Repository: envoyproxy/gateway

Issue:
find and enable linter for pre-allocate maps/slices
xref: https://github.com/envoyproxy/gateway/pull/7050


cc @arkodg 

Hints from issue comments:

Solution patch:
diff --git a/.github/workflows/build_and_test.yaml b/.github/workflows/build_and_test.yaml
index 0cf2128d4..4943cf217 100644
--- a/.github/workflows/build_and_test.yaml
+++ b/.github/workflows/build_and_test.yaml
@@ -252,8 +252,6 @@ jobs:
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - uses: ./tools/github-actions/setup-deps
 
-    - name: Setup Graphviz
-      uses: ts-graphviz/setup-graphviz@b1de5da23ed0a6d14e0aeee8ed52fdd87af2363c  # v2.0.2
 
     # Benchmark
     - name: Run Benchmark tests
@@ -266,6 +264,7 @@ jobs:
         BENCHMARK_CPU_LIMITS: 1000m
         BENCHMARK_MEMORY_LIMITS: 2000Mi
         BENCHMARK_REPORT_DIR: benchmark_report
+        BENCHMARK_RENDER_PNG: "false"
       run: make benchmark
 
     - name: Upload Benchmark report
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 02aa90992..9d3640d4e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@f1f6e5f6af878fb37288ce1c627459e94dbf7d01  # v3.29.5
+      uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93  # v3.29.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@f1f6e5f6af878fb37288ce1c627459e94dbf7d01  # v3.29.5
+      uses: github/codeql-action/autobuild@3599b3baa15b485a2e49ef411a7a4bb2452e7f93  # v3.29.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@f1f6e5f6af878fb37288ce1c627459e94dbf7d01  # v3.29.5
+      uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93  # v3.29.5
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d892348fc..1b06e1c85 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -18,8 +18,6 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - uses: ./tools/github-actions/setup-deps
 
-      - name: Setup Graphviz
-        uses: ts-graphviz/setup-graphviz@b1de5da23ed0a6d14e0aeee8ed52fdd87af2363c  # v2.0.2
 
       # Benchmark
       - name: Run Benchmark tests
@@ -33,6 +31,7 @@ jobs:
           BENCHMARK_CPU_LIMITS: 1000m
           BENCHMARK_MEMORY_LIMITS: 2000Mi
           BENCHMARK_REPORT_DIR: benchmark_report
+          BENCHMARK_RENDER_PNG: "false"
         run: make benchmark
 
       - name: Package benchmark report
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 9ec295515..612d88dbd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01  # v3.29.5
+      uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93  # v3.29.5
       with:
         sarif_file: results.sarif
diff --git a/api/v1alpha1/jwt_types.go b/api/v1alpha1/jwt_types.go
index 2666d56d0..823192ad4 100644
--- a/api/v1alpha1/jwt_types.go
+++ b/api/v1alpha1/jwt_types.go
@@ -5,7 +5,9 @@
 
 package v1alpha1
 
-import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
 
 // JWT defines the configuration for JSON Web Token (JWT) authentication.
 type JWT struct {
@@ -108,6 +110,11 @@ type RemoteJWKS struct {
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:MaxLength=253
 	URI string `json:"uri"`
+	// Duration after which the cached JWKS should be expired. If not specified, default cache duration is 5 minutes.
+
+	// +kubebuilder:default="300s"
+	// +optional
+	CacheDuration *gwapiv1.Duration `json:"cacheDuration,omitempty"`
 }
 
 // LocalJWKSType defines the types of values for Local JWKS.
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 866269c9a..9884d1df7 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -6035,6 +6035,11 @@ func (in *RedisTLSSettings) DeepCopy() *RedisTLSSettings {
 func (in *RemoteJWKS) DeepCopyInto(out *RemoteJWKS) {
 	*out = *in
 	in.BackendCluster.DeepCopyInto(&out.BackendCluster)
+	if in.CacheDuration != nil {
+		in, out := &in.CacheDuration, &out.CacheDuration
+		*out = new(v1.Duration)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RemoteJWKS.
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
index 75f89017c..ed62618c3 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -3761,6 +3761,13 @@ spec:
                                       type: object
                                   type: object
                               type: object
+                            cacheDuration:
+                              default: 300s
+                              description: |-
+                                Duration is a string value representing a duration in time. The format is as specified
+                                in GEP-2257, a strict subset of the syntax parsed by Golang time.ParseDuration.
+                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                              type: string
                             uri:
                               description: |-
                                 URI is the HTTPS URI to fetch the JWKS. Envoy's system trust bundle is used to validate the server certificate.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index 5162de0c3..2a5654e44 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -3760,6 +3760,13 @@ spec:
                                       type: object
                                   type: object
                               type: object
+                            cacheDuration:
+                              default: 300s
+                              description: |-
+                                Duration is a string value representing a duration in time. The format is as specified
+                                in GEP-2257, a strict subset of the syntax parsed by Golang time.ParseDuration.
+                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                              type: string
                             uri:
                               description: |-
                                 URI is the HTTPS URI to fetch the JWKS. Envoy's system trust bundle is used to validate the server certificate.
diff --git a/examples/extension-server/go.mod b/examples/extension-server/go.mod
index 3d0bb1a85..0a99b42e2 100644
--- a/examples/extension-server/go.mod
+++ b/examples/extension-server/go.mod
@@ -12,7 +12,6 @@ require (
 	k8s.io/apimachinery v0.33.4
 	sigs.k8s.io/controller-runtime v0.21.0
 	sigs.k8s.io/gateway-api v1.3.1-0.20250527223622-54df0a899c1c
-	sigs.k8s.io/gateway-api-inference-extension v0.5.1
 )
 
 require (
@@ -23,14 +22,22 @@ require (
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v0.21.1 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/onsi/ginkgo/v2 v2.24.0 // indirect
+	github.com/onsi/gomega v1.38.0 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/spf13/cobra v1.10.1 // indirect
@@ -43,7 +50,8 @@ require (
 	golang.org/x/sync v0.16.0 // indirect
 	golang.org/x/sys v0.35.0 // indirect
 	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/tools v0.35.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
+	golang.org/x/tools/go/expect v0.1.1-deprecated // indirect
 	golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 // indirect
@@ -52,9 +60,12 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.33.4 // indirect
 	k8s.io/apiextensions-apiserver v0.33.4 // indirect
+	k8s.io/code-generator v0.33.4 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
-	sigs.k8s.io/controller-tools v0.17.3 // indirect
+	sigs.k8s.io/controller-tools v0.18.0 // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
diff --git a/examples/extension-server/go.sum b/examples/extension-server/go.sum
index b1c8019d4..d1aa29d2e 100644
--- a/examples/extension-server/go.sum
+++ b/examples/extension-server/go.sum
@@ -1,5 +1,8 @@
 cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
 cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
+github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -25,6 +28,12 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic=
+github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
@@ -33,6 +42,8 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
+github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -43,6 +54,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
@@ -51,6 +64,8 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -65,10 +80,10 @@ github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
-github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
-github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
-github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
+github.com/onsi/ginkgo/v2 v2.24.0 h1:obZz8LAnHicNdbBqvG3ytAFx8fgza+i1IDpBVcHT2YE=
+github.com/onsi/ginkgo/v2 v2.24.0/go.mod h1:ppTWQ1dh9KM/F1XgpeRqelR+zHVwV81DGRSDnFxK7Sk=
+github.com/onsi/gomega v1.38.0 h1:c/WX+w8SLAinvuKKQFh77WEucCnPk4j2OTUr7lt7BeY=
+github.com/onsi/gomega v1.38.0/go.mod h1:OcXcwId0b9QsE7Y49u+BTrL4IdKOBOKnD6VQNTJEB6o=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -149,10 +164,10 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
-golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
-golang.org/x/tools/go/expect v0.1.0-deprecated h1:jY2C5HGYR5lqex3gEniOQL0r7Dq5+VGVgY1nudX5lXY=
-golang.org/x/tools/go/expect v0.1.0-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -187,18 +202,22 @@ k8s.io/apiextensions-apiserver v0.33.4 h1:rtq5SeXiDbXmSwxsF0MLe2Mtv3SwprA6wp+5qh
 k8s.io/apiextensions-apiserver v0.33.4/go.mod h1:mWXcZQkQV1GQyxeIjYApuqsn/081hhXPZwZ2URuJeSs=
 k8s.io/apimachinery v0.33.4 h1:SOf/JW33TP0eppJMkIgQ+L6atlDiP/090oaX0y9pd9s=
 k8s.io/apimachinery v0.33.4/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/code-generator v0.33.4 h1:DiA801QxqApRIBh3OWULasVAUA237XnYvFNMh+E34Y8=
+k8s.io/code-generator v0.33.4/go.mod h1:ifWxKWhEl/Z1K7WmWAyOBEf3ex/i546ingCzLC8YVIY=
+k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 h1:2OX19X59HxDprNCVrWi6jb7LW1PoqTlYqEq5H2oetog=
+k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
+k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
 sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
-sigs.k8s.io/controller-tools v0.17.3 h1:lwFPLicpBKLgIepah+c8ikRBubFW5kOQyT88r3EwfNw=
-sigs.k8s.io/controller-tools v0.17.3/go.mod h1:1ii+oXcYZkxcBXzwv3YZBlzjt1fvkrCGjVF73blosJI=
+sigs.k8s.io/controller-tools v0.18.0 h1:rGxGZCZTV2wJreeRgqVoWab/mfcumTMmSwKzoM9xrsE=
+sigs.k8s.io/controller-tools v0.18.0/go.mod h1:gLKoiGBriyNh+x1rWtUQnakUYEujErjXs9pf+x/8n1U=
 sigs.k8s.io/gateway-api v1.3.1-0.20250527223622-54df0a899c1c h1:GS4VnGRV90GEUjrgQ2GT5ii6yzWj3KtgUg+sVMdhs5c=
 sigs.k8s.io/gateway-api v1.3.1-0.20250527223622-54df0a899c1c/go.mod h1:d8NV8nJbaRbEKem+5IuxkL8gJGOZ+FJ+NvOIltV8gDk=
-sigs.k8s.io/gateway-api-inference-extension v0.5.1 h1:OMpt4gKlPWkD+h5kHcZZVh4926kix2DSBPI7X5ntuCA=
-sigs.k8s.io/gateway-api-inference-extension v0.5.1/go.mod h1:lki0jx1qysZSZT4Ai2BxuAcpx6G8g5oBgOGuuJzjy/k=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
diff --git a/examples/kubernetes/jwt/jwt.yaml b/examples/kubernetes/jwt/jwt.yaml
index 46381b13a..a5ba7f4c1 100644
--- a/examples/kubernetes/jwt/jwt.yaml
+++ b/examples/kubernetes/jwt/jwt.yaml
@@ -12,6 +12,7 @@ spec:
     - name: example
       remoteJWKS:
         uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/jwks.json
+        cacheDuration: 60s
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
diff --git a/internal/gatewayapi/backend.go b/internal/gatewayapi/backend.go
index d1772428a..c3c1c8220 100644
--- a/internal/gatewayapi/backend.go
+++ b/internal/gatewayapi/backend.go
@@ -20,7 +20,7 @@ import (
 )
 
 func (t *Translator) ProcessBackends(backends []*egv1a1.Backend, backendTLSPolicies []*gwapiv1a3.BackendTLSPolicy) []*egv1a1.Backend {
-	var res []*egv1a1.Backend
+	res := make([]*egv1a1.Backend, 0, len(backends))
 	for _, backend := range backends {
 		// Ensure Backends are enabled
 		if !t.BackendEnabled {
diff --git a/internal/gatewayapi/backendtlspolicy.go b/internal/gatewayapi/backendtlspolicy.go
index 2d37278e3..45fc18839 100644
--- a/internal/gatewayapi/backendtlspolicy.go
+++ b/internal/gatewayapi/backendtlspolicy.go
@@ -257,7 +257,7 @@ func getBackendTLSPolicy(
 
 func getBackendTLSBundle(backendTLSPolicy *gwapiv1a3.BackendTLSPolicy, resources *resource.Resources) (*ir.TLSUpstreamConfig, error) {
 	// Translate SubjectAltNames from gwapiv1a3 to ir
-	var subjectAltNames []ir.SubjectAltName
+	subjectAltNames := make([]ir.SubjectAltName, 0, len(backendTLSPolicy.Spec.Validation.SubjectAltNames))
 	for _, san := range backendTLSPolicy.Spec.Validation.SubjectAltNames {
 		var subjectAltName ir.SubjectAltName
 		switch san.Type {
diff --git a/internal/gatewayapi/envoyextensionpolicy.go b/internal/gatewayapi/envoyextensionpolicy.go
index 607e09b97..ca52cff72 100644
--- a/internal/gatewayapi/envoyextensionpolicy.go
+++ b/internal/gatewayapi/envoyextensionpolicy.go
@@ -51,13 +51,13 @@ func (t *Translator) ProcessEnvoyExtensionPolicies(envoyExtensionPolicies []*egv
 			Name:      route.GetName(),
 			Namespace: route.GetNamespace(),
 		}
-		routeMap[key] = &policyRouteTargetContext{RouteContext: route, attachedToRouteRules: make(sets.Set[string])}
+		routeMap[key] = &policyRouteTargetContext{RouteContext: route}
 	}
 
 	gatewayMap := map[types.NamespacedName]*policyGatewayTargetContext{}
 	for _, gw := range gateways {
 		key := utils.NamespacedName(gw)
-		gatewayMap[key] = &policyGatewayTargetContext{GatewayContext: gw, attachedToListeners: make(sets.Set[string])}
+		gatewayMap[key] = &policyGatewayTargetContext{GatewayContext: gw}
 	}
 
 	// Map of Gateway to the routes attached to it.
@@ -368,7 +368,7 @@ func resolveEEPolicyGatewayTargetRef(
 		gateway.attached = true
 	} else {
 		listenerName := string(*target.SectionName)
-		if gateway.attachedToListeners.Has(listenerName) {
+		if gateway.attachedToListeners != nil && gateway.attachedToListeners.Has(listenerName) {
 			message := fmt.Sprintf("Unable to target Listener %s/%s, another EnvoyExtensionPolicy has already attached to it",
 				string(target.Name), listenerName)
 
@@ -377,6 +377,9 @@ func resolveEEPolicyGatewayTargetRef(
 				Message: message,
 			}
 		}
+		if gateway.attachedToListeners == nil {
+			gateway.attachedToListeners = make(sets.Set[string])
+		}
 		gateway.attachedToListeners.Insert(listenerName)
 	}
 
@@ -424,7 +427,7 @@ func resolveEEPolicyRouteTargetRef(
 		route.attached = true
 	} else {
 		routeRuleName := string(*target.SectionName)
-		if route.attachedToRouteRules.Has(routeRuleName) {
+		if route.attachedToRouteRules != nil && route.attachedToRouteRules.Has(routeRuleName) {
 			message := fmt.Sprintf("Unable to target RouteRule %s/%s, another EnvoyExtensionPolicy has already attached to it",
 				string(target.Name), routeRuleName)
 
@@ -433,6 +436,9 @@ func resolveEEPolicyRouteTargetRef(
 				Message: message,
 			}
 		}
+		if route.attachedToRouteRules == nil {
+			route.attachedToRouteRules = make(sets.Set[string])
+		}
 		route.attachedToRouteRules.Insert(routeRuleName)
 	}
 
@@ -609,12 +615,12 @@ func (t *Translator) translateEnvoyExtensionPolicyForGateway(
 }
 
 func (t *Translator) buildLuas(policy *egv1a1.EnvoyExtensionPolicy, resources *resource.Resources, envoyProxy *egv1a1.EnvoyProxy) ([]ir.Lua, error) {
-	var luaIRList []ir.Lua
-
 	if policy == nil {
 		return nil, nil
 	}
 
