit
 
+                  - envoy.filters.http.grpc_web
+
+                  - envoy.filters.http.grpc_stats
+
                   - envoy.filters.http.custom_response
 
+                  - envoy.filters.http.credential_injector
+
+                  - envoy.filters.http.compressor
+
                   - envoy.filters.http.router
 
                   Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
@@ -334,13 +346,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                     before:
@@ -357,13 +373,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                     name:
@@ -378,13 +398,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                   required:
diff --git a/internal/envoygateway/config/loader/configloader.go b/internal/envoygateway/config/loader/configloader.go
index 8bd284262..e32a1a27e 100644
--- a/internal/envoygateway/config/loader/configloader.go
+++ b/internal/envoygateway/config/loader/configloader.go
@@ -10,6 +10,7 @@ import (
 	"io"
 	"time"
 
+	"github.com/envoyproxy/gateway/api/v1alpha1/validation"
 	"github.com/envoyproxy/gateway/internal/envoygateway/config"
 	"github.com/envoyproxy/gateway/internal/filewatcher"
 	"github.com/envoyproxy/gateway/internal/logging"
@@ -67,6 +68,12 @@ func (r *Loader) Start(ctx context.Context, logOut io.Writer) error {
 					// TODO: add a metric for this?
 					continue
 				}
+
+				if err := validation.ValidateEnvoyGateway(eg); err != nil {
+					r.logger.Error(err, "failed to validate EnvoyGateway config")
+					continue
+				}
+
 				// Set defaults for unset fields
 				eg.SetEnvoyGatewayDefaults()
 				r.cfg.EnvoyGateway = eg
diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go
index 1577c8461..925683b20 100644
--- a/internal/gatewayapi/clienttrafficpolicy.go
+++ b/internal/gatewayapi/clienttrafficpolicy.go
@@ -449,9 +449,11 @@ func (t *Translator) translateClientTrafficPolicyForListener(policy *egv1a1.Clie
 		}
 
 		// Translate HTTP2 Settings
-		if err = translateHTTP2Settings(policy.Spec.HTTP2, httpIR); err != nil {
+		if h2, err := buildIRHTTP2Settings(policy.Spec.HTTP2); err != nil {
 			err = perr.WithMessage(err, "HTTP2")
 			errs = errors.Join(errs, err)
+		} else {
+			httpIR.HTTP2 = h2
 		}
 
 		// enable http3 if set and TLS is enabled
@@ -745,52 +747,6 @@ func translateHTTP1Settings(http1Settings *egv1a1.HTTP1Settings, connection *ir.
 	return nil
 }
 
-func translateHTTP2Settings(http2Settings *egv1a1.HTTP2Settings, httpIR *ir.HTTPListener) error {
-	if http2Settings == nil {
-		return nil
-	}
-
-	var (
-		http2 = &ir.HTTP2Settings{}
-		errs  error
-	)
-
-	if http2Settings.InitialStreamWindowSize != nil {
-		initialStreamWindowSize, ok := http2Settings.InitialStreamWindowSize.AsInt64()
-		switch {
-		case !ok:
-			errs = errors.Join(errs, fmt.Errorf("invalid InitialStreamWindowSize value %s", http2Settings.InitialStreamWindowSize.String()))
-		case initialStreamWindowSize < MinHTTP2InitialStreamWindowSize || initialStreamWindowSize > MaxHTTP2InitialStreamWindowSize:
-			errs = errors.Join(errs, fmt.Errorf("InitialStreamWindowSize value %s is out of range, must be between %d and %d",
-				http2Settings.InitialStreamWindowSize.String(),
-				MinHTTP2InitialStreamWindowSize,
-				MaxHTTP2InitialStreamWindowSize))
-		default:
-			http2.InitialStreamWindowSize = ptr.To(uint32(initialStreamWindowSize))
-		}
-	}
-
-	if http2Settings.InitialConnectionWindowSize != nil {
-		initialConnectionWindowSize, ok := http2Settings.InitialConnectionWindowSize.AsInt64()
-		switch {
-		case !ok:
-			errs = errors.Join(errs, fmt.Errorf("invalid InitialConnectionWindowSize value %s", http2Settings.InitialConnectionWindowSize.String()))
-		case initialConnectionWindowSize < MinHTTP2InitialConnectionWindowSize || initialConnectionWindowSize > MaxHTTP2InitialConnectionWindowSize:
-			errs = errors.Join(errs, fmt.Errorf("InitialConnectionWindowSize value %s is out of range, must be between %d and %d",
-				http2Settings.InitialConnectionWindowSize.String(),
-				MinHTTP2InitialConnectionWindowSize,
-				MaxHTTP2InitialConnectionWindowSize))
-		default:
-			http2.InitialConnectionWindowSize = ptr.To(uint32(initialConnectionWindowSize))
-		}
-	}
-
-	http2.MaxConcurrentStreams = http2Settings.MaxConcurrentStreams
-
-	httpIR.HTTP2 = http2
-	return errs
-}
-
 func translateHealthCheckSettings(healthCheckSettings *egv1a1.HealthCheckSettings, httpIR *ir.HTTPListener) {
 	// Return early if not set
 	if healthCheckSettings == nil {
diff --git a/internal/ir/infra.go b/internal/ir/infra.go
index 8c765fe1f..f6dd5f428 100644
--- a/internal/ir/infra.go
+++ b/internal/ir/infra.go
@@ -17,7 +17,8 @@ import (
 )
 