+	luaIRList := make([]ir.Lua, 0, len(policy.Spec.Lua))
+
 	for idx, ep := range policy.Spec.Lua {
 		name := irConfigNameForLua(policy, idx)
 		luaIR, err := t.buildLua(name, policy, ep, resources, envoyProxy)
@@ -678,15 +684,16 @@ func getLuaBodyFromLocalObjectReference(valueRef *gwapiv1.LocalObjectReference,
 
 func (t *Translator) buildExtProcs(policy *egv1a1.EnvoyExtensionPolicy, resources *resource.Resources, envoyProxy *egv1a1.EnvoyProxy) ([]ir.ExtProc, error, bool) {
 	var (
-		extProcIRList []ir.ExtProc
-		failOpen      bool
-		errs          error
+		failOpen bool
+		errs     error
 	)
 
 	if policy == nil {
 		return nil, nil, failOpen
 	}
 
+	extProcIRList := make([]ir.ExtProc, 0, len(policy.Spec.ExtProc))
+
 	hasFailClose := false
 	for idx, ep := range policy.Spec.ExtProc {
 		name := irConfigNameForExtProc(policy, idx)
@@ -822,15 +829,16 @@ func (t *Translator) buildWasms(
 	resources *resource.Resources,
 ) ([]ir.Wasm, error, bool) {
 	var (
-		wasmIRList []ir.Wasm
-		failOpen   bool
-		errs       error
+		failOpen bool
+		errs     error
 	)
 
 	if len(policy.Spec.Wasm) == 0 {
-		return wasmIRList, nil, failOpen
+		return nil, nil, failOpen
 	}
 
+	wasmIRList := make([]ir.Wasm, 0, len(policy.Spec.Wasm))
+
 	if t.WasmCache == nil {
 		return nil, fmt.Errorf("wasm cache is not initialized"), failOpen
 	}
diff --git a/internal/gatewayapi/ext_service.go b/internal/gatewayapi/ext_service.go
index 7e56c2f45..82e6f7369 100644
--- a/internal/gatewayapi/ext_service.go
+++ b/internal/gatewayapi/ext_service.go
@@ -34,7 +34,6 @@ func (t *Translator) translateExtServiceBackendRefs(
 ) (*ir.RouteDestination, error) {
 	var (
 		rs  *ir.RouteDestination
-		ds  []*ir.DestinationSetting
 		err error
 	)
 
@@ -42,6 +41,8 @@ func (t *Translator) translateExtServiceBackendRefs(
 		return nil, errors.New("no backendRefs found for external service")
 	}
 
+	ds := make([]*ir.DestinationSetting, 0, len(backendRefs))
+
 	pnn := utils.NamespacedName(policy)
 	destName := irIndexedExtServiceDestinationName(pnn, policy.GetObjectKind().GroupVersionKind().Kind, configType, index)
 	for i, backendRef := range backendRefs {
diff --git a/internal/gatewayapi/filters.go b/internal/gatewayapi/filters.go
index 946225048..722cb8b55 100644
--- a/internal/gatewayapi/filters.go
+++ b/internal/gatewayapi/filters.go
@@ -1033,17 +1033,17 @@ func (t *Translator) processCORSFilter(
 		}
 	}
 
-	var allowMethods []string
+	allowMethods := make([]string, 0, len(corsFilter.AllowMethods))
 	for _, method := range corsFilter.AllowMethods {
 		allowMethods = append(allowMethods, string(method))
 	}
 
-	var allowHeaders []string
+	allowHeaders := make([]string, 0, len(corsFilter.AllowHeaders))
 	for _, header := range corsFilter.AllowHeaders {
 		allowHeaders = append(allowHeaders, string(header))
 	}
 
-	var exposeHeaders []string
+	exposeHeaders := make([]string, 0, len(corsFilter.ExposeHeaders))
 	for _, header := range corsFilter.ExposeHeaders {
 		exposeHeaders = append(exposeHeaders, string(header))
 	}
diff --git a/internal/gatewayapi/helpers.go b/internal/gatewayapi/helpers.go
index 3ff008ece..aa0eeaa87 100644
--- a/internal/gatewayapi/helpers.go
+++ b/internal/gatewayapi/helpers.go
@@ -460,7 +460,7 @@ func IsMergeGatewaysEnabled(resources *resource.Resources) bool {
 }
 
 func protocolSliceToStringSlice(protocols []gwapiv1.ProtocolType) []string {
-	var protocolStrings []string
+	protocolStrings := make([]string, 0, len(protocols))
 	for _, protocol := range protocols {
 		protocolStrings = append(protocolStrings, string(protocol))
 	}
diff --git a/internal/gatewayapi/luavalidator/lua_validator.go b/internal/gatewayapi/luavalidator/lua_validator.go
index 1c103ee17..2410349e0 100644
--- a/internal/gatewayapi/luavalidator/lua_validator.go
+++ b/internal/gatewayapi/luavalidator/lua_validator.go
@@ -24,7 +24,7 @@ const (
 // Refer: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/lua_filter#stream-handle-api
 //
 //go:embed mocks.lua
-var mockData []byte
+var mockData string
 
 // LuaValidator validates user provided Lua for compatibility with Envoy supported Lua HTTP filter
 // Validation strictness is controlled by the validation field
@@ -47,12 +47,12 @@ func (l *LuaValidator) Validate() error {
 		return fmt.Errorf("expected one of %s() or %s() to be defined", envoyOnRequestFunctionName, envoyOnResponseFunctionName)
 	}
 	if strings.Contains(l.code, envoyOnRequestFunctionName) {
-		if err := l.validate(string(mockData) + "\n" + l.code + "\n" + envoyOnRequestFunctionName + "(StreamHandle)"); err != nil {
+		if err := l.validate(mockData + "\n" + l.code + "\n" + envoyOnRequestFunctionName + "(StreamHandle)"); err != nil {
 			return fmt.Errorf("failed to validate with %s: %w", envoyOnRequestFunctionName, err)
 		}
 	}
 	if strings.Contains(l.code, envoyOnResponseFunctionName) {
-		if err := l.validate(string(mockData) + "\n" + l.code + "\n" + envoyOnResponseFunctionName + "(StreamHandle)"); err != nil {
+		if err := l.validate(mockData + "\n" + l.code + "\n" + envoyOnResponseFunctionName + "(StreamHandle)"); err != nil {
 			return fmt.Errorf("failed to validate with %s: %w", envoyOnResponseFunctionName, err)
 		}
 	}
diff --git a/internal/gatewayapi/route.go b/internal/gatewayapi/route.go
index ff837a3e5..3ef0456d0 100644
--- a/internal/gatewayapi/route.go
+++ b/internal/gatewayapi/route.go
@@ -52,7 +52,7 @@ type RoutesTranslator interface {
 }
 
 func (t *Translator) ProcessHTTPRoutes(httpRoutes []*gwapiv1.HTTPRoute, gateways []*GatewayContext, resources *resource.Resources, xdsIR resource.XdsIRMap) []*HTTPRouteContext {
-	var relevantHTTPRoutes []*HTTPRouteContext
+	relevantHTTPRoutes := make([]*HTTPRouteContext, 0, len(httpRoutes))
 
 	// HTTPRoutes are already sorted by the provider layer
 
@@ -79,7 +79,7 @@ func (t *Translator) ProcessHTTPRoutes(httpRoutes []*gwapiv1.HTTPRoute, gateways
 }
 
 func (t *Translator) ProcessGRPCRoutes(grpcRoutes []*gwapiv1.GRPCRoute, gateways []*GatewayContext, resources *resource.Resources, xdsIR resource.XdsIRMap) []*GRPCRouteContext {
-	var relevantGRPCRoutes []*GRPCRouteContext
+	relevantGRPCRoutes := make([]*GRPCRouteContext, 0, len(grpcRoutes))
 
 	// GRPCRoutes are already sorted by the provider layer
 
@@ -387,7 +387,11 @@ func (t *Translator) processHTTPRouteRule(
 	rule *gwapiv1.HTTPRouteRule,
 	routeRuleMetadata *ir.ResourceMetadata,
 ) ([]*ir.HTTPRoute, status.Error) {
-	var ruleRoutes []*ir.HTTPRoute
+	capacity := len(rule.Matches)
+	if capacity == 0 {
+		capacity = 1
+	}
+	ruleRoutes := make([]*ir.HTTPRoute, 0, capacity)
 
 	// If no matches are specified, the implementation MUST match every HTTP request.
 	if len(rule.Matches) == 0 {
@@ -642,7 +646,8 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 	pattern := getStatPattern(grpcRoute, parentRef, t.GatewayControllerName)
 
 	// compute matches, filters, backends
-	for ruleIdx, rule := range grpcRoute.Spec.Rules {
+	for ruleIdx := range grpcRoute.Spec.Rules {
+		rule := &grpcRoute.Spec.Rules[ruleIdx]
 		httpFiltersContext, err := t.ProcessGRPCFilters(parentRef, grpcRoute, rule.Filters, resources)
 		if err != nil {
 			errs.Add(status.NewRouteStatusError(
@@ -654,7 +659,7 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 		// A rule is matched if any one of its matches
 		// is satisfied (i.e. a logical "OR"), so generate
 		// a unique Xds IR HTTPRoute per match.
-		ruleRoutes, err := t.processGRPCRouteRule(grpcRoute, ruleIdx, httpFiltersContext, &rule)
+		ruleRoutes, err := t.processGRPCRouteRule(grpcRoute, ruleIdx, httpFiltersContext, rule)
 		if err != nil {
 			errs.Add(status.NewRouteStatusError(
 				fmt.Errorf("failed to process route rule %d: %w", ruleIdx, err),
@@ -740,7 +745,11 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 }
 
 func (t *Translator) processGRPCRouteRule(grpcRoute *GRPCRouteContext, ruleIdx int, httpFiltersContext *HTTPFiltersContext, rule *gwapiv1.GRPCRouteRule) ([]*ir.HTTPRoute, status.Error) {
-	var ruleRoutes []*ir.HTTPRoute
+	capacity := len(rule.Matches)
+	if capacity == 0 {
+		capacity = 1
+	}
+	ruleRoutes := make([]*ir.HTTPRoute, 0, capacity)
 
 	// If no matches are specified, the implementation MUST match every gRPC request.
 	if len(rule.Matches) == 0 {
@@ -924,7 +933,7 @@ func filterEGPrefix(in map[string]string) map[string]string {
 }
 
 func (t *Translator) ProcessTLSRoutes(tlsRoutes []*gwapiv1a2.TLSRoute, gateways []*GatewayContext, resources *resource.Resources, xdsIR resource.XdsIRMap) []*TLSRouteContext {
-	var relevantTLSRoutes []*TLSRouteContext
+	relevantTLSRoutes := make([]*TLSRouteContext, 0, len(tlsRoutes))
 	// TLSRoutes are already sorted by the provider layer
 
 	for _, tls := range tlsRoutes {
@@ -1069,7 +1078,7 @@ func (t *Translator) processTLSRouteParentRefs(tlsRoute *TLSRouteContext, resour
 func (t *Translator) ProcessUDPRoutes(udpRoutes []*gwapiv1a2.UDPRoute, gateways []*GatewayContext, resources *resource.Resources,
 	xdsIR resource.XdsIRMap,
 ) []*UDPRouteContext {
-	var relevantUDPRoutes []*UDPRouteContext
+	relevantUDPRoutes := make([]*UDPRouteContext, 0, len(udpRoutes))
 	// UDPRoutes are already sorted by the provider layer
 
 	for _, u := range udpRoutes {
@@ -1219,7 +1228,7 @@ func (t *Translator) processUDPRouteParentRefs(udpRoute *UDPRouteContext, resour
 func (t *Translator) ProcessTCPRoutes(tcpRoutes []*gwapiv1a2.TCPRoute, gateways []*GatewayContext, resources *resource.Resources,
 	xdsIR resource.XdsIRMap,
 ) []*TCPRouteContext {
-	var relevantTCPRoutes []*TCPRouteContext
+	relevantTCPRoutes := make([]*TCPRouteContext, 0, len(tcpRoutes))
 	// TCPRoutes are already sorted by the provider layer
 
 	for _, tcp := range tcpRoutes {
@@ -1978,10 +1987,7 @@ func (t *Translator) processBackendDestinationSetting(
 	protocol ir.AppProtocol,
 	resources *resource.Resources,
 ) *ir.DestinationSetting {
-	var (
-		dstEndpoints []*ir.DestinationEndpoint
-		dstAddrType  *ir.DestinationAddressType
-	)
+	var dstAddrType *ir.DestinationAddressType
 
 	addrTypeMap := make(map[ir.DestinationAddressType]int)
 	backend := resources.GetBackend(backendNamespace, string(backendRef.Name))
@@ -1998,6 +2004,8 @@ func (t *Translator) processBackendDestinationSetting(
 		return ds
 	}
 
+	dstEndpoints := make([]*ir.DestinationEndpoint, 0, len(backend.Spec.Endpoints))
+
 	for _, bep := range backend.Spec.Endpoints {
 		var irde *ir.DestinationEndpoint
 		switch {
diff --git a/internal/gatewayapi/runner/runner.go b/internal/gatewayapi/runner/runner.go
index f85fbbee6..2565d6215 100644
--- a/internal/gatewayapi/runner/runner.go
+++ b/internal/gatewayapi/runner/runner.go
@@ -19,7 +19,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/client-go/kubernetes"
 	ctrl "sigs.k8s.io/controller-runtime"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -64,11 +63,15 @@ type Config struct {
 type Runner struct {
 	Config
 	wasmCache wasm.Cache
+
+	// Key tracking for mark and sweep - avoids expensive LoadAll operations
+	keyCache *KeyCache
 }
 
 func New(cfg *Config) *Runner {
 	return &Runner{
-		Config: *cfg,
+		Config:   *cfg,
+		keyCache: newKeyCache(),
 	}
 }
 
@@ -88,6 +91,7 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 	// Do not call .Subscribe() inside Goroutine since it is supposed to be called from the same
 	// Goroutine where Close() is called.
 	c := r.ProviderResources.GatewayAPIResources.Subscribe(ctx)
+
 	go r.subscribeAndTranslate(c)
 	r.Logger.Info("started")
 	return
@@ -130,25 +134,14 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 			r.Logger.Info("received an update")
 			val := update.Value
 			// There is only 1 key which is the controller name
-			// so when a delete is triggered, delete all IR keys
+			// so when a delete is triggered, delete all keys
 			if update.Delete || val == nil {
-				r.deleteAllIRKeys()
-				r.deleteAllStatusKeys()
+				r.deleteAllKeys()
 				return
 			}
 
-			// IR keys for watchable
-			var curIRKeys, newIRKeys []string
-
-			// Get current IR keys
-			for key := range r.InfraIR.LoadAll() {
-				curIRKeys = append(curIRKeys, key)
-			}
-
-			// Get all status keys from watchable and save them in this StatusesToDelete structure.
-			// Iterating through the controller resources, any valid keys will be removed from statusesToDelete.
-			// Remaining keys will be deleted from watchable before we exit this function.
-			statusesToDelete := r.getAllStatuses()
+			// Initialize keysToDelete with tracked keys (mark and sweep approach)
+			keysToDelete := r.keyCache.copy()
 
 			// Aggregate metric counters for batch publishing
 			var infraIRCount, xdsIRCount, gatewayStatusCount, httpRouteStatusCount, grpcRouteStatusCount int
@@ -204,7 +197,9 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 					} else {
 						r.InfraIR.Store(key, val)
 						infraIRCount++
-						newIRKeys = append(newIRKeys, key)
+						// Track IR key for mark and sweep
+						r.keyCache.IR[key] = true
+						delete(keysToDelete.IR, key)
 					}
 				}
 
@@ -227,37 +222,43 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 					key := utils.NamespacedName(gateway)
 					r.ProviderResources.GatewayStatuses.Store(key, &gateway.Status)
 					gatewayStatusCount++
-					delete(statusesToDelete.GatewayStatusKeys, key)
+					delete(keysToDelete.GatewayStatus, key)
+					r.keyCache.GatewayStatus[key] = true
 				}
 				for _, httpRoute := range result.HTTPRoutes {
 					key := utils.NamespacedName(httpRoute)
 					r.ProviderResources.HTTPRouteStatuses.Store(key, &httpRoute.Status)
 					httpRouteStatusCount++
-					delete(statusesToDelete.HTTPRouteStatusKeys, key)
+					delete(keysToDelete.HTTPRouteStatus, key)
+					r.keyCache.HTTPRouteStatus[key] = true
 				}
 				for _, grpcRoute := range result.GRPCRoutes {
 					key := utils.NamespacedName(grpcRoute)
 					r.ProviderResources.GRPCRouteStatuses.Store(key, &grpcRoute.Status)
 					grpcRouteStatusCount++
-					delete(statusesToDelete.GRPCRouteStatusKeys, key)
+					delete(keysToDelete.GRPCRouteStatus, key)
+					r.keyCache.GRPCRouteStatus[key] = true
 				}
 				for _, tlsRoute := range result.TLSRoutes {
 					key := utils.NamespacedName(tlsRoute)
 					r.ProviderResources.TLSRouteStatuses.Store(key, &tlsRoute.Status)
 					tlsRouteStatusCount++
-					delete(statusesToDelete.TLSRouteStatusKeys, key)
+					delete(keysToDelete.TLSRouteStatus, key)
+					r.keyCache.TLSRouteStatus[key] = true
 				}
 				for _, tcpRoute := range result.TCPRoutes {
 					key := utils.NamespacedName(tcpRoute)
 					r.ProviderResources.TCPRouteStatuses.Store(key, &tcpRoute.Status)
 					tcpRouteStatusCount++
-					delete(statusesToDelete.TCPRouteStatusKeys, key)
+					delete(keysToDelete.TCPRouteStatus, key)
+					r.keyCache.TCPRouteStatus[key] = true
 				}
 				for _, udpRoute := range result.UDPRoutes {
 					key := utils.NamespacedName(udpRoute)
 					r.ProviderResources.UDPRouteStatuses.Store(key, &udpRoute.Status)
 					udpRouteStatusCount++
-					delete(statusesToDelete.UDPRouteStatusKeys, key)
+					delete(keysToDelete.UDPRouteStatus, key)
+					r.keyCache.UDPRouteStatus[key] = true
 				}
 
 				// Skip updating status for policies with empty status
@@ -270,7 +271,8 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 						r.ProviderResources.BackendTLSPolicyStatuses.Store(key, &backendTLSPolicy.Status)
 						backendTLSPolicyStatusCount++
 					}
-					delete(statusesToDelete.BackendTLSPolicyStatusKeys, key)
+					delete(keysToDelete.BackendTLSPolicyStatus, key)
+					r.keyCache.BackendTLSPolicyStatus[key] = true
 				}
 
 				for _, clientTrafficPolicy := range result.ClientTrafficPolicies {
@@ -279,7 +281,8 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 						r.ProviderResources.ClientTrafficPolicyStatuses.Store(key, &clientTrafficPolicy.Status)
 						clientTrafficPolicyStatusCount++
 					}
-					delete(statusesToDelete.ClientTrafficPolicyStatusKeys, key)
+					delete(keysToDelete.ClientTrafficPolicyStatus, key)
+					r.keyCache.ClientTrafficPolicyStatus[key] = true
 				}
 				for _, backendTrafficPolicy := range result.BackendTrafficPolicies {
 					key := utils.NamespacedName(backendTrafficPolicy)
@@ -287,7 +290,8 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 						r.ProviderResources.BackendTrafficPolicyStatuses.Store(key, &backendTrafficPolicy.Status)
 						backendTrafficPolicyStatusCount++
 					}
-					delete(statusesToDelete.BackendTrafficPolicyStatusKeys, key)
+					delete(keysToDelete.BackendTrafficPolicyStatus, key)
+					r.keyCache.BackendTrafficPolicyStatus[key] = true
 				}
 				for _, securityPolicy := range result.SecurityPolicies {
 					key := utils.NamespacedName(securityPolicy)
@@ -295,7 +299,8 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 						r.ProviderResources.SecurityPolicyStatuses.Store(key, &securityPolicy.Status)
 						securityPolicyStatusCount++
 					}
-					delete(statusesToDelete.SecurityPolicyStatusKeys, key)
+					delete(keysToDelete.SecurityPolicyStatus, key)
+					r.keyCache.SecurityPolicyStatus[key] = true
 				}
 				for _, envoyExtensionPolicy := range result.EnvoyExtensionPolicies {
 					key := utils.NamespacedName(envoyExtensionPolicy)
@@ -303,7 +308,8 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 						r.ProviderResources.EnvoyExtensionPolicyStatuses.Store(key, &envoyExtensionPolicy.Status)
 						envoyExtensionPolicyStatusCount++
 					}
-					delete(statusesToDelete.EnvoyExtensionPolicyStatusKeys, key)
+					delete(keysToDelete.EnvoyExtensionPolicyStatus, key)
+					r.keyCache.EnvoyExtensionPolicyStatus[key] = true
 				}
 				for _, backend := range result.Backends {
 					key := utils.NamespacedName(backend)
@@ -311,7 +317,8 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 						r.ProviderResources.BackendStatuses.Store(key, &backend.Status)
 						backendStatusCount++
 					}
-					delete(statusesToDelete.BackendStatusKeys, key)
+					delete(keysToDelete.BackendStatus, key)
+					r.keyCache.BackendStatus[key] = true
 				}
 				for _, extServerPolicy := range result.ExtensionServerPolicies {
 					key := message.NamespacedNameAndGVK{
@@ -325,7 +332,8 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 							extensionServerPolicyStatusCount++
 						}
 					}
-					delete(statusesToDelete.ExtensionServerPolicyStatusKeys, key)
+					delete(keysToDelete.ExtensionServerPolicyStatus, key)
+					r.keyCache.ExtensionServerPolicyStatus[key] = true
 				}
 			}
 
@@ -346,16 +354,8 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *re
 			message.PublishMetric(message.Metadata{Runner: r.Name(), Message: message.BackendStatusMessageName}, backendStatusCount)
 			message.PublishMetric(message.Metadata{Runner: r.Name(), Message: message.ExtensionServerPoliciesStatusMessageName}, extensionServerPolicyStatusCount)
 
-			// Delete IR keys
-			// There is a 1:1 mapping between infra and xds IR keys
-			delKeys := getIRKeysToDelete(curIRKeys, newIRKeys)
-			for _, key := range delKeys {
-				r.InfraIR.Delete(key)
-				r.XdsIR.Delete(key)
-			}
-
-			// Delete status keys
-			r.deleteStatusKeys(statusesToDelete)
+			// Delete keys using mark and sweep
+			r.deleteKeys(keysToDelete)
 		},
 	)
 	r.Logger.Info("shutting down")
@@ -401,205 +401,265 @@ func unstructuredToPolicyStatus(policyStatus map[string]any) gwapiv1a2.PolicySta
 	return ret
 }
 
-// deleteAllIRKeys deletes all XdsIR and InfraIR
-func (r *Runner) deleteAllIRKeys() {
-	for key := range r.InfraIR.LoadAll() {
+// deleteAllIRKeys deletes all XdsIR and InfraIR using tracked keys
+func (r *Runner) deleteAllKeys() {
+	// Delete IR keys
+	for key := range r.keyCache.IR {
 		r.InfraIR.Delete(key)
 		r.XdsIR.Delete(key)
 	}
-}
-
-type StatusesToDelete struct {
-	GatewayStatusKeys          map[types.NamespacedName]bool
-	HTTPRouteStatusKeys        map[types.NamespacedName]bool
-	GRPCRouteStatusKeys        map[types.NamespacedName]bool
-	TLSRouteStatusKeys         map[types.NamespacedName]bool
-	TCPRouteStatusKeys         map[types.NamespacedName]bool
-	UDPRouteStatusKeys         map[types.NamespacedName]bool
-	BackendTLSPolicyStatusKeys map[types.NamespacedName]bool
-
-	ClientTrafficPolicyStatusKeys   map[types.NamespacedName]bool
-	BackendTrafficPolicyStatusKeys  map[types.NamespacedName]bool
-	SecurityPolicyStatusKeys        map[types.NamespacedName]bool
-	EnvoyExtensionPolicyStatusKeys  map[types.NamespacedName]bool
-	ExtensionServerPolicyStatusKeys map[message.NamespacedNameAndGVK]bool
-
-	BackendStatusKeys map[types.NamespacedName]bool
-}
 
-func (r *Runner) getAllStatuses() *StatusesToDelete {
-	// Maps storing status keys to be deleted
-	ds := &StatusesToDelete{
-		GatewayStatusKeys:   make(map[types.NamespacedName]bool),
-		HTTPRouteStatusKeys: make(map[types.NamespacedName]bool),
-		GRPCRouteStatusKeys: make(map[types.NamespacedName]bool),
-		TLSRouteStatusKeys:  make(map[types.NamespacedName]bool),
-		TCPRouteStatusKeys:  make(map[types.NamespacedName]bool),
-		UDPRouteStatusKeys:  make(map[types.NamespacedName]bool),
-
-		ClientTrafficPolicyStatusKeys:   make(map[types.NamespacedName]bool),
-		BackendTrafficPolicyStatusKeys:  make(map[types.NamespacedName]bool),
-		SecurityPolicyStatusKeys:        make(map[types.NamespacedName]bool),
-		BackendTLSPolicyStatusKeys:      make(map[types.NamespacedName]bool),
-		EnvoyExtensionPolicyStatusKeys:  make(map[types.NamespacedName]bool),
-		ExtensionServerPolicyStatusKeys: make(map[message.NamespacedNameAndGVK]bool),
-
-		BackendStatusKeys: make(map[types.NamespacedName]bool),
+	// Delete status keys
+	for key := range r.keyCache.GatewayStatus {
+		r.ProviderResources.GatewayStatuses.Delete(key)
 	}
-
-	// Get current status keys
-	for key := range r.ProviderResources.GatewayStatuses.LoadAll() {
-		ds.GatewayStatusKeys[key] = true
+	for key := range r.keyCache.HTTPRouteStatus {
+		r.ProviderResources.HTTPRouteStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.HTTPRouteStatuses.LoadAll() {
-		ds.HTTPRouteStatusKeys[key] = true
+	for key := range r.keyCache.GRPCRouteStatus {
+		r.ProviderResources.GRPCRouteStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.GRPCRouteStatuses.LoadAll() {
-		ds.GRPCRouteStatusKeys[key] = true
+	for key := range r.keyCache.TLSRouteStatus {
+		r.ProviderResources.TLSRouteStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.TLSRouteStatuses.LoadAll() {
-		ds.TLSRouteStatusKeys[key] = true
+	for key := range r.keyCache.TCPRouteStatus {
+		r.ProviderResources.TCPRouteStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.TCPRouteStatuses.LoadAll() {
-		ds.TCPRouteStatusKeys[key] = true
+	for key := range r.keyCache.UDPRouteStatus {
+		r.ProviderResources.UDPRouteStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.UDPRouteStatuses.LoadAll() {
-		ds.UDPRouteStatusKeys[key] = true
+	for key := range r.keyCache.BackendTLSPolicyStatus {
+		r.ProviderResources.BackendTLSPolicyStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.BackendTLSPolicyStatuses.LoadAll() {
-		ds.BackendTLSPolicyStatusKeys[key] = true
+	for key := range r.keyCache.ClientTrafficPolicyStatus {
+		r.ProviderResources.ClientTrafficPolicyStatuses.Delete(key)
 	}
-
-	for key := range r.ProviderResources.ClientTrafficPolicyStatuses.LoadAll() {
-		ds.ClientTrafficPolicyStatusKeys[key] = true
+	for key := range r.keyCache.BackendTrafficPolicyStatus {
+		r.ProviderResources.BackendTrafficPolicyStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.BackendTrafficPolicyStatuses.LoadAll() {
-		ds.BackendTrafficPolicyStatusKeys[key] = true
+	for key := range r.keyCache.SecurityPolicyStatus {
+		r.ProviderResources.SecurityPolicyStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.SecurityPolicyStatuses.LoadAll() {
-		ds.SecurityPolicyStatusKeys[key] = true
+	for key := range r.keyCache.EnvoyExtensionPolicyStatus {
+		r.ProviderResources.EnvoyExtensionPolicyStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.EnvoyExtensionPolicyStatuses.LoadAll() {
-		ds.EnvoyExtensionPolicyStatusKeys[key] = true
+	for key := range r.keyCache.ExtensionServerPolicyStatus {
+		r.ProviderResources.ExtensionPolicyStatuses.Delete(key)
 	}
-	for key := range r.ProviderResources.BackendStatuses.LoadAll() {
-		ds.BackendStatusKeys[key] = true
+	for key := range r.keyCache.BackendStatus {
+		r.ProviderResources.BackendStatuses.Delete(key)
 	}
-	return ds
+
+	// Clear all tracking
+	r.keyCache = newKeyCache()
 }
 
-func (r *Runner) deleteStatusKeys(ds *StatusesToDelete) {
-	for key := range ds.GatewayStatusKeys {
-		r.ProviderResources.GatewayStatuses.Delete(key)
-		delete(ds.GatewayStatusKeys, key)
+type KeyCache struct {
+	// IR keys
+	IR map[string]bool
+
+	// Status keys
+	GatewayStatus          map[types.NamespacedName]bool
+	HTTPRouteStatus        map[types.NamespacedName]bool
+	GRPCRouteStatus        map[types.NamespacedName]bool
+	TLSRouteStatus         map[types.NamespacedName]bool
+	TCPRouteStatus         map[types.NamespacedName]bool
+	UDPRouteStatus         map[types.NamespacedName]bool
+	BackendTLSPolicyStatus map[types.NamespacedName]bool
+
+	ClientTrafficPolicyStatus   map[types.NamespacedName]bool
+	BackendTrafficPolicyStatus  map[types.NamespacedName]bool
+	SecurityPolicyStatus        map[types.NamespacedName]bool
+	EnvoyExtensionPolicyStatus  map[types.NamespacedName]bool
+	ExtensionServerPolicyStatus map[message.NamespacedNameAndGVK]bool
+
+	BackendStatus map[types.NamespacedName]bool
+}
+
+// copy creates a deep copy of the KeyCache for mark-and-sweep deletion
+func (kc *KeyCache) copy() *KeyCache {
+	copied := newKeyCache()
+
+	// Copy IR keys
+	for key := range kc.IR {
+		copied.IR[key] = true
 	}
-	for key := range ds.HTTPRouteStatusKeys {
-		r.ProviderResources.HTTPRouteStatuses.Delete(key)
-		delete(ds.HTTPRouteStatusKeys, key)
+
+	// Copy status keys
+	for key := range kc.GatewayStatus {
+		copied.GatewayStatus[key] = true
 	}
-	for key := range ds.GRPCRouteStatusKeys {
-		r.ProviderResources.GRPCRouteStatuses.Delete(key)
-		delete(ds.GRPCRouteStatusKeys, key)
+	for key := range kc.HTTPRouteStatus {
+		copied.HTTPRouteStatus[key] = true
 	}
-	for key := range ds.TLSRouteStatusKeys {
-		r.ProviderResources.TLSRouteStatuses.Delete(key)
-		delete(ds.TLSRouteStatusKeys, key)
+	for key := range kc.GRPCRouteStatus {
+		copied.GRPCRouteStatus[key] = true
 	}
-	for key := range ds.TCPRouteStatusKeys {
-		r.ProviderResources.TCPRouteStatuses.Delete(key)
-		delete(ds.TCPRouteStatusKeys, key)
+	for key := range kc.TLSRouteStatus {
+		copied.TLSRouteStatus[key] = true
 	}
-	for key := range ds.UDPRouteStatusKeys {
-		r.ProviderResources.UDPRouteStatuses.Delete(key)
-		delete(ds.UDPRouteStatusKeys, key)
+	for key := range kc.TCPRouteStatus {
+		copied.TCPRouteStatus[key] = true
 	}
-
-	for key := range ds.ClientTrafficPolicyStatusKeys {
-		r.ProviderResources.ClientTrafficPolicyStatuses.Delete(key)
-		delete(ds.ClientTrafficPolicyStatusKeys, key)
+	for key := range kc.UDPRouteStatus {
+		copied.UDPRouteStatus[key] = true
 	}
-	for key := range ds.BackendTrafficPolicyStatusKeys {
-		r.ProviderResources.BackendTrafficPolicyStatuses.Delete(key)
-		delete(ds.BackendTrafficPolicyStatusKeys, key)
+	for key := range kc.BackendTLSPolicyStatus {
+		copied.BackendTLSPolicyStatus[key] = true
 	}
-	for key := range ds.SecurityPolicyStatusKeys {
-		r.ProviderResources.SecurityPolicyStatuses.Delete(key)
-		delete(ds.SecurityPolicyStatusKeys, key)
+	for key := range kc.ClientTrafficPolicyStatus {
+		copied.ClientTrafficPolicyStatus[key] = true
 	}
-	for key := range ds.BackendTLSPolicyStatusKeys {
-		r.ProviderResources.BackendTLSPolicyStatuses.Delete(key)
-		delete(ds.BackendTLSPolicyStatusKeys, key)
+	for key := range kc.BackendTrafficPolicyStatus {
+		copied.BackendTrafficPolicyStatus[key] = true
 	}
-	for key := range ds.EnvoyExtensionPolicyStatusKeys {
-		r.ProviderResources.EnvoyExtensionPolicyStatuses.Delete(key)
-		delete(ds.EnvoyExtensionPolicyStatusKeys, key)
+	for key := range kc.SecurityPolicyStatus {
+		copied.SecurityPolicyStatus[key] = true
 	}
-	for key := range ds.ExtensionServerPolicyStatusKeys {
-		r.ProviderResources.ExtensionPolicyStatuses.Delete(key)
-		delete(ds.ExtensionServerPolicyStatusKeys, key)
+	for key := range kc.EnvoyExtensionPolicyStatus {
+		copied.EnvoyExtensionPolicyStatus[key] = true
 	}
-	for key := range ds.BackendStatusKeys {
-		r.ProviderResources.BackendStatuses.Delete(key)
-		delete(ds.BackendStatusKeys, key)
+	for key := range kc.ExtensionServerPolicyStatus {
+		copied.ExtensionServerPolicyStatus[key] = true
+	}
+	for key := range kc.BackendStatus {
+		copied.BackendStatus[key] = true
+	}
+
+	return copied
+}
+
+func newKeyCache() *KeyCache {
+	return &KeyCache{
+		IR:                          make(map[string]bool),
+		GatewayStatus:               make(map[types.NamespacedName]bool),
+		HTTPRouteStatus:             make(map[types.NamespacedName]bool),
+		GRPCRouteStatus:             make(map[types.NamespacedName]bool),
+		TLSRouteStatus:              make(map[types.NamespacedName]bool),
+		TCPRouteStatus:              make(map[types.NamespacedName]bool),
+		UDPRouteStatus:              make(map[types.NamespacedName]bool),
+		BackendTLSPolicyStatus:      make(map[types.NamespacedName]bool),
+		ClientTrafficPolicyStatus:   make(map[types.NamespacedName]bool),
+		BackendTrafficPolicyStatus:  make(map[types.NamespacedName]bool),
+		SecurityPolicyStatus:        make(map[types.NamespacedName]bool),
+		EnvoyExtensionPolicyStatus:  make(map[types.NamespacedName]bool),
+		ExtensionServerPolicyStatus: make(map[message.NamespacedNameAndGVK]bool),
+		BackendStatus:               make(map[types.NamespacedName]bool),
 	}
 }
 