 const (
-	DefaultProxyName = "default"
+	DefaultProxyName       = "default"
+	MaxPort          int32 = 65535
 )
 
 // Infra defines managed infrastructure.
@@ -224,10 +225,10 @@ func (p *ProxyInfra) Validate() error {
 				if len(listener.Ports[j].Name) == 0 {
 					errs = append(errs, errors.New("listener name field required"))
 				}
-				if listener.Ports[j].ServicePort < 1 || listener.Ports[j].ServicePort > 65353 {
+				if listener.Ports[j].ServicePort < 1 || listener.Ports[j].ServicePort > MaxPort {
 					errs = append(errs, errors.New("listener service port must be a valid port number"))
 				}
-				if listener.Ports[j].ContainerPort < 1 || listener.Ports[j].ContainerPort > 65353 {
+				if listener.Ports[j].ContainerPort < 1 || listener.Ports[j].ContainerPort > MaxPort {
 					errs = append(errs, errors.New("listener container port must be a valid port number"))
 				}
 			}
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index 3271a4f90..59cf04af4 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -10,7 +10,8 @@ security updates: |
 new features: |
 
 bug fixes: |
-
+ - Fixed Listener port limit typo 65353 -> 65535.
+ - Fixed issue where reloading invalid envoy gateway configuration.
 # Enhancements that improve performance.
 performance improvements: |
 
diff --git a/site/content/en/v1.1/tasks/operations/customize-envoyproxy.md b/site/content/en/v1.1/tasks/operations/customize-envoyproxy.md
index 892c3496f..c5cee9725 100644
--- a/site/content/en/v1.1/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/v1.1/tasks/operations/customize-envoyproxy.md
@@ -512,7 +512,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   bootstrap:
     type: Replace
@@ -702,7 +702,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -730,7 +730,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -766,10 +766,10 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   extraArgs:
-    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
+    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm
 EOF
 ```
 
@@ -783,10 +783,10 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   extraArgs:
-    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
+    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm
 ```
 
 {{% /tab %}}
@@ -809,7 +809,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: eg
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -941,7 +941,7 @@ By default, Envoy Gateway applies the following filters in the order shown:
 * envoy.filters.http.fault
 * envoy.filters.http.cors
 * envoy.filters.http.ext_authz
-* envoy.filters.http.basic_authn
+* envoy.filters.http.basic_auth
 * envoy.filters.http.oauth2
 * envoy.filters.http.jwt_authn
 * envoy.filters.http.ext_proc
@@ -951,7 +951,7 @@ By default, Envoy Gateway applies the following filters in the order shown:
 * envoy.filters.http.ratelimit
 * envoy.filters.http.router
 
-The default order in which these filters are applied is opinionated and may not suit all use cases. 
+The default order in which these filters are applied is opinionated and may not suit all use cases.
 To address this, Envoy Gateway allows you to adjust the execution order of these filters with the `filterOrder` field in the [EnvoyProxy][] resource.
 