-// deleteAllStatusKeys deletes all status keys stored by the subscriber.
-func (r *Runner) deleteAllStatusKeys() {
-	// Fields of GatewayAPIStatuses
+// populateKeyCache initializes the keyCache with existing keys from watchable stores
+// This is needed for restart scenarios where stores may already contain data
+func (r *Runner) populateKeyCache() {
+	// Populate IR keys
+	for key := range r.InfraIR.LoadAll() {
+		r.keyCache.IR[key] = true
+	}
+
+	// Populate status keys
 	for key := range r.ProviderResources.GatewayStatuses.LoadAll() {
-		r.ProviderResources.GatewayStatuses.Delete(key)
+		r.keyCache.GatewayStatus[key] = true
 	}
 	for key := range r.ProviderResources.HTTPRouteStatuses.LoadAll() {
-		r.ProviderResources.HTTPRouteStatuses.Delete(key)
+		r.keyCache.HTTPRouteStatus[key] = true
 	}
 	for key := range r.ProviderResources.GRPCRouteStatuses.LoadAll() {
-		r.ProviderResources.GRPCRouteStatuses.Delete(key)
+		r.keyCache.GRPCRouteStatus[key] = true
 	}
 	for key := range r.ProviderResources.TLSRouteStatuses.LoadAll() {
-		r.ProviderResources.TLSRouteStatuses.Delete(key)
+		r.keyCache.TLSRouteStatus[key] = true
 	}
 	for key := range r.ProviderResources.TCPRouteStatuses.LoadAll() {
-		r.ProviderResources.TCPRouteStatuses.Delete(key)
+		r.keyCache.TCPRouteStatus[key] = true
 	}
 	for key := range r.ProviderResources.UDPRouteStatuses.LoadAll() {
-		r.ProviderResources.UDPRouteStatuses.Delete(key)
+		r.keyCache.UDPRouteStatus[key] = true
 	}
 	for key := range r.ProviderResources.BackendTLSPolicyStatuses.LoadAll() {
-		r.ProviderResources.BackendTLSPolicyStatuses.Delete(key)
+		r.keyCache.BackendTLSPolicyStatus[key] = true
 	}
-
-	// Fields of PolicyStatuses
 	for key := range r.ProviderResources.ClientTrafficPolicyStatuses.LoadAll() {
-		r.ProviderResources.ClientTrafficPolicyStatuses.Delete(key)
+		r.keyCache.ClientTrafficPolicyStatus[key] = true
 	}
 	for key := range r.ProviderResources.BackendTrafficPolicyStatuses.LoadAll() {
-		r.ProviderResources.BackendTrafficPolicyStatuses.Delete(key)
+		r.keyCache.BackendTrafficPolicyStatus[key] = true
 	}
 	for key := range r.ProviderResources.SecurityPolicyStatuses.LoadAll() {
-		r.ProviderResources.SecurityPolicyStatuses.Delete(key)
+		r.keyCache.SecurityPolicyStatus[key] = true
 	}
 	for key := range r.ProviderResources.EnvoyExtensionPolicyStatuses.LoadAll() {
-		r.ProviderResources.EnvoyExtensionPolicyStatuses.Delete(key)
+		r.keyCache.EnvoyExtensionPolicyStatus[key] = true
 	}
 	for key := range r.ProviderResources.ExtensionPolicyStatuses.LoadAll() {
-		r.ProviderResources.ExtensionPolicyStatuses.Delete(key)
+		r.keyCache.ExtensionServerPolicyStatus[key] = true
 	}
 	for key := range r.ProviderResources.BackendStatuses.LoadAll() {
-		r.ProviderResources.BackendStatuses.Delete(key)
+		r.keyCache.BackendStatus[key] = true
 	}
 }
 
-// getIRKeysToDelete returns the list of IR keys to delete
-// based on the difference between the current keys and the
-// new keys parameters passed to the function.
-func getIRKeysToDelete(curKeys, newKeys []string) []string {
-	curSet := sets.NewString(curKeys...)
-	newSet := sets.NewString(newKeys...)
+func (r *Runner) deleteKeys(kc *KeyCache) {
+	// Delete IR keys
+	for key := range kc.IR {
+		r.InfraIR.Delete(key)
+		r.XdsIR.Delete(key)
+		delete(r.keyCache.IR, key)
+	}
 
-	delSet := curSet.Difference(newSet)
+	// Delete status keys
+	for key := range kc.GatewayStatus {
+		r.ProviderResources.GatewayStatuses.Delete(key)
+		delete(r.keyCache.GatewayStatus, key)
+	}
+	for key := range kc.HTTPRouteStatus {
+		r.ProviderResources.HTTPRouteStatuses.Delete(key)
+		delete(r.keyCache.HTTPRouteStatus, key)
+	}
+	for key := range kc.GRPCRouteStatus {
+		r.ProviderResources.GRPCRouteStatuses.Delete(key)
+		delete(r.keyCache.GRPCRouteStatus, key)
+	}
+	for key := range kc.TLSRouteStatus {
+		r.ProviderResources.TLSRouteStatuses.Delete(key)
+		delete(r.keyCache.TLSRouteStatus, key)
+	}
+	for key := range kc.TCPRouteStatus {
+		r.ProviderResources.TCPRouteStatuses.Delete(key)
+		delete(r.keyCache.TCPRouteStatus, key)
+	}
+	for key := range kc.UDPRouteStatus {
+		r.ProviderResources.UDPRouteStatuses.Delete(key)
+		delete(r.keyCache.UDPRouteStatus, key)
+	}
 
-	return delSet.List()
+	for key := range kc.ClientTrafficPolicyStatus {
+		r.ProviderResources.ClientTrafficPolicyStatuses.Delete(key)
+		delete(r.keyCache.ClientTrafficPolicyStatus, key)
+	}
+	for key := range kc.BackendTrafficPolicyStatus {
+		r.ProviderResources.BackendTrafficPolicyStatuses.Delete(key)
+		delete(r.keyCache.BackendTrafficPolicyStatus, key)
+	}
+	for key := range kc.SecurityPolicyStatus {
+		r.ProviderResources.SecurityPolicyStatuses.Delete(key)
+		delete(r.keyCache.SecurityPolicyStatus, key)
+	}
+	for key := range kc.BackendTLSPolicyStatus {
+		r.ProviderResources.BackendTLSPolicyStatuses.Delete(key)
+		delete(r.keyCache.BackendTLSPolicyStatus, key)
+	}
+	for key := range kc.EnvoyExtensionPolicyStatus {
+		r.ProviderResources.EnvoyExtensionPolicyStatuses.Delete(key)
+		delete(r.keyCache.EnvoyExtensionPolicyStatus, key)
+	}
+	for key := range kc.ExtensionServerPolicyStatus {
+		r.ProviderResources.ExtensionPolicyStatuses.Delete(key)
+		delete(r.keyCache.ExtensionServerPolicyStatus, key)
+	}
+	for key := range kc.BackendStatus {
+		r.ProviderResources.BackendStatuses.Delete(key)
+		delete(r.keyCache.BackendStatus, key)
+	}
 }
 
 // hmac returns the HMAC secret generated by the CertGen job.
diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
index b2930b270..e2d56eb82 100644
--- a/internal/gatewayapi/securitypolicy.go
+++ b/internal/gatewayapi/securitypolicy.go
@@ -73,19 +73,13 @@ func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.Security
 			Name:      route.GetName(),
 			Namespace: route.GetNamespace(),
 		}
-		routeMap[key] = &policyRouteTargetContext{
-			RouteContext:         route,
-			attachedToRouteRules: make(sets.Set[string]),
-		}
+		routeMap[key] = &policyRouteTargetContext{RouteContext: route}
 	}
 
 	gatewayMap := make(map[types.NamespacedName]*policyGatewayTargetContext, gatewayMapSize)
 	for _, gw := range gateways {
 		key := utils.NamespacedName(gw)
-		gatewayMap[key] = &policyGatewayTargetContext{
-			GatewayContext:      gw,
-			attachedToListeners: make(sets.Set[string]),
-		}
+		gatewayMap[key] = &policyGatewayTargetContext{GatewayContext: gw}
 	}
 
 	// Map of Gateway to the routes attached to it.
@@ -465,7 +459,7 @@ func resolveSecurityPolicyGatewayTargetRef(
 		gateway.attached = true
 	} else {
 		listenerName := string(*target.SectionName)
-		if gateway.attachedToListeners.Has(listenerName) {
+		if gateway.attachedToListeners != nil && gateway.attachedToListeners.Has(listenerName) {
 			message := fmt.Sprintf("Unable to target Listener %s/%s, another SecurityPolicy has already attached to it",
 				string(target.Name), listenerName)
 
@@ -474,6 +468,9 @@ func resolveSecurityPolicyGatewayTargetRef(
 				Message: message,
 			}
 		}
+		if gateway.attachedToListeners == nil {
+			gateway.attachedToListeners = make(sets.Set[string])
+		}
 		gateway.attachedToListeners.Insert(listenerName)
 	}
 
@@ -524,7 +521,7 @@ func resolveSecurityPolicyRouteTargetRef(
 		route.attached = true
 	} else {
 		routeRuleName := string(*target.SectionName)
-		if route.attachedToRouteRules.Has(routeRuleName) {
+		if route.attachedToRouteRules != nil && route.attachedToRouteRules.Has(routeRuleName) {
 			message := fmt.Sprintf("Unable to target RouteRule %s/%s, another SecurityPolicy has already attached to it",
 				string(target.Name), routeRuleName)
 			return route.RouteContext, &status.PolicyResolveError{
@@ -532,6 +529,9 @@ func resolveSecurityPolicyRouteTargetRef(
 				Message: message,
 			}
 		}
+		if route.attachedToRouteRules == nil {
+			route.attachedToRouteRules = make(sets.Set[string])
+		}
 		route.attachedToRouteRules.Insert(routeRuleName)
 	}
 
@@ -883,7 +883,7 @@ func (t *Translator) buildJWT(
 		return nil, err
 	}
 
-	var providers []ir.JWTProvider
+	providers := make([]ir.JWTProvider, 0, len(policy.Spec.JWT.Providers))
 	for i, p := range policy.Spec.JWT.Providers {
 		provider := ir.JWTProvider{
 			Name:           p.Name,
@@ -1007,10 +1007,11 @@ func (t *Translator) buildRemoteJWKS(
 	envoyProxy *egv1a1.EnvoyProxy,
 ) (*ir.RemoteJWKS, error) {
 	var (
-		protocol ir.AppProtocol
-		rd       *ir.RouteDestination
-		traffic  *ir.TrafficFeatures
-		err      error
+		protocol      ir.AppProtocol
+		rd            *ir.RouteDestination
+		traffic       *ir.TrafficFeatures
+		err           error
+		cacheDuration *metav1.Duration
 	)
 
 	u, err := url.Parse(remoteJWKS.URI)
@@ -1037,10 +1038,19 @@ func (t *Translator) buildRemoteJWKS(
 		}
 	}
 
+	if remoteJWKS.CacheDuration != nil {
+		d, err := time.ParseDuration(string(*remoteJWKS.CacheDuration))
+		if err != nil {
+			return nil, err
+		}
+		cacheDuration = ir.MetaV1DurationPtr(d)
+	}
+
 	return &ir.RemoteJWKS{
-		Destination: rd,
-		Traffic:     traffic,
-		URI:         remoteJWKS.URI,
+		Destination:   rd,
+		Traffic:       traffic,
+		URI:           remoteJWKS.URI,
+		CacheDuration: cacheDuration,
 	}, nil
 }
 
diff --git a/internal/gatewayapi/status/gatewayclass.go b/internal/gatewayapi/status/gatewayclass.go
index c09031d21..703c42a12 100644
--- a/internal/gatewayapi/status/gatewayclass.go
+++ b/internal/gatewayapi/status/gatewayclass.go
@@ -83,7 +83,7 @@ func getSupportedFeatures(gatewaySuite *suite.ConformanceOptions, skippedTests [
 		})
 	}
 
-	var featureList []gwapiv1.SupportedFeature
+	featureList := make([]gwapiv1.SupportedFeature, 0, len(ret))
 	for feature := range ret {
 		featureList = append(featureList, feature)
 	}
diff --git a/internal/gatewayapi/tls.go b/internal/gatewayapi/tls.go
index 9d7d864fc..20ea5c0cd 100644
--- a/internal/gatewayapi/tls.go
+++ b/internal/gatewayapi/tls.go
@@ -18,8 +18,8 @@ import (
 // is not malformed and can be properly parsed
 func validateTLSSecretsData(secrets []*corev1.Secret) ([]*x509.Certificate, error) {
 	var publicKeyAlgorithm string
-	var certs []*x509.Certificate
 	var parseErr error
+	certs := make([]*x509.Certificate, 0, len(secrets))
 
 	pkaSecretSet := make(map[string]string)
 	for _, secret := range secrets {
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index da5b2510e..bd333839e 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -1077,6 +1077,9 @@ type RemoteJWKS struct {
 	// URI is the HTTPS URI to fetch the JWKS. Envoy's system trust bundle is used to validate the server certificate.
 	// If a custom trust bundle is needed, it can be specified in a BackendTLSConfig resource and target the BackendRefs.
 	URI string `json:"uri"`
+
+	// Duration after which the cached JWKS should be expired. If not specified, default cache duration is 5 minutes.
+	CacheDuration *metav1.Duration `json:"cacheDuration,omitempty"`
 }
 