 `filterOrder` is a list of customized filter order configurations. Each configuration can specify a filter
@@ -960,7 +960,7 @@ If a filter occurs in multiple configurations, the final order is the result of
 To avoid conflicts, it is recommended to only specify one configuration per filter.
 
 For example, the following configuration moves the `envoy.filters.http.wasm` filter before the `envoy.filters.http.jwt_authn`
-filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_authn` filter:
+filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_auth` filter:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
@@ -977,7 +977,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 EOF
 ```
 
@@ -997,7 +997,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 ```
 
 {{% /tab %}}
diff --git a/site/content/en/v1.2/tasks/operations/customize-envoyproxy.md b/site/content/en/v1.2/tasks/operations/customize-envoyproxy.md
index 9c5ab5fe1..262e872b0 100644
--- a/site/content/en/v1.2/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/v1.2/tasks/operations/customize-envoyproxy.md
@@ -513,7 +513,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   bootstrap:
     type: Replace
@@ -688,7 +688,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   bootstrap:
     type: JSONPatch
@@ -742,7 +742,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -770,7 +770,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -806,10 +806,10 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   extraArgs:
-    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
+    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm
 EOF
 ```
 
@@ -823,10 +823,10 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   extraArgs:
-    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
+    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm
 ```
 
 {{% /tab %}}
@@ -849,7 +849,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: eg
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -981,7 +981,7 @@ By default, Envoy Gateway applies the following filters in the order shown:
 * envoy.filters.http.fault
 * envoy.filters.http.cors
 * envoy.filters.http.ext_authz
-* envoy.filters.http.basic_authn
+* envoy.filters.http.basic_auth
 * envoy.filters.http.oauth2
 * envoy.filters.http.jwt_authn
 * envoy.filters.http.ext_proc
@@ -991,7 +991,7 @@ By default, Envoy Gateway applies the following filters in the order shown:
 * envoy.filters.http.ratelimit
 * envoy.filters.http.router
 
-The default order in which these filters are applied is opinionated and may not suit all use cases. 
+The default order in which these filters are applied is opinionated and may not suit all use cases.
 To address this, Envoy Gateway allows you to adjust the execution order of these filters with the `filterOrder` field in the [EnvoyProxy][] resource.
 
 `filterOrder` is a list of customized filter order configurations. Each configuration can specify a filter
@@ -1000,7 +1000,7 @@ If a filter occurs in multiple configurations, the final order is the result of
 To avoid conflicts, it is recommended to only specify one configuration per filter.
 
 For example, the following configuration moves the `envoy.filters.http.wasm` filter before the `envoy.filters.http.jwt_authn`
-filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_authn` filter:
+filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_auth` filter:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
@@ -1017,7 +1017,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 EOF
 ```
 
@@ -1037,7 +1037,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 ```
 
 {{% /tab %}}
@@ -1092,4 +1092,4 @@ After applying the config, the EnvoyProxy deployment will be configured to use t
 
 [Gateway API documentation]: https://gateway-api.sigs.k8s.io/
 [EnvoyProxy]: ../../../api/extension_types#envoyproxy
-[egctl x translate]: ../operations/egctl#egctl-experimental-translate
\ No newline at end of file
+[egctl x translate]: ../operations/egctl#egctl-experimental-translate
diff --git a/site/content/en/v1.3/tasks/operations/customize-envoyproxy.md b/site/content/en/v1.3/tasks/operations/customize-envoyproxy.md
index 9c5ab5fe1..262e872b0 100644
--- a/site/content/en/v1.3/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/v1.3/tasks/operations/customize-envoyproxy.md
@@ -513,7 +513,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   bootstrap:
     type: Replace
@@ -688,7 +688,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   bootstrap:
     type: JSONPatch
@@ -742,7 +742,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -770,7 +770,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -806,10 +806,10 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   extraArgs:
-    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
+    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm
 EOF
 ```
 
@@ -823,10 +823,10 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   extraArgs:
-    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
+    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm
 ```
 