 // OIDC defines the schema for authenticating HTTP requests using
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index dadc7e7b7..5ae55046a 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -3140,6 +3140,11 @@ func (in *RemoteJWKS) DeepCopyInto(out *RemoteJWKS) {
 		*out = new(TrafficFeatures)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.CacheDuration != nil {
+		in, out := &in.CacheDuration, &out.CacheDuration
+		*out = new(v1.Duration)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RemoteJWKS.
diff --git a/internal/provider/file/resources.go b/internal/provider/file/resources.go
index 576d9665a..8f9524305 100644
--- a/internal/provider/file/resources.go
+++ b/internal/provider/file/resources.go
@@ -16,7 +16,7 @@ import (
 
 // loadFromFilesAndDirs loads resources from specific files and directories.
 func loadFromFilesAndDirs(files, dirs []string) ([]*resource.Resources, error) {
-	var rs []*resource.Resources
+	rs := make([]*resource.Resources, 0, len(files)+len(dirs))
 
 	for _, file := range files {
 		r, err := loadFromFile(file)
@@ -61,7 +61,7 @@ func loadFromDir(path string) ([]*resource.Resources, error) {
 		return nil, err
 	}
 
-	var rs []*resource.Resources
+	rs := make([]*resource.Resources, 0, len(entries))
 	for _, entry := range entries {
 		// Ignoring subdirectories and all hidden files and directories.
 		if entry.IsDir() || strings.HasPrefix(entry.Name(), ".") {
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index 8d767f23c..a87c5b511 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -298,18 +298,18 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 		gwcResource.GatewayClass = managedGC
 
 		gwcResourceMapping := newResourceMapping()
-
+		logger := r.log.WithValues("GatewayClass", managedGC.Name)
 		// Process the parametersRef of the accepted GatewayClass.
 		// This should run before processGateways and processBackendRefs
 		failToProcessGCParamsRef := false
 		if managedGC.Spec.ParametersRef != nil && managedGC.DeletionTimestamp == nil {
 			if err := r.processGatewayClassParamsRef(ctx, managedGC, gwcResourceMapping, gwcResource); err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error processing GatewayClass parametersRef", "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error processing parametersRef for GatewayClass")
 					return reconcile.Result{}, err
 				}
 
-				r.log.Error(err, fmt.Sprintf("failed processGatewayClassParamsRef for gatewayClass %s", managedGC.Name))
+				logger.Error(err, "failed to process ParametersRef for GatewayClass")
 				msg := fmt.Sprintf("%s: %v", status.MsgGatewayClassInvalidParams, err)
 				gc := status.SetGatewayClassAccepted(
 					managedGC.DeepCopy(),
@@ -328,11 +328,11 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 		// process envoy gateway secret refs
 		if err := r.processEnvoyProxySecretRef(ctx, gwcResource); err != nil {
 			if isTransientError(err) {
-				r.log.Error(err, "transient error processing TLS SecretRef for EnvoyProxy", "gatewayClass", managedGC.Name)
+				logger.Error(err, "transient error processing TLS SecretRef for EnvoyProxy")
 				return reconcile.Result{}, err
 			}
 
-			r.log.Error(err, fmt.Sprintf("failed process TLS SecretRef for EnvoyProxy for gatewayClass %s", managedGC.Name))
+			r.log.Error(err, "failed to process TLS SecretRef for EnvoyProxy for GatewayClass")
 			gc := status.SetGatewayClassAccepted(
 				managedGC.DeepCopy(),
 				false,
@@ -348,6 +348,7 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 
 		if !failToProcessGCParamsRef {
 			// GatewayClass is valid so far, mark it as accepted.
+			logger.V(6).Info("Set GatewayClass Accepted")
 			gc := status.SetGatewayClassAccepted(
 				managedGC.DeepCopy(),
 				true,
@@ -362,38 +363,38 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 		// add the OIDC HMAC Secret to the resourceTree
 		if err = r.processOIDCHMACSecret(ctx, gwcResource, gwcResourceMapping); err != nil {
 			if isTransientError(err) {
-				r.log.Error(err, "transient error processing OIDC HMAC Secret", "gatewayClass", managedGC.Name)
+				logger.Error(err, "transient error processing OIDC HMAC Secret")
 				return reconcile.Result{}, err
 			}
-			r.log.Error(err, fmt.Sprintf("failed processOIDCHMACSecret for gatewayClass %s", managedGC.Name))
+			logger.Error(err, "failed to process OIDC HMAC Secret for GatewayClass")
 		}
 
 		// add the Envoy TLS Secret to the resourceTree
 		if err = r.processEnvoyTLSSecret(ctx, gwcResource, gwcResourceMapping); err != nil {
 			if isTransientError(err) {
-				r.log.Error(err, "transient error processing Envoy TLS Secret", "gatewayClass", managedGC.Name)
+				logger.Error(err, "transient error processing Envoy TLS Secret")
 				return reconcile.Result{}, err
 			}
-			r.log.Error(err, fmt.Sprintf("failed processEnvoyTLSSecret for gatewayClass %s", managedGC.Name))
+			logger.Error(err, "failed to process EnvoyTLSSecret")
 		}
 
 		// Add all Gateways, their associated Routes, and referenced resources to the resourceTree
 		if err = r.processGateways(ctx, managedGC, gwcResourceMapping, gwcResource); err != nil {
 			if isTransientError(err) {
-				r.log.Error(err, "transient error processing gateways", "gatewayClass", managedGC.Name)
+				logger.Error(err, "transient error processing gateways")
 				return reconcile.Result{}, err
 			}
-			r.log.Error(err, fmt.Sprintf("failed processGateways for gatewayClass %s", managedGC.Name))
+			logger.Error(err, "failed process gateways for GatewayClass")
 		}
 
 		if r.eppCRDExists {
 			// Add all EnvoyPatchPolicies to the resourceTree
 			if err = r.processEnvoyPatchPolicies(ctx, gwcResource, gwcResourceMapping); err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error processing EnvoyPatchPolicies", "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error processing EnvoyPatchPolicies")
 					return reconcile.Result{}, err
 				}
-				r.log.Error(err, fmt.Sprintf("failed processEnvoyPatchPolicies for gatewayClass %s", managedGC.Name))
+				logger.Error(err, "failed to process EnvoyPatchPolicies for GatewayClass")
 			}
 		}
 
@@ -401,10 +402,10 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 			// Add all ClientTrafficPolicies and their referenced resources to the resourceTree
 			if err = r.processClientTrafficPolicies(ctx, gwcResource, gwcResourceMapping); err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error processing ClientTrafficPolicies", "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error processing ClientTrafficPolicies")
 					return reconcile.Result{}, err
 				}
-				r.log.Error(err, fmt.Sprintf("failed processClientTrafficPolicies for gatewayClass %s", managedGC.Name))
+				logger.Error(err, "failed process to ClientTrafficPolicies for GatewayClass")
 			}
 		}
 
@@ -412,10 +413,10 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 			// Add all BackendTrafficPolicies to the resourceTree
 			if err = r.processBackendTrafficPolicies(ctx, gwcResource, gwcResourceMapping); err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error processing BackendTrafficPolicies", "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error processing BackendTrafficPolicies")
 					return reconcile.Result{}, err
 				}
-				r.log.Error(err, fmt.Sprintf("failed processBackendTrafficPolicies for gatewayClass %s", managedGC.Name))
+				logger.Error(err, "failed to process BackendTrafficPolicies for GatewayClass")
 			}
 		}
 
@@ -423,10 +424,10 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 			// Add all SecurityPolicies and their referenced resources to the resourceTree
 			if err = r.processSecurityPolicies(ctx, gwcResource, gwcResourceMapping); err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error processing SecurityPolicies", "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error processing SecurityPolicies")
 					return reconcile.Result{}, err
 				}
-				r.log.Error(err, fmt.Sprintf("failed processSecurityPolicies for gatewayClass %s", managedGC.Name))
+				logger.Error(err, "failed to process SecurityPolicies for GatewayClass")
 			}
 		}
 
@@ -434,10 +435,10 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 			// Add all BackendTLSPolies to the resourceTree
 			if err = r.processBackendTLSPolicies(ctx, gwcResource, gwcResourceMapping); err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error processing BackendTLSPolicies", "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error processing BackendTLSPolicies")
 					return reconcile.Result{}, err
 				}
-				r.log.Error(err, fmt.Sprintf("failed processBackendTLSPolicies for gatewayClass %s", managedGC.Name))
+				logger.Error(err, "failed to process BackendTLSPolicies for GatewayClass")
 			}
 		}
 
@@ -445,19 +446,19 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 			// Add all EnvoyExtensionPolicies and their referenced resources to the resourceTree
 			if err = r.processEnvoyExtensionPolicies(ctx, gwcResource, gwcResourceMapping); err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error processing EnvoyExtensionPolicies", "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error processing EnvoyExtensionPolicies")
 					return reconcile.Result{}, err
 				}
-				r.log.Error(err, fmt.Sprintf("failed processEnvoyExtensionPolicies for gatewayClass %s", managedGC.Name))
+				logger.Error(err, "failed to process EnvoyExtensionPolicies for GatewayClass")
 			}
 		}
 
 		if err = r.processExtensionServerPolicies(ctx, gwcResource); err != nil {
 			if isTransientError(err) {
-				r.log.Error(err, "transient error processing ExtensionServerPolicies", "gatewayClass", managedGC.Name)
+				logger.Error(err, "transient error processing ExtensionServerPolicies")
 				return reconcile.Result{}, err
 			}
-			r.log.Error(err, fmt.Sprintf("failed processExtensionServerPolicies for gatewayClass %s", managedGC.Name))
+			logger.Error(err, "failed to process ExtensionServerPolicies for GatewayClass")
 		}
 
 		// Add the referenced services, ServiceImports, and EndpointSlices in
@@ -465,11 +466,11 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 		// BackendRefs are referred by various Route objects and the ExtAuth in SecurityPolicies.
 		if err = r.processBackendRefs(ctx, gwcResource, gwcResourceMapping); err != nil {
 			if isTransientError(err) {
-				r.log.Error(err, "transient error processing BackendRefs", "gatewayClass", managedGC.Name)
+				logger.Error(err, "transient error processing BackendRefs")
 				return reconcile.Result{}, err
 			}
 
-			r.log.Error(err, fmt.Sprintf("failed  processBackendRefs for gatewayClass %s", managedGC.Name))
+			logger.Error(err, "failed to process BackendRefs for GatewayClass")
 		}
 
 		// For this particular Gateway, and all associated objects, check whether the
@@ -478,10 +479,10 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 			namespace, err := r.getNamespace(ctx, ns)
 			if err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error getting namespace", "namespace", ns, "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error getting namespace", "namespace", ns)
 					return reconcile.Result{}, err
 				}
-				r.log.Error(err, "unable to find the namespace")
+				logger.Error(err, "unable to find the namespace", "namespace", ns)
 				if kerrors.IsNotFound(err) {
 					continue
 				}
@@ -500,26 +501,24 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 		}
 
 		if len(gwcResource.Gateways) == 0 {
-			r.log.Info("No gateways found for accepted gatewayClass")
+			logger.Info("No gateways found for accepted GatewayClass")
 
 			// If needed, remove the finalizer from the accepted GatewayClass.
 			if err := r.removeFinalizer(ctx, managedGC); err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error removing finalizer from gatewayClass", "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error removing finalizer from GatewayClass")
 					return reconcile.Result{}, err
 				}
-				r.log.Error(err, fmt.Sprintf("failed to remove finalizer from gatewayClass %s",
-					managedGC.Name))
+				logger.Error(err, "failed to remove finalizer from GatewayClass")
 			}
 		} else {
 			// finalize the accepted GatewayClass.
 			if err := r.addFinalizer(ctx, managedGC); err != nil {
 				if isTransientError(err) {
-					r.log.Error(err, "transient error adding finalizer to gatewayClass", "gatewayClass", managedGC.Name)
+					logger.Error(err, "transient error adding finalizer to gatewayClass")
 					return reconcile.Result{}, err
 				}
-				r.log.Error(err, fmt.Sprintf("failed adding finalizer to gatewayClass %s",
-					managedGC.Name))
+				logger.Error(err, "failed adding finalizer to gatewayClass")
 			}
 		}
 	}
@@ -958,7 +957,7 @@ func (r *gatewayAPIReconciler) processSecurityPolicyObjectRefs(
 }
 
 func getBackendRefs(backendCluster egv1a1.BackendCluster) []gwapiv1.BackendObjectReference {
-	var backendRefs []gwapiv1.BackendObjectReference
+	backendRefs := make([]gwapiv1.BackendObjectReference, 0, 1+len(backendCluster.BackendRefs))
 	if backendCluster.BackendRef != nil {
 		backendRefs = append(backendRefs, *backendCluster.BackendRef)
 	}
@@ -1379,14 +1378,14 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 	if err := r.client.List(ctx, gatewayList, &client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(classGatewayIndex, managedGC.Name),
 	}); err != nil {
-		r.log.Error(err, "failed to list gateways for gatewayClass %s", managedGC.Name)
+		r.log.Error(err, "failed to list gateways for GatewayClass", "GatewayClass", managedGC.Name)
 		return err
 	}
 
 	mergedGateways := false
 	if r.mergeGateways.Has(managedGC.Name) {
 		mergedGateways = true
-		// processGatewayClassParamsRef has been called for this gatewayclass, its EnvoyProxy should exist in resourceTree
+		// processGatewayClassParamsRef has been called for this GatewayClass, its EnvoyProxy should exist in resourceTree
 		r.processServiceClusterForGatewayClass(resourceTree.EnvoyProxyForGatewayClass, managedGC, resourceMap)
 	}
 
@@ -1398,7 +1397,7 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 				if isTransientError(err) {
 					return err
 				}
-				r.log.Error(err, "failed to check namespace labels for gateway %s in namespace %s: %w", gtw.GetName(), gtw.GetNamespace())
+				r.log.Error(err, "failed to check namespace labels for gateway", "name", gtw.GetName(), "namespace", gtw.GetNamespace())
 				continue
 			} else if !ok {
 				continue
@@ -2367,7 +2366,7 @@ func (r *gatewayAPIReconciler) processGatewayParamsRef(ctx context.Context, gtw
 
 	ep := new(egv1a1.EnvoyProxy)
 	if err := r.client.Get(ctx, types.NamespacedName{Namespace: gtw.Namespace, Name: ref.Name}, ep); err != nil {
-		return fmt.Errorf("failed to find envoyproxy %s/%s: %w", gtw.Namespace, ref.Name, err)
+		return fmt.Errorf("failed to find envoyproxy %s/%s for Gateway %s: %w", gtw.Namespace, ref.Name, gtw.Name, err)
 	}
 
 	if err := r.processEnvoyProxy(ep, resourceMap); err != nil {
@@ -2397,8 +2396,9 @@ func (r *gatewayAPIReconciler) processGatewayClassParamsRef(ctx context.Context,
 	}
 
 	ep := new(egv1a1.EnvoyProxy)
-	if err := r.client.Get(ctx, types.NamespacedName{Namespace: string(*gc.Spec.ParametersRef.Namespace), Name: gc.Spec.ParametersRef.Name}, ep); err != nil {
-		return fmt.Errorf("failed to find envoyproxy %s/%s: %w", r.namespace, gc.Spec.ParametersRef.Name, err)
+	nn := types.NamespacedName{Namespace: string(*gc.Spec.ParametersRef.Namespace), Name: gc.Spec.ParametersRef.Name}
+	if err := r.client.Get(ctx, nn, ep); err != nil {
+		return fmt.Errorf("failed to find envoyproxy %s/%s for GatewayClass %s: %w", nn.Namespace, nn.Name, gc.Name, err)
 	}
 
 	// Check for incompatible configuration: both MergeGateways and GatewayNamespaceMode enabled
diff --git a/internal/provider/kubernetes/helpers.go b/internal/provider/kubernetes/helpers.go
index 634f64aef..b2b69f513 100644
--- a/internal/provider/kubernetes/helpers.go
+++ b/internal/provider/kubernetes/helpers.go
@@ -97,35 +97,6 @@ func (cc *controlledClasses) removeMatch(gc *gwapiv1.GatewayClass) {
 	}
 }
 
-// isAccepted returns true if the provided gatewayclass contains the Accepted=true
-// status condition.
-func isAccepted(gc *gwapiv1.GatewayClass) bool {
-	if gc == nil {
-		return false
-	}
-	for _, cond := range gc.Status.Conditions {
-		if cond.Type == string(gwapiv1.GatewayClassConditionStatusAccepted) && cond.Status == metav1.ConditionTrue {
-			return true
-		}
-	}
-	return false
-}
-
-// gatewaysOfClass returns a list of gateways that reference gc from the provided gwList.
-func gatewaysOfClass(gc *gwapiv1.GatewayClass, gwList *gwapiv1.GatewayList) []gwapiv1.Gateway {
-	var gateways []gwapiv1.Gateway
-	if gwList == nil || gc == nil {
-		return gateways
-	}
-	for i := range gwList.Items {
-		gw := gwList.Items[i]
-		if string(gw.Spec.GatewayClassName) == gc.Name {
-			gateways = append(gateways, gw)
-		}
-	}
-	return gateways
-}
-
 // terminatesTLS returns true if the provided gateway contains a listener configured
 // for TLS termination.
 func terminatesTLS(listener *gwapiv1.Listener) bool {
diff --git a/internal/provider/kubernetes/indexers.go b/internal/provider/kubernetes/indexers.go
index 2b9b5efdb..03d4b13f9 100644
--- a/internal/provider/kubernetes/indexers.go
+++ b/internal/provider/kubernetes/indexers.go
@@ -70,7 +70,7 @@ func addReferenceGrantIndexers(ctx context.Context, mgr manager.Manager) error {
 
 func getReferenceGrantIndexerFunc(rawObj client.Object) []string {
 	refGrant := rawObj.(*gwapiv1b1.ReferenceGrant)
-	var referredServices []string
+	referredServices := make([]string, 0, len(refGrant.Spec.To))
 	for _, target := range refGrant.Spec.To {
 		referredServices = append(referredServices, string(target.Kind))
 	}
@@ -587,8 +587,8 @@ func secretSecurityPolicyIndexFunc(rawObj client.Object) []string {
 	securityPolicy := rawObj.(*egv1a1.SecurityPolicy)
 
 	var (
-		secretReferences []gwapiv1.SecretObjectReference
-		values           []string
+		secretReferences = make([]gwapiv1.SecretObjectReference, 0, 4) // OIDC (2) + APIKeyAuth + BasicAuth
+		values           = make([]string, 0, 4)
 	)
 
 	if securityPolicy.Spec.OIDC != nil {
@@ -619,8 +619,8 @@ func backendSecurityPolicyIndexFunc(rawObj client.Object) []string {
 	securityPolicy := rawObj.(*egv1a1.SecurityPolicy)
 
 	var (
-		backendRefs []gwapiv1.BackendObjectReference
-		values      []string
+		backendRefs = make([]gwapiv1.BackendObjectReference, 0, 2) // HTTP + GRPC
+		values      = make([]string, 0, 2)
 	)
 
 	if securityPolicy.Spec.ExtAuth != nil {
diff --git a/internal/provider/kubernetes/predicates.go b/internal/provider/kubernetes/predicates.go
index 19a71b997..b169cd4b7 100644
--- a/internal/provider/kubernetes/predicates.go
+++ b/internal/provider/kubernetes/predicates.go
@@ -110,13 +110,7 @@ func matchLabelsAndExpressions(ls *metav1.LabelSelector, objLabels map[string]st
 
 // validateGatewayForReconcile returns true if the provided object is a Gateway
 // using a GatewayClass matching the configured GatewayClass controller name.
-func (r *gatewayAPIReconciler) validateGatewayForReconcile(obj client.Object) bool {
-	gw, ok := obj.(*gwapiv1.Gateway)
-	if !ok {
-		r.log.Info("unexpected object type, bypassing reconciliation", "object", obj)
-		return false
-	}
-
+func (r *gatewayAPIReconciler) validateGatewayForReconcile(gw *gwapiv1.Gateway) bool {
 	gc := &gwapiv1.GatewayClass{}
 	key := types.NamespacedName{Name: string(gw.Spec.GatewayClassName)}
 	if err := r.client.Get(context.Background(), key, gc); err != nil {
@@ -136,13 +130,7 @@ func (r *gatewayAPIReconciler) validateGatewayForReconcile(obj client.Object) bo
 }
 
 // validateSecretForReconcile checks whether the Secret belongs to a valid Gateway.
-func (r *gatewayAPIReconciler) validateSecretForReconcile(obj client.Object) bool {
-	secret, ok := obj.(*corev1.Secret)
-	if !ok {
-		r.log.Info("unexpected object type, bypassing reconciliation", "object", obj)
-		return false
-	}
-
+func (r *gatewayAPIReconciler) validateSecretForReconcile(secret *corev1.Secret) bool {
 	nsName := utils.NamespacedName(secret)
 
 	if r.isGatewayReferencingSecret(&nsName) {
diff --git a/internal/provider/kubernetes/routes.go b/internal/provider/kubernetes/routes.go
index 42b83deed..37dd5b460 100644
--- a/internal/provider/kubernetes/routes.go
+++ b/internal/provider/kubernetes/routes.go
@@ -306,7 +306,7 @@ func (r *gatewayAPIReconciler) processHTTPRouteFilter(
 	resourceMap *resourceMappings,
 	resourceTree *resource.Resources,
 ) error {
-	var extGKs []schema.GroupKind
+	extGKs := make([]schema.GroupKind, 0, len(r.extGVKs))
 	for _, gvk := range r.extGVKs {
 		extGKs = append(extGKs, gvk.GroupKind())
 	}
diff --git a/internal/provider/kubernetes/secrets.go b/internal/provider/kubernetes/secrets.go
index e8c0f4311..402147db9 100644
--- a/internal/provider/kubernetes/secrets.go
+++ b/internal/provider/kubernetes/secrets.go
@@ -91,8 +91,8 @@ func CertsToSecret(namespace string, certs *crypto.Certificates) []corev1.Secret
 // them if they do.
 func CreateOrUpdateSecrets(ctx context.Context, client client.Client, secrets []corev1.Secret, update bool) ([]corev1.Secret, error) {
 	var (
-		tidySecrets     []corev1.Secret
-		existingSecrets []string
+		tidySecrets     = make([]corev1.Secret, 0, len(secrets))
+		existingSecrets = make([]string, 0, len(secrets))
 	)
 
 	for i := range secrets {
diff --git a/internal/provider/kubernetes/status.go b/internal/provider/kubernetes/status.go
index 5735260e0..a0e4f0ef7 100644
--- a/internal/provider/kubernetes/status.go
+++ b/internal/provider/kubernetes/status.go
@@ -109,7 +109,7 @@ func (r *gatewayAPIReconciler) subscribeAndUpdateStatus(ctx context.Context, ext
 							Spec:       h.Spec,
 							Status: gwapiv1.HTTPRouteStatus{
 								RouteStatus: gwapiv1.RouteStatus{
-									Parents: mergeRouteParentStatus(h.Namespace, r.envoyGateway.Gateway.ControllerName, h.Status.Parents, val.Parents),
+									Parents: mergeRouteParentStatus(h.Namespace, h.Status.Parents, val.Parents),
 								},
 							},
 						}
@@ -147,7 +147,7 @@ func (r *gatewayAPIReconciler) subscribeAndUpdateStatus(ctx context.Context, ext
 							Spec:       g.Spec,
 							Status: gwapiv1.GRPCRouteStatus{
 								RouteStatus: gwapiv1.RouteStatus{
-									Parents: mergeRouteParentStatus(g.Namespace, r.envoyGateway.Gateway.ControllerName, g.Status.Parents, val.Parents),
+									Parents: mergeRouteParentStatus(g.Namespace, g.Status.Parents, val.Parents),
 								},
 							},
 						}
@@ -187,7 +187,7 @@ func (r *gatewayAPIReconciler) subscribeAndUpdateStatus(ctx context.Context, ext
 							Spec:       t.Spec,
 							Status: gwapiv1a2.TLSRouteStatus{
 								RouteStatus: gwapiv1.RouteStatus{
-									Parents: mergeRouteParentStatus(t.Namespace, r.envoyGateway.Gateway.ControllerName, t.Status.Parents, val.Parents),
+									Parents: mergeRouteParentStatus(t.Namespace, t.Status.Parents, val.Parents),
 								},
 							},
 						}
@@ -227,7 +227,7 @@ func (r *gatewayAPIReconciler) subscribeAndUpdateStatus(ctx context.Context, ext
 							Spec:       t.Spec,
 							Status: gwapiv1a2.TCPRouteStatus{
 								RouteStatus: gwapiv1.RouteStatus{
-									Parents: mergeRouteParentStatus(t.Namespace, r.envoyGateway.Gateway.ControllerName, t.Status.Parents, val.Parents),
+									Parents: mergeRouteParentStatus(t.Namespace, t.Status.Parents, val.Parents),
 								},
 							},
 						}
@@ -267,7 +267,7 @@ func (r *gatewayAPIReconciler) subscribeAndUpdateStatus(ctx context.Context, ext
 							Spec:       u.Spec,
 							Status: gwapiv1a2.UDPRouteStatus{
 								RouteStatus: gwapiv1.RouteStatus{
-									Parents: mergeRouteParentStatus(u.Namespace, r.envoyGateway.Gateway.ControllerName, u.Status.Parents, val.Parents),
+									Parents: mergeRouteParentStatus(u.Namespace, u.Status.Parents, val.Parents),
 								},
 							},
 						}
@@ -569,14 +569,15 @@ func (r *gatewayAPIReconciler) subscribeAndUpdateStatus(ctx context.Context, ext
 
 // mergeRouteParentStatus merges the old and new RouteParentStatus.
 // This is needed because the RouteParentStatus doesn't support strategic merge patch yet.
-func mergeRouteParentStatus(ns, controllerName string, old, new []gwapiv1.RouteParentStatus) []gwapiv1.RouteParentStatus {
+func mergeRouteParentStatus(ns string, old, new []gwapiv1.RouteParentStatus) []gwapiv1.RouteParentStatus {
 	// Allocating with worst-case capacity to avoid reallocation.
 	merged := make([]gwapiv1.RouteParentStatus, 0, len(old)+len(new))
 
 	// Range over old status parentRefs in order:
 	// 1. The parentRef exists in the new status: append the new one to the final status.
 	// 2. The parentRef doesn't exist in the new status and it's not our controller: append it to the final status.
-	// 3. The parentRef doesn't exist in the new status, and it is our controller: don't append it to the final status.
+	// 3. The parentRef doesn't exist in the new status, and it is our controller: keep it in the final status.
+	//    This is important for routes with multiple parent references - not all parents are updated in each reconciliation.
 	for _, oldP := range old {
 		found := -1
 		for newI, newP := range new {
@@ -587,7 +588,10 @@ func mergeRouteParentStatus(ns, controllerName string, old, new []gwapiv1.RouteP
 		}
 		if found >= 0 {
 			merged = append(merged, new[found])
-		} else if oldP.ControllerName != gwapiv1.GatewayController(controllerName) {
+		} else {
+			// Keep all old parent statuses, regardless of controller.
+			// For routes with multiple parents managed by the same controller,
+			// not all parents are necessarily updated in each reconciliation.
 			merged = append(merged, oldP)
 		}
 	}
diff --git a/internal/utils/jsonpatch/jsonpathtopointer.go b/internal/utils/jsonpatch/jsonpathtopointer.go
index 3898fb079..b1c325249 100644
--- a/internal/utils/jsonpatch/jsonpathtopointer.go
+++ b/internal/utils/jsonpatch/jsonpathtopointer.go
@@ -15,7 +15,7 @@ import (
 )
 
 func ConvertPathToPointers(jsonDoc []byte, jsonPath, path string) ([]string, error) {
-	var jsonPointers []string
+	jsonPointers := make([]string, 0, 4) // reasonable default for most json path queries
 
 	jObj, err := oj.Parse(jsonDoc)
 	if err != nil {
diff --git a/internal/utils/jsonpatch/patch.go b/internal/utils/jsonpatch/patch.go
index 8c14ae19f..868c9c2f3 100644
--- a/internal/utils/jsonpatch/patch.go
+++ b/internal/utils/jsonpatch/patch.go
@@ -11,7 +11,6 @@ import (
 	"fmt"
 
 	jsonpatchv5 "github.com/evanphx/json-patch/v5"
-	"sigs.k8s.io/yaml"
 
 	"github.com/envoyproxy/gateway/internal/ir"
 )
@@ -58,38 +57,18 @@ func ApplyJSONPatches(document json.RawMessage, patches ...ir.JSONPatchOperation
 		}
 
 		for _, path := range jsonPointers {
-			op := ir.JSONPatchOperation{
-				Path:  &path,
-				Op:    p.Op,
-				Value: p.Value,
-				From:  p.From,
-			}
-
-			// Convert patch to JSON
-			// The patch library expects an array so convert it into one
-			y, err := yaml.Marshal([]ir.JSONPatchOperation{op})
-			if err != nil {
-				tErr := fmt.Errorf("unable to marshal patch %+v, err: %s", op, err.Error())
-				tErrs = errors.Join(tErrs, tErr)
-				continue
-			}
-			jsonBytes, err := yaml.YAMLToJSON(y)
+			operation, err := toPatchOperation(path, p)
 			if err != nil {
-				tErr := fmt.Errorf("unable to convert patch to json %s, err: %s", string(y), err.Error())
-				tErrs = errors.Join(tErrs, tErr)
-				continue
-			}
-			patchObj, err := jsonpatchv5.DecodePatch(jsonBytes)
-			if err != nil {
-				tErr := fmt.Errorf("unable to decode patch %s, err: %s", string(jsonBytes), err.Error())
-				tErrs = errors.Join(tErrs, tErr)
+				tErrs = errors.Join(tErrs, err)
 				continue
 			}
 