 {{% /tab %}}
@@ -849,7 +849,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: eg
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -981,7 +981,7 @@ By default, Envoy Gateway applies the following filters in the order shown:
 * envoy.filters.http.fault
 * envoy.filters.http.cors
 * envoy.filters.http.ext_authz
-* envoy.filters.http.basic_authn
+* envoy.filters.http.basic_auth
 * envoy.filters.http.oauth2
 * envoy.filters.http.jwt_authn
 * envoy.filters.http.ext_proc
@@ -991,7 +991,7 @@ By default, Envoy Gateway applies the following filters in the order shown:
 * envoy.filters.http.ratelimit
 * envoy.filters.http.router
 
-The default order in which these filters are applied is opinionated and may not suit all use cases. 
+The default order in which these filters are applied is opinionated and may not suit all use cases.
 To address this, Envoy Gateway allows you to adjust the execution order of these filters with the `filterOrder` field in the [EnvoyProxy][] resource.
 
 `filterOrder` is a list of customized filter order configurations. Each configuration can specify a filter
@@ -1000,7 +1000,7 @@ If a filter occurs in multiple configurations, the final order is the result of
 To avoid conflicts, it is recommended to only specify one configuration per filter.
 
 For example, the following configuration moves the `envoy.filters.http.wasm` filter before the `envoy.filters.http.jwt_authn`
-filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_authn` filter:
+filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_auth` filter:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
@@ -1017,7 +1017,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 EOF
 ```
 
@@ -1037,7 +1037,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 ```
 
 {{% /tab %}}
@@ -1092,4 +1092,4 @@ After applying the config, the EnvoyProxy deployment will be configured to use t
 
 [Gateway API documentation]: https://gateway-api.sigs.k8s.io/
 [EnvoyProxy]: ../../../api/extension_types#envoyproxy
-[egctl x translate]: ../operations/egctl#egctl-experimental-translate
\ No newline at end of file
+[egctl x translate]: ../operations/egctl#egctl-experimental-translate
diff --git a/site/content/en/v1.4/tasks/operations/customize-envoyproxy.md b/site/content/en/v1.4/tasks/operations/customize-envoyproxy.md
index 561d1d9a4..fd4a1b6d1 100644
--- a/site/content/en/v1.4/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/v1.4/tasks/operations/customize-envoyproxy.md
@@ -513,7 +513,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   bootstrap:
     type: Replace
@@ -733,7 +733,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   bootstrap:
     type: JSONPatch
@@ -787,7 +787,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -815,7 +815,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -851,10 +851,10 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   extraArgs:
-    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
+    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm
 EOF
 ```
 
@@ -868,10 +868,10 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: custom-proxy-config
-  namespace: default 
+  namespace: default
 spec:
   extraArgs:
-    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
+    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm
 ```
 
 {{% /tab %}}
@@ -894,7 +894,7 @@ apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: EnvoyProxy
 metadata:
   name: eg
-  namespace: default 
+  namespace: default
 spec:
   provider:
     type: Kubernetes
@@ -1026,7 +1026,7 @@ By default, Envoy Gateway applies the following filters in the order shown:
 * envoy.filters.http.fault
 * envoy.filters.http.cors
 * envoy.filters.http.ext_authz
-* envoy.filters.http.basic_authn
+* envoy.filters.http.basic_auth
 * envoy.filters.http.oauth2
 * envoy.filters.http.jwt_authn
 * envoy.filters.http.ext_proc
@@ -1036,7 +1036,7 @@ By default, Envoy Gateway applies the following filters in the order shown:
 * envoy.filters.http.ratelimit
 * envoy.filters.http.router
 
-The default order in which these filters are applied is opinionated and may not suit all use cases. 
+The default order in which these filters are applied is opinionated and may not suit all use cases.
 To address this, Envoy Gateway allows you to adjust the execution order of these filters with the `filterOrder` field in the [EnvoyProxy][] resource.
 
 `filterOrder` is a list of customized filter order configurations. Each configuration can specify a filter
@@ -1045,7 +1045,7 @@ If a filter occurs in multiple configurations, the final order is the result of
 To avoid conflicts, it is recommended to only specify one configuration per filter.
 
 For example, the following configuration moves the `envoy.filters.http.wasm` filter before the `envoy.filters.http.jwt_authn`
-filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_authn` filter:
+filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_auth` filter:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
@@ -1062,7 +1062,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 EOF
 ```
 
@@ -1082,7 +1082,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 ```
 
 {{% /tab %}}
@@ -1137,4 +1137,4 @@ After applying the config, the EnvoyProxy deployment will be configured to use t
 
 [Gateway API documentation]: https://gateway-api.sigs.k8s.io/
 [EnvoyProxy]: ../../../api/extension_types#envoyproxy
-[egctl x translate]: ../operations/egctl#egctl-experimental-translate
\ No newline at end of file
+[egctl x translate]: ../operations/egctl#egctl-experimental-translate
diff --git a/site/content/en/v1.5/tasks/operations/customize-envoyproxy.md b/site/content/en/v1.5/tasks/operations/customize-envoyproxy.md
index 3b094d3dd..e13bfa63c 100644
--- a/site/content/en/v1.5/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/v1.5/tasks/operations/customize-envoyproxy.md
@@ -1028,7 +1028,7 @@ By default, Envoy Gateway applies the following filters in the order shown:
 * envoy.filters.http.fault
 * envoy.filters.http.cors
 * envoy.filters.http.ext_authz
-* envoy.filters.http.basic_authn
+* envoy.filters.http.basic_auth
 * envoy.filters.http.oauth2
 * envoy.filters.http.jwt_authn
 * envoy.filters.http.ext_proc
@@ -1047,7 +1047,7 @@ If a filter occurs in multiple configurations, the final order is the result of
 To avoid conflicts, it is recommended to only specify one configuration per filter.
 