+			patch := jsonpatchv5.Patch{operation}
+
 			// Apply patch
-			document, err = patchObj.ApplyWithOptions(document, opts)
+			document, err = patch.ApplyWithOptions(document, opts)
 			if err != nil {
-				tErr := fmt.Errorf("unable to apply patch:\n%s on resource:\n%s, err: %s", string(jsonBytes), string(document), err.Error())
+				tErr := fmt.Errorf("unable to apply patch: op=%s path=%s err: %s", string(p.Op), path, err.Error())
 				tErrs = errors.Join(tErrs, tErr)
 				continue
 			}
@@ -97,3 +76,52 @@ func ApplyJSONPatches(document json.RawMessage, patches ...ir.JSONPatchOperation
 	}
 	return document, tErrs
 }
+
+func toPatchOperation(path string, original ir.JSONPatchOperation) (jsonpatchv5.Operation, error) {
+	operation := make(jsonpatchv5.Operation, 4)
+
+	rawOp, err := marshalJSONString(string(original.Op))
+	if err != nil {
+		return nil, fmt.Errorf("unable to marshal patch op %q: %w", string(original.Op), err)
+	}
+	operation["op"] = rawOp
+
+	rawPath, err := marshalJSONString(path)
+	if err != nil {
+		return nil, fmt.Errorf("unable to marshal patch path %q: %w", path, err)
+	}
+	operation["path"] = rawPath
+
+	if original.From != nil {
+		rawFrom, err := marshalJSONString(*original.From)
+		if err != nil {
+			return nil, fmt.Errorf("unable to marshal patch from %q: %w", *original.From, err)
+		}
+		operation["from"] = rawFrom
+	}
+
+	if original.Value != nil {
+		operation["value"] = cloneRawJSON(original.Value.Raw)
+	}
+
+	return operation, nil
+}
+
+func marshalJSONString(value string) (*json.RawMessage, error) {
+	b, err := json.Marshal(value)
+	if err != nil {
+		return nil, err
+	}
+	raw := json.RawMessage(b)
+	return &raw, nil
+}
+
+func cloneRawJSON(src []byte) *json.RawMessage {
+	if src == nil {
+		rawNull := json.RawMessage([]byte("null"))
+		return &rawNull
+	}
+	cloned := make(json.RawMessage, len(src))
+	copy(cloned, src)
+	return &cloned
+}
diff --git a/internal/utils/slice/slice.go b/internal/utils/slice/slice.go
index cc75f9f0e..68e077d21 100644
--- a/internal/utils/slice/slice.go
+++ b/internal/utils/slice/slice.go
@@ -18,12 +18,18 @@ func ContainsString(slice []string, s string) bool {
 // RemoveString returns a newly created []string that contains all items from slice that
 // are not equal to s.
 func RemoveString(slice []string, s string) []string {
-	var newSlice []string
+	if slice == nil {
+		return nil
+	}
+	newSlice := make([]string, 0, len(slice))
 	for _, item := range slice {
 		if item == s {
 			continue
 		}
 		newSlice = append(newSlice, item)
 	}
+	if len(newSlice) == 0 {
+		return nil
+	}
 	return newSlice
 }
diff --git a/internal/xds/cache/snapshotcache.go b/internal/xds/cache/snapshotcache.go
index 61b923f22..aa892d79c 100644
--- a/internal/xds/cache/snapshotcache.go
+++ b/internal/xds/cache/snapshotcache.go
@@ -407,7 +407,7 @@ func (s *snapshotCache) GetIrKeys() []string {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	var irKeys []string
+	irKeys := make([]string, 0, len(s.lastSnapshot))
 	for key := range s.lastSnapshot {
 		irKeys = append(irKeys, key)
 	}
diff --git a/internal/xds/translator/accesslog.go b/internal/xds/translator/accesslog.go
index e51853f27..5cd7ef611 100644
--- a/internal/xds/translator/accesslog.go
+++ b/internal/xds/translator/accesslog.go
@@ -373,7 +373,11 @@ func celAccessLogFilter(expr string) (*accesslog.AccessLogFilter, error) {
 
 func buildAccessLogFilter(exprs []string, withNoRouteMatchFilter bool) (*accesslog.AccessLogFilter, error) {
 	// add filter for access logs
-	var filters []*accesslog.AccessLogFilter
+	capacity := len(exprs)
+	if withNoRouteMatchFilter {
+		capacity++
+	}
+	filters := make([]*accesslog.AccessLogFilter, 0, capacity)
 	for _, expr := range exprs {
 		fl, err := celAccessLogFilter(expr)
 		if err != nil {
diff --git a/internal/xds/translator/authorization.go b/internal/xds/translator/authorization.go
index 7a94453fb..e2e53f5ea 100644
--- a/internal/xds/translator/authorization.go
+++ b/internal/xds/translator/authorization.go
@@ -153,9 +153,9 @@ func buildRBACPerRoute(authorization *ir.Authorization) (*rbacv3.RBACPerRoute, e
 		rbac        *rbacv3.RBACPerRoute
 		allowAction *anypb.Any
 		denyAction  *anypb.Any
-		matcherList []*matcherv3.Matcher_MatcherList_FieldMatcher
 		err         error
 	)
+	matcherList := make([]*matcherv3.Matcher_MatcherList_FieldMatcher, 0, len(authorization.Rules))
 
 	allow := &rbacconfigv3.Action{
 		Name:   "ALLOW",
@@ -625,7 +625,7 @@ func buildHeaderPredicate(name string, values []string, ignoreCase bool) ([]*mat
 		return nil, err
 	}
 
-	var predicates []*matcherv3.Matcher_MatcherList_Predicate
+	predicates := make([]*matcherv3.Matcher_MatcherList_Predicate, 0, len(values))
 	for _, value := range values {
 		predicates = append(predicates, &matcherv3.Matcher_MatcherList_Predicate{
 			MatchType: &matcherv3.Matcher_MatcherList_Predicate_SinglePredicate_{
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
index 0d3e387c1..48d4c4d86 100644
--- a/internal/xds/translator/cluster.go
+++ b/internal/xds/translator/cluster.go
@@ -725,7 +725,6 @@ func buildXdsClusterLoadAssignment(clusterName string, destSettings []*ir.Destin
 }
 
 func buildZonalLocalities(metadata *corev3.Metadata, ds *ir.DestinationSetting) []*endpointv3.LocalityLbEndpoints {
-	var localities []*endpointv3.LocalityLbEndpoints
 	zonalEndpoints := make(map[string][]*endpointv3.LbEndpoint)
 	for _, irEp := range ds.Endpoints {
 		healthStatus := corev3.HealthStatus_UNKNOWN
@@ -748,6 +747,7 @@ func buildZonalLocalities(metadata *corev3.Metadata, ds *ir.DestinationSetting)
 		zonalEndpoints[zone] = append(zonalEndpoints[zone], lbEndpoint)
 	}
 
+	localities := make([]*endpointv3.LocalityLbEndpoints, 0, len(zonalEndpoints))
 	for zone, endPts := range zonalEndpoints {
 		locality := &endpointv3.LocalityLbEndpoints{
 			Locality: &corev3.Locality{
@@ -1249,7 +1249,7 @@ func buildHTTP2Settings(opts *ir.HTTP2Settings) *corev3.Http2ProtocolOptions {
 // buildEndpointOverrideLoadBalancingPolicy builds the Envoy LoadBalancingPolicy for EndpointOverride
 func buildEndpointOverrideLoadBalancingPolicy(loadBalancer *ir.LoadBalancer) (*clusterv3.LoadBalancingPolicy, error) {
 	// Build override host sources from EndpointOverride
-	var overrideHostSources []*override_hostv3.OverrideHost_OverrideHostSource
+	overrideHostSources := make([]*override_hostv3.OverrideHost_OverrideHostSource, 0, len(loadBalancer.EndpointOverride.ExtractFrom))
 
 	for _, source := range loadBalancer.EndpointOverride.ExtractFrom {
 		overrideSource := &override_hostv3.OverrideHost_OverrideHostSource{}
diff --git a/internal/xds/translator/cors.go b/internal/xds/translator/cors.go
index b53a12002..5aff0a80e 100644
--- a/internal/xds/translator/cors.go
+++ b/internal/xds/translator/cors.go
@@ -125,7 +125,6 @@ func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute, _ *ir.HTTPL
 	}
 
 	var (
-		allowOrigins     []*matcherv3.StringMatcher
 		allowMethods     string
 		allowHeaders     string
 		exposeHeaders    string
@@ -144,6 +143,7 @@ func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute, _ *ir.HTTPL
 
 	//nolint:gocritic
 
+	allowOrigins := make([]*matcherv3.StringMatcher, 0, len(c.AllowOrigins))
 	for _, origin := range c.AllowOrigins {
 		allowOrigins = append(allowOrigins, buildXdsStringMatcher(origin))
 	}
diff --git a/internal/xds/translator/extauth.go b/internal/xds/translator/extauth.go
index 194999d4a..3fb3ce4cc 100644
--- a/internal/xds/translator/extauth.go
+++ b/internal/xds/translator/extauth.go
@@ -107,7 +107,7 @@ func extAuthConfig(extAuth *ir.ExtAuth) (*extauthv3.ExtAuthz, error) {
 		config.ClearRouteCache = *extAuth.RecomputeRoute
 	}
 
-	var headersToExtAuth []*matcherv3.StringMatcher
+	headersToExtAuth := make([]*matcherv3.StringMatcher, 0, len(extAuth.HeadersToExtAuth))
 	for _, header := range extAuth.HeadersToExtAuth {
 		headersToExtAuth = append(headersToExtAuth, &matcherv3.StringMatcher{
 			MatchPattern: &matcherv3.StringMatcher_Exact{
@@ -164,9 +164,8 @@ func extAuthConfig(extAuth *ir.ExtAuth) (*extauthv3.ExtAuthz, error) {
 
 func httpService(http *ir.HTTPExtAuthService, timeout *durationpb.Duration) *extauthv3.HttpService {
 	var (
-		uri              string
-		headersToBackend []*matcherv3.StringMatcher
-		service          *extauthv3.HttpService
+		uri     string
+		service *extauthv3.HttpService
 	)
 
 	service = &extauthv3.HttpService{
@@ -191,6 +190,7 @@ func httpService(http *ir.HTTPExtAuthService, timeout *durationpb.Duration) *ext
 		Timeout: timeout,
 	}
 
+	headersToBackend := make([]*matcherv3.StringMatcher, 0, len(http.HeadersToBackend))
 	for _, header := range http.HeadersToBackend {
 		headersToBackend = append(headersToBackend, &matcherv3.StringMatcher{
 			MatchPattern: &matcherv3.StringMatcher_Exact{
diff --git a/internal/xds/translator/header_mutation.go b/internal/xds/translator/header_mutation.go
index 286014339..689c57824 100644
--- a/internal/xds/translator/header_mutation.go
+++ b/internal/xds/translator/header_mutation.go
@@ -92,7 +92,7 @@ func buildHeaderMutationFilter(headers *ir.HeaderSettings) (*hcmv3.HttpFilter, e
 }
 
 func buildHeaderMutationRules(addHeaders []ir.AddHeader, removeHeaders []string) []*mutation_rulesv3.HeaderMutation {
-	var mutationRules []*mutation_rulesv3.HeaderMutation
+	mutationRules := make([]*mutation_rulesv3.HeaderMutation, 0, len(addHeaders)+len(removeHeaders))
 
 	for _, header := range addHeaders {
 		var appendAction corev3.HeaderValueOption_HeaderAppendAction
diff --git a/internal/xds/translator/jsonpatch.go b/internal/xds/translator/jsonpatch.go
index c8b2a7141..e4e3ceb36 100644
--- a/internal/xds/translator/jsonpatch.go
+++ b/internal/xds/translator/jsonpatch.go
@@ -17,7 +17,6 @@ import (
 	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
 	"google.golang.org/protobuf/encoding/protojson"
-	"sigs.k8s.io/yaml"
 
 	"github.com/envoyproxy/gateway/internal/gatewayapi/status"
 	"github.com/envoyproxy/gateway/internal/ir"
@@ -68,17 +67,15 @@ func processJSONPatches(tCtx *types.ResourceVersionTable, envoyPatchPolicies []*
 			// If Path and JSONPath is "" and op is "add", unmarshal and add the patch as a complete
 			// resource
 			if p.Operation.Op == ir.JSONPatchOpAdd && p.Operation.IsPathNilOrEmpty() && p.Operation.IsJSONPathNilOrEmpty() {
-				// Convert patch to JSON
-				// The patch library expects an array so convert it into one
-				y, err := yaml.Marshal(p.Operation.Value)
-				if err != nil {
-					tErr := fmt.Errorf("unable to marshal patch %+v, err: %s", p.Operation.Value, err.Error())
+				if p.Operation.Value == nil {
+					tErr := fmt.Errorf("missing value for add operation with empty path")
 					tErrs = errors.Join(tErrs, tErr)
 					continue
 				}
-				jsonBytes, err := yaml.YAMLToJSON(y)
-				if err != nil {
-					tErr := fmt.Errorf("unable to convert patch to json %s, err: %s", string(y), err.Error())
+
+				jsonBytes := p.Operation.Value.Raw
+				if len(jsonBytes) == 0 {
+					tErr := fmt.Errorf("empty value for add operation with empty path")
 					tErrs = errors.Join(tErrs, tErr)
 					continue
 				}
diff --git a/internal/xds/translator/jwt.go b/internal/xds/translator/jwt.go
index 8803b0529..423e31f1d 100644
--- a/internal/xds/translator/jwt.go
+++ b/internal/xds/translator/jwt.go
@@ -8,7 +8,6 @@ package translator
 import (
 	"errors"
 	"fmt"
-	"time"
 
 	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
@@ -159,11 +158,13 @@ func buildJWTAuthn(irListener *ir.HTTPListener) (*jwtauthnv3.JwtAuthentication,
 							},
 							Timeout: durationpb.New(defaultExtServiceRequestTimeout),
 						},
-						CacheDuration: durationpb.New(5 * time.Minute),
-						AsyncFetch:    &jwtauthnv3.JwksAsyncFetch{},
+
+						AsyncFetch: &jwtauthnv3.JwksAsyncFetch{},
 					},
 				}
-
+				if jwks.CacheDuration != nil {
+					remote.RemoteJwks.CacheDuration = durationpb.New(jwks.CacheDuration.Duration)
+				}
 				// Set the retry policy if it exists.
 				if jwks.Traffic != nil && jwks.Traffic.Retry != nil {
 					var rp *corev3.RetryPolicy
diff --git a/internal/xds/translator/local_ratelimit.go b/internal/xds/translator/local_ratelimit.go
index e98809928..7a7d16ab1 100644
--- a/internal/xds/translator/local_ratelimit.go
+++ b/internal/xds/translator/local_ratelimit.go
@@ -198,8 +198,8 @@ func (*localRateLimit) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute, h
 func buildRouteLocalRateLimits(local *ir.LocalRateLimit) (
 	[]*routev3.RateLimit, []*rlv3.LocalRateLimitDescriptor,
 ) {
-	var rateLimits []*routev3.RateLimit
-	var descriptors []*rlv3.LocalRateLimitDescriptor
+	rateLimits := make([]*routev3.RateLimit, 0, len(local.Rules))
+	descriptors := make([]*rlv3.LocalRateLimitDescriptor, 0, len(local.Rules))
 
 	// Rules are ORed
 	for rIdx, rule := range local.Rules {
diff --git a/internal/xds/translator/session_persistence.go b/internal/xds/translator/session_persistence.go
index f68a18a80..8f958d30d 100644
--- a/internal/xds/translator/session_persistence.go
+++ b/internal/xds/translator/session_persistence.go
@@ -178,7 +178,7 @@ func routePathToCookiePath(path *ir.StringMatch) string {
 // https://gateway-api.sigs.k8s.io/geps/gep-1619/#path
 func getLongestNonRegexPrefix(path string) string {
 	parts := strings.Split(path, "/")
-	var longestNonRegexPrefix []string
+	longestNonRegexPrefix := make([]string, 0, len(parts))
 	for _, part := range parts {
 		if part == "*" || strings.Contains(part, "*") {
 			break
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index b9134cd12..aa9e22b35 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -13,6 +13,7 @@ new features: |
   Added support for RetryPolicy in gRPC ExtAuth callouts via SecurityPolicy backend settings fields.
   Added support for late response headers in ClientTrafficPolicy.
   Added max connection/stream duration and max requests per connection to ClientTrafficPolicy.
+  Added cacheDuration for remoteJWKS in SecurityPolicy.
 