 For example, the following configuration moves the `envoy.filters.http.wasm` filter before the `envoy.filters.http.jwt_authn`
-filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_authn` filter:
+filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_auth` filter:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
@@ -1064,7 +1064,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 EOF
 ```
 
@@ -1084,7 +1084,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 ```
 
 {{% /tab %}}
diff --git a/tools/docker/envoy-gateway/Dockerfile b/tools/docker/envoy-gateway/Dockerfile
index e8dc0313b..44c03c9d8 100644
--- a/tools/docker/envoy-gateway/Dockerfile
+++ b/tools/docker/envoy-gateway/Dockerfile
@@ -1,4 +1,4 @@
-FROM busybox@sha256:2f590fc602ce325cbff2ccfc39499014d039546dc400ef8bbf5c6ffb860632e7 AS source
+FROM busybox@sha256:e3652a00a2fabd16ce889f0aa32c38eec347b997e73bd09e69c962ec7f8732ee AS source
 # Create the data directory for eg
 RUN mkdir -p /var/lib/eg && chmod -R 0777 /var/lib/eg
 



Test patch:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http2.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http2.in.yaml
index fd435bbb5..bbb3eb9e5 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http2.in.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http2.in.yaml
@@ -9,6 +9,7 @@ clientTrafficPolicies:
       initialStreamWindowSize: 64Ki
       initialConnectionWindowSize: 32Mi
       maxConcurrentStreams: 200
+      onInvalidMessage: TerminateConnection
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml
index 8ee7f5817..c89f9102c 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml
@@ -9,6 +9,7 @@ clientTrafficPolicies:
       initialConnectionWindowSize: 32Mi
       initialStreamWindowSize: 64Ki
       maxConcurrentStreams: 200
+      onInvalidMessage: TerminateConnection
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
@@ -191,6 +192,7 @@ xdsIR:
         initialConnectionWindowSize: 65536
         initialStreamWindowSize: 33554432
         maxConcurrentStreams: 200
+        resetStreamOnError: false
       isHTTP2: false
       metadata:
         kind: Gateway
@@ -206,8 +208,6 @@ xdsIR:
       externalPort: 8080
       hostnames:
       - www.example.com
-      http2:
-        maxConcurrentStreams: 200
       isHTTP2: false
       metadata:
         kind: Gateway
diff --git a/internal/gatewayapi/testdata/custom-filter-order.in.yaml b/internal/gatewayapi/testdata/custom-filter-order.in.yaml
index 59c44d469..11243797c 100644
--- a/internal/gatewayapi/testdata/custom-filter-order.in.yaml
+++ b/internal/gatewayapi/testdata/custom-filter-order.in.yaml
@@ -17,7 +17,7 @@ envoyProxyForGatewayClass:
       - name: envoy.filters.http.wasm
         before: envoy.filters.http.jwt_authn
       - name: envoy.filters.http.cors
-        after: envoy.filters.http.basic_authn
+        after: envoy.filters.http.basic_auth
 gateways:
   - apiVersion: gateway.networking.k8s.io/v1
     kind: Gateway
diff --git a/internal/gatewayapi/testdata/custom-filter-order.out.yaml b/internal/gatewayapi/testdata/custom-filter-order.out.yaml
index f05f383f7..7c3df25ab 100644
--- a/internal/gatewayapi/testdata/custom-filter-order.out.yaml
+++ b/internal/gatewayapi/testdata/custom-filter-order.out.yaml
@@ -135,7 +135,7 @@ infraIR:
           filterOrder:
           - before: envoy.filters.http.jwt_authn
             name: envoy.filters.http.wasm
-          - after: envoy.filters.http.basic_authn
+          - after: envoy.filters.http.basic_auth
             name: envoy.filters.http.cors
           logging: {}
         status: {}
@@ -221,7 +221,7 @@ xdsIR:
     filterOrder:
     - before: envoy.filters.http.jwt_authn
       name: envoy.filters.http.wasm
-    - after: envoy.filters.http.basic_authn
+    - after: envoy.filters.http.basic_auth
       name: envoy.filters.http.cors
     globalResources:
       envoyClientCertificate:
diff --git a/internal/xds/translator/testdata/in/xds-ir/custom-filter-order.yaml b/internal/xds/translator/testdata/in/xds-ir/custom-filter-order.yaml
index 7f224f4f1..053feeaf3 100644
--- a/internal/xds/translator/testdata/in/xds-ir/custom-filter-order.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/custom-filter-order.yaml
@@ -1,7 +1,7 @@
 filterOrder:
 - before: envoy.filters.http.jwt_authn
   name: envoy.filters.http.wasm
-- after: envoy.filters.http.basic_authn
+- after: envoy.filters.http.basic_auth
   name: envoy.filters.http.cors
 http:
 - address: 0.0.0.0
diff --git a/internal/xds/translator/testdata/out/xds-ir/custom-filter-order.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/custom-filter-order.listeners.yaml
index 14804eca7..9d4df0182 100644
--- a/internal/xds/translator/testdata/out/xds-ir/custom-filter-order.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/custom-filter-order.listeners.yaml
@@ -14,15 +14,15 @@
           initialStreamWindowSize: 65536
           maxConcurrentStreams: 100
         httpFilters:
-        - name: envoy.filters.http.cors
-          typedConfig:
-            '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
         - disabled: true
           name: envoy.filters.http.basic_auth/securitypolicy/envoy-gateway/policy-for-gateway
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
             users:
               inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
+        - name: envoy.filters.http.cors
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
         - disabled: true
           name: envoy.filters.http.wasm/envoyextensionpolicy/envoy-gateway/policy-for-gateway/0
           typedConfig:
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 405b316db..7ab4e62ee 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -1755,7 +1755,7 @@ _Appears in:_
 | `extraArgs` | _string array_ |  false  |  | ExtraArgs defines additional command line options that are provided to Envoy.<br />More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options<br />Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here. |
 | `mergeGateways` | _boolean_ |  false  |  | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.<br />Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.<br />This means that the port, protocol and hostname tuple must be unique for every listener.<br />If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition. |
 | `shutdown` | _[ShutdownConfig](#shutdownconfig)_ |  false  |  | Shutdown defines configuration for graceful envoy shutdown process. |
-| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  |  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br />- envoy.filters.http.health_check<br />- envoy.filters.http.fault<br />- envoy.filters.http.cors<br />- envoy.filters.http.ext_authz<br />- envoy.filters.http.basic_auth<br />- envoy.filters.http.oauth2<br />- envoy.filters.http.jwt_authn<br />- envoy.filters.http.stateful_session<br />- envoy.filters.http.lua<br />- envoy.filters.http.ext_proc<br />- envoy.filters.http.wasm<br />- envoy.filters.http.rbac<br />- envoy.filters.http.local_ratelimit<br />- envoy.filters.http.ratelimit<br />- envoy.filters.http.custom_response<br />- envoy.filters.http.router<br />Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. |
+| `filterOrder` | _[FilterPosition](#filterposition) array_ |  false  |  | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br />- envoy.filters.http.health_check<br />- envoy.filters.http.fault<br />- envoy.filters.http.cors<br />- envoy.filters.http.ext_authz<br />- envoy.filters.http.api_key_auth<br />- envoy.filters.http.basic_auth<br />- envoy.filters.http.oauth2<br />- envoy.filters.http.jwt_authn<br />- envoy.filters.http.stateful_session<br />- envoy.filters.http.buffer<br />- envoy.filters.http.lua<br />- envoy.filters.http.ext_proc<br />- envoy.filters.http.wasm<br />- envoy.filters.http.rbac<br />- envoy.filters.http.local_ratelimit<br />- envoy.filters.http.ratelimit<br />- envoy.filters.http.grpc_web<br />- envoy.filters.http.grpc_stats<br />- envoy.filters.http.custom_response<br />- envoy.filters.http.credential_injector<br />- envoy.filters.http.compressor<br />- envoy.filters.http.router<br />Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. |
 | `backendTLS` | _[BackendTLSConfig](#backendtlsconfig)_ |  false  |  | BackendTLS is the TLS configuration for the Envoy proxy to use when connecting to backends.<br />These settings are applied on backends for which TLS policies are specified. |
 | `ipFamily` | _[IPFamily](#ipfamily)_ |  false  |  | IPFamily specifies the IP family for the EnvoyProxy fleet.<br />This setting only affects the Gateway listener port and does not impact<br />other aspects of the Envoy proxy configuration.<br />If not specified, the system will operate as follows:<br />- It defaults to IPv4 only.<br />- IPv6 and dual-stack environments are not supported in this default configuration.<br />Note: To enable IPv6 or dual-stack functionality, explicit configuration is required. |
 | `preserveRouteOrder` | _boolean_ |  false  |  | PreserveRouteOrder determines if the order of matching for HTTPRoutes is determined by Gateway-API<br />specification (https://gateway-api.sigs.k8s.io/reference/1.4/spec/#httprouterule)<br />or preserves the order defined by users in the HTTPRoute's HTTPRouteRule list.<br />Default: False |
diff --git a/site/content/en/latest/tasks/operations/customize-envoyproxy.md b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
index 3b094d3dd..6980aa19f 100644
--- a/site/content/en/latest/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
@@ -1025,17 +1025,27 @@ Under the hood, Envoy Gateway uses a series of [Envoy HTTP filters](https://www.
 to process HTTP requests and responses, and to apply various policies.
 
 By default, Envoy Gateway applies the following filters in the order shown:
+* envoy.filters.http.health_check
 * envoy.filters.http.fault
 * envoy.filters.http.cors
 * envoy.filters.http.ext_authz
-* envoy.filters.http.basic_authn
+* envoy.filters.http.api_key_auth
+* envoy.filters.http.basic_auth
 * envoy.filters.http.oauth2
 * envoy.filters.http.jwt_authn
+* envoy.filters.http.stateful_session
+* envoy.filters.http.buffer
+* envoy.filters.http.lua
 * envoy.filters.http.ext_proc
 * envoy.filters.http.wasm
 * envoy.filters.http.rbac
 * envoy.filters.http.local_ratelimit
 * envoy.filters.http.ratelimit
+* envoy.filters.http.grpc_web
+* envoy.filters.http.grpc_stats
+* envoy.filters.http.custom_response
+* envoy.filters.http.credential_injector
+* envoy.filters.http.compressor
 * envoy.filters.http.router
 
 The default order in which these filters are applied is opinionated and may not suit all use cases.
@@ -1047,7 +1057,7 @@ If a filter occurs in multiple configurations, the final order is the result of
 To avoid conflicts, it is recommended to only specify one configuration per filter.
 
 For example, the following configuration moves the `envoy.filters.http.wasm` filter before the `envoy.filters.http.jwt_authn`
-filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_authn` filter:
+filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_auth` filter:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
@@ -1064,7 +1074,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 EOF
 ```
 