 bug fixes: |
   Fixed %ROUTE_KIND% operator to be lower-cased when used by clusterStatName in EnvoyProxy API.
diff --git a/site/data/adopters.yaml b/site/data/adopters.yaml
index 91f48b316..99ad40f91 100644
--- a/site/data/adopters.yaml
+++ b/site/data/adopters.yaml
@@ -86,3 +86,7 @@ adopters:
   - name: "Sophotech"
     logo: "/logos/sophotech.svg"
     description: "Sophotech is using Envoy Gateway to power ingress in Kubernetes environments, giving secure, consistent, and easy-to-manage traffic routing."
+  - name: "CloudRaft"
+    logo: "/logos/cloudraft.svg"
+    url: "https://www.cloudraft.io"
+    description: "CloudRaft uses Envoy Gateway for Kubernetes ingress and traffic management, enabling secure, consistent routing with advanced features like rate limiting and policy enforcement."
diff --git a/site/package.json b/site/package.json
index 31002b72e..48b668cbf 100644
--- a/site/package.json
+++ b/site/package.json
@@ -38,12 +38,12 @@
     "@fortawesome/fontawesome-free": "^7.0.0",
     "autoprefixer": "^10.4.20",
     "cross-env": "^10.0.0",
-    "hugo-extended": "0.150.0",
+    "hugo-extended": "0.150.1",
     "postcss-cli": "^11.0.0",
     "rtlcss": "^4.3.0"
   },
   "optionalDependencies": {
-    "npm-check-updates": "^18.0.2"
+    "npm-check-updates": "^19.0.0"
   },
   "private": true,
   "prettier": {
diff --git a/site/static/logos/cloudraft.svg b/site/static/logos/cloudraft.svg
new file mode 100644
index 000000000..6657d15c0
--- /dev/null
+++ b/site/static/logos/cloudraft.svg
@@ -0,0 +1,3 @@
+<svg width="1920" height="211" viewBox="0 0 1920 211" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M160.059 16.3556C143.965 6.42541 124.36 0.584139 103.877 0.584139C45.3549 0.584139 0 44.6857 0 105.143C0 169.981 47.9884 210.286 103.877 210.286C124.068 210.286 145.428 203.568 160.352 194.514C166.496 191.302 167.959 183.708 163.278 177.283C159.474 172.61 153.329 171.733 148.062 174.654C134.894 182.832 119.971 187.213 103.877 187.213C59.6929 187.213 25.1647 156.546 25.1647 105.143C25.1647 57.2444 57.9372 23.6572 103.877 23.6572C120.264 23.6572 135.187 28.6222 148.062 36.2159C153.621 39.1365 159.474 38.8445 162.985 33.8794C167.667 27.746 166.496 20.1524 160.059 16.3556ZM353.924 195.975C353.924 189.257 348.657 184.292 341.927 184.292H253.265V14.6032C253.265 7.88573 247.706 2.92065 241.268 2.92065C233.953 2.92065 228.978 7.88573 228.978 14.6032V195.39C228.978 202.108 233.953 207.365 240.683 207.365H341.927C348.657 207.365 353.924 202.692 353.924 195.975ZM597.153 105.143C597.153 44.9778 555.894 0 498.542 0C440.898 0 399.93 44.9778 399.93 105.143C399.93 165.308 440.898 210.286 498.542 210.286C555.894 210.286 597.153 165.308 597.153 105.143ZM571.988 105.143C571.988 152.457 541.556 186.921 498.542 186.921C455.236 186.921 425.097 152.749 425.097 105.143C425.097 57.5365 455.236 23.3651 498.542 23.3651C541.556 23.3651 571.988 57.5365 571.988 105.143ZM808.906 2.62858C801.884 2.62858 797.787 7.88573 797.787 14.6032V130.552C797.787 162.679 772.037 186.044 742.191 186.044C712.93 186.044 688.058 162.679 688.058 130.552V14.6032C688.058 7.88573 682.498 2.62858 676.06 2.62858C668.745 2.62858 663.771 7.88573 663.771 14.6032V130.552C663.771 175.53 697.421 209.41 742.191 209.41C786.668 209.41 820.318 175.53 820.318 130.552V14.6032C820.318 7.88573 815.637 2.62858 808.906 2.62858ZM911.016 2.92065C904.286 2.92065 899.311 7.88573 899.311 14.6032V195.39C899.311 202.108 904.286 207.365 911.016 207.365H984.169C1041.81 207.365 1070.49 161.511 1070.49 105.143C1070.49 50.2349 1041.81 2.92065 984.169 2.92065H911.016ZM981.243 25.4095C1026.31 25.4095 1045.32 62.7936 1045.32 105.143C1045.32 148.952 1026.31 184.584 981.243 184.584H923.598V25.4095H981.243ZM1150.6 207.365C1157.33 207.365 1161.43 202.108 1161.43 195.39V124.419H1223.17C1240.14 124.419 1257.7 131.721 1257.7 156.546C1257.7 189.549 1267.65 200.063 1277.01 205.321C1281.69 208.241 1290.18 208.241 1293.98 202.692C1297.78 197.435 1295.74 190.425 1290.18 187.213C1283.45 183.416 1281.98 175.822 1281.11 154.21C1280.52 133.765 1269.69 119.454 1254.77 112.444C1273.79 103.975 1287.84 84.1143 1287.84 60.7492C1287.84 27.1619 1262.09 2.92065 1229.61 2.92065H1148.84C1142.11 2.92065 1137.14 7.88573 1137.14 14.6032V195.39C1137.14 202.108 1143.29 207.365 1150.6 207.365ZM1228.14 25.4095C1248.04 25.4095 1262.67 40.8889 1262.67 61.3333C1262.67 85.8667 1246.58 102.514 1229.61 103.39H1161.43V25.4095H1228.14ZM1518.93 196.559C1518.93 195.098 1518.64 193.638 1518.06 191.886L1442.56 9.63811C1440.81 4.96509 1436.42 2.04446 1431.44 2.04446C1426.47 1.75239 1422.08 4.0889 1420.03 9.63811L1344.24 193.638C1343.66 195.098 1343.37 196.559 1343.66 198.019C1343.66 203.568 1347.17 207.949 1354.49 207.949C1358.88 207.949 1362.97 205.029 1364.73 200.356L1384.33 152.749H1477.09L1496.7 200.063C1498.74 205.029 1502.84 207.949 1507.52 207.949C1513.37 207.949 1518.93 203.568 1518.93 196.559ZM1393.7 129.968L1430.27 40.8889L1467.43 129.968H1393.7ZM1590.79 207.365C1597.52 207.365 1602.78 202.108 1602.78 195.39V114.197H1680.03C1686.76 114.197 1692.03 108.94 1692.03 103.098C1692.03 96.3809 1686.76 91.4159 1680.03 91.4159H1602.78V25.4095H1693.2C1699.93 25.4095 1705.2 20.4445 1705.2 14.3111C1705.2 7.59366 1699.93 2.92065 1693.2 2.92065H1590.49C1583.76 2.92065 1578.79 7.88573 1578.79 14.6032V195.39C1578.79 202.108 1583.47 207.365 1590.79 207.365ZM1839.82 207.365C1847.14 207.365 1852.41 202.108 1852.41 195.39V25.1175H1908C1914.73 25.1175 1920 21.0286 1920 14.0191C1920 7.3016 1914.73 2.92065 1908 2.92065H1771.94C1765.21 2.92065 1760.23 7.3016 1760.23 14.0191C1760.23 20.7365 1765.21 25.1175 1771.94 25.1175H1827.53V195.39C1827.53 202.108 1832.8 207.365 1839.82 207.365Z" fill="#00BD6E"/>
+</svg>
diff --git a/tools/linter/golangci-lint/.golangci.yml b/tools/linter/golangci-lint/.golangci.yml
index c8c6b8218..416543bd0 100644
--- a/tools/linter/golangci-lint/.golangci.yml
+++ b/tools/linter/golangci-lint/.golangci.yml
@@ -42,6 +42,7 @@ linters:
     - gosec
     - importas
     - misspell
+    - prealloc
     - revive
     - staticcheck
     - testifylint
diff --git a/tools/make/kube.mk b/tools/make/kube.mk
index aa0cb495d..843ead2e7 100644
--- a/tools/make/kube.mk
+++ b/tools/make/kube.mk
@@ -25,6 +25,10 @@ BENCHMARK_CONNECTIONS ?= 100
 BENCHMARK_DURATION ?= 60
 BENCHMARK_REPORT_DIR ?= benchmark_report
 
+# Benchmark toggles
+# Disable PNG rendering by default to speed up CI
+BENCHMARK_RENDER_PNG ?= false
+
 CONFORMANCE_RUN_TEST ?=
 
 E2E_RUN_TEST ?=
@@ -253,8 +257,8 @@ run-benchmark: install-benchmark-server prepare-ip-family ## Run benchmark tests
 	kubectl apply -f test/benchmark/config/gatewayclass.yaml
 	go test -v -tags benchmark -timeout $(BENCHMARK_TIMEOUT) ./test/benchmark --rps=$(BENCHMARK_RPS) --connections=$(BENCHMARK_CONNECTIONS) --duration=$(BENCHMARK_DURATION) --report-save-dir=$(BENCHMARK_REPORT_DIR)
 	# render benchmark profiles into image
-	dot -V
-	find test/benchmark/$(BENCHMARK_REPORT_DIR)/profiles -name "*.pprof" -type f -exec sh -c 'go tool pprof -png "$$1" > "$${1%.pprof}.png"' _ {} \;
+	@if [ "$(BENCHMARK_RENDER_PNG)" != "false" ]; then dot -V; fi
+	@if [ "$(BENCHMARK_RENDER_PNG)" != "false" ]; then find test/benchmark/$(BENCHMARK_REPORT_DIR)/profiles -name "*.pprof" -type f -exec sh -c 'go tool pprof -png "$$1" > "$$${1%.pprof}.png"' _ {} \; ; fi
 
 .PHONY: install-benchmark-server
 install-benchmark-server: ## Install nighthawk server for benchmark test



Test patch:
diff --git a/internal/cmd/egctl/testdata/translate/in/jwt-single-route-single-match-to-xds.yaml b/internal/cmd/egctl/testdata/translate/in/jwt-single-route-single-match-to-xds.yaml
index cef3ccc53..c3555103d 100644
--- a/internal/cmd/egctl/testdata/translate/in/jwt-single-route-single-match-to-xds.yaml
+++ b/internal/cmd/egctl/testdata/translate/in/jwt-single-route-single-match-to-xds.yaml
@@ -84,6 +84,7 @@ spec:
       - name: example
         remoteJWKS:
           uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/jwks.json
+          cacheDuration: 300s
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
diff --git a/internal/gatewayapi/resource/testdata/all-resources.out.yaml b/internal/gatewayapi/resource/testdata/all-resources.out.yaml
index b62951040..f70580f5d 100644
--- a/internal/gatewayapi/resource/testdata/all-resources.out.yaml
+++ b/internal/gatewayapi/resource/testdata/all-resources.out.yaml
@@ -383,6 +383,7 @@ securityPolicies:
       providers:
       - name: example
         remoteJWKS:
+          cacheDuration: 300s
           uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/jwks.json
     targetRef:
       group: gateway.networking.k8s.io
diff --git a/internal/gatewayapi/runner/runner_test.go b/internal/gatewayapi/runner/runner_test.go
index 8ba56270a..357a9290a 100644
--- a/internal/gatewayapi/runner/runner_test.go
+++ b/internal/gatewayapi/runner/runner_test.go
@@ -12,7 +12,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"k8s.io/apimachinery/pkg/types"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -66,54 +65,8 @@ func TestRunner(t *testing.T) {
 	}, time.Second*1, time.Millisecond*20)
 }
 
-func TestGetIRKeysToDelete(t *testing.T) {
-	testCases := []struct {
-		name    string
-		curKeys []string
-		newKeys []string
-		delKeys []string
-	}{
-		{
-			name:    "empty",
-			curKeys: []string{},
-			newKeys: []string{},
-			delKeys: []string{},
-		},
-		{
-			name:    "no new keys",
-			curKeys: []string{"one", "two"},
-			newKeys: []string{},
-			delKeys: []string{"one", "two"},
-		},
-		{
-			name:    "no cur keys",
-			curKeys: []string{},
-			newKeys: []string{"one", "two"},
-			delKeys: []string{},
-		},
-		{
-			name:    "equal",
-			curKeys: []string{"one", "two"},
-			newKeys: []string{"two", "one"},
-			delKeys: []string{},
-		},
-		{
-			name:    "mix",
-			curKeys: []string{"one", "two"},
-			newKeys: []string{"two", "three"},
-			delKeys: []string{"one"},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.ElementsMatch(t, tc.delKeys, getIRKeysToDelete(tc.curKeys, tc.newKeys))
-		})
-	}
-}
-
-func TestDeleteStatusKeys(t *testing.T) {
-	// Setup
+// setupTestRunner creates a test runner with populated stores and keyCache
+func setupTestRunner(t *testing.T) (*Runner, []types.NamespacedName) {
 	pResources := new(message.ProviderResources)
 	xdsIR := new(message.XdsIR)
 	infraIR := new(message.InfraIR)
@@ -121,7 +74,8 @@ func TestDeleteStatusKeys(t *testing.T) {
 	require.NoError(t, err)
 	extMgr, closeFunc, err := registry.NewInMemoryManager(&egv1a1.ExtensionManager{}, &pb.UnimplementedEnvoyGatewayExtensionServer{})
 	require.NoError(t, err)
-	defer closeFunc()
+	t.Cleanup(closeFunc)
+
 	r := New(&Config{
 		Server:            *cfg,
 		ProviderResources: pResources,
@@ -129,48 +83,30 @@ func TestDeleteStatusKeys(t *testing.T) {
 		InfraIR:           infraIR,
 		ExtensionManager:  extMgr,
 	})
-	ctx := context.Background()
 
-	// Start
-	err = r.Start(ctx)
-	require.NoError(t, err)
+	// Store test data in IR and status stores
+	r.InfraIR.Store("test-ir-1", nil)
+	r.InfraIR.Store("test-ir-2", nil)
+	r.XdsIR.Store("test-ir-1", nil)
+	r.XdsIR.Store("test-ir-2", nil)
 
-	// A new status gets stored
 	keys := []types.NamespacedName{
-		{
-			Name:      "test1",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test2",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test3",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test4",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test5",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test6",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test7",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test8",
-			Namespace: "test-namespace",
-		},
+		{Name: "gateway1", Namespace: "test-namespace"},
+		{Name: "httproute1", Namespace: "test-namespace"},
+		{Name: "grpcroute1", Namespace: "test-namespace"},
+		{Name: "tlsroute1", Namespace: "test-namespace"},
+		{Name: "tcproute1", Namespace: "test-namespace"},
+		{Name: "udproute1", Namespace: "test-namespace"},
+		{Name: "udproute2", Namespace: "test-namespace"},
+		{Name: "backend1", Namespace: "test-namespace"},
+		{Name: "backendtls1", Namespace: "test-namespace"},
+		{Name: "clientpolicy1", Namespace: "test-namespace"},
+		{Name: "backendpolicy1", Namespace: "test-namespace"},
+		{Name: "security1", Namespace: "test-namespace"},
+		{Name: "envoyext1", Namespace: "test-namespace"},
 	}
 
+	// Store various status types
 	r.ProviderResources.GatewayStatuses.Store(keys[0], &gwapiv1.GatewayStatus{})
 	r.ProviderResources.HTTPRouteStatuses.Store(keys[1], &gwapiv1.HTTPRouteStatus{})
 	r.ProviderResources.GRPCRouteStatuses.Store(keys[2], &gwapiv1.GRPCRouteStatus{})
@@ -179,19 +115,22 @@ func TestDeleteStatusKeys(t *testing.T) {
 	r.ProviderResources.UDPRouteStatuses.Store(keys[5], &gwapiv1a2.UDPRouteStatus{})
 	r.ProviderResources.UDPRouteStatuses.Store(keys[6], &gwapiv1a2.UDPRouteStatus{})
 	r.ProviderResources.BackendStatuses.Store(keys[7], &egv1a1.BackendStatus{})
+	r.ProviderResources.BackendTLSPolicyStatuses.Store(keys[8], &gwapiv1a2.PolicyStatus{})
+	r.ProviderResources.ClientTrafficPolicyStatuses.Store(keys[9], &gwapiv1a2.PolicyStatus{})
+	r.ProviderResources.BackendTrafficPolicyStatuses.Store(keys[10], &gwapiv1a2.PolicyStatus{})
+	r.ProviderResources.SecurityPolicyStatuses.Store(keys[11], &gwapiv1a2.PolicyStatus{})
+	r.ProviderResources.EnvoyExtensionPolicyStatuses.Store(keys[12], &gwapiv1a2.PolicyStatus{})
 
-	// Checks that the keys are successfully stored to DeletableStatus and watchable maps
-	ds := r.getAllStatuses()
+	// Populate keyCache to simulate normal operation where stores and keyCache are kept in sync
+	r.populateKeyCache()
 
-	require.True(t