@@ -1084,7 +1094,7 @@ spec:
     - name: envoy.filters.http.wasm
       before: envoy.filters.http.jwt_authn
     - name: envoy.filters.http.cors
-      after: envoy.filters.http.basic_authn
+      after: envoy.filters.http.basic_auth
 ```
 
 {{% /tab %}}
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
index 6602b87b5..854b28329 100644
--- a/test/helm/gateway-crds-helm/all.out.yaml
+++ b/test/helm/gateway-crds-helm/all.out.yaml
@@ -28542,6 +28542,8 @@ spec:
 
                   - envoy.filters.http.ext_authz
 
+                  - envoy.filters.http.api_key_auth
+
                   - envoy.filters.http.basic_auth
 
                   - envoy.filters.http.oauth2
@@ -28550,6 +28552,8 @@ spec:
 
                   - envoy.filters.http.stateful_session
 
+                  - envoy.filters.http.buffer
+
                   - envoy.filters.http.lua
 
                   - envoy.filters.http.ext_proc
@@ -28562,8 +28566,16 @@ spec:
 
                   - envoy.filters.http.ratelimit
 
+                  - envoy.filters.http.grpc_web
+
+                  - envoy.filters.http.grpc_stats
+
                   - envoy.filters.http.custom_response
 
+                  - envoy.filters.http.credential_injector
+
+                  - envoy.filters.http.compressor
+
                   - envoy.filters.http.router
 
                   Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
@@ -28585,13 +28597,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                     before:
@@ -28608,13 +28624,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                     name:
@@ -28629,13 +28649,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                   required:
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
index 377be517e..6f7f5b540 100644
--- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
+++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
@@ -7886,6 +7886,8 @@ spec:
 
                   - envoy.filters.http.ext_authz
 
+                  - envoy.filters.http.api_key_auth
+
                   - envoy.filters.http.basic_auth
 
                   - envoy.filters.http.oauth2
@@ -7894,6 +7896,8 @@ spec:
 
                   - envoy.filters.http.stateful_session
 
+                  - envoy.filters.http.buffer
+
                   - envoy.filters.http.lua
 
                   - envoy.filters.http.ext_proc
@@ -7906,8 +7910,16 @@ spec:
 
                   - envoy.filters.http.ratelimit
 
+                  - envoy.filters.http.grpc_web
+
+                  - envoy.filters.http.grpc_stats
+
                   - envoy.filters.http.custom_response
 
+                  - envoy.filters.http.credential_injector
+
+                  - envoy.filters.http.compressor
+
                   - envoy.filters.http.router
 
                   Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
@@ -7929,13 +7941,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                     before:
@@ -7952,13 +7968,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                     name:
@@ -7973,13 +7993,17 @@ spec:
                       - envoy.filters.http.oauth2
                       - envoy.filters.http.jwt_authn
                       - envoy.filters.http.stateful_session
+                      - envoy.filters.http.buffer
                       - envoy.filters.http.lua
                       - envoy.filters.http.ext_proc
                       - envoy.filters.http.wasm
                       - envoy.filters.http.rbac
                       - envoy.filters.http.local_ratelimit
                       - envoy.filters.http.ratelimit
+                      - envoy.filters.http.grpc_web
+                      - envoy.filters.http.grpc_stats
                       - envoy.filters.http.custom_response
+                      - envoy.filters.http.credential_injector
                       - envoy.filters.http.compressor
                       type: string
                   required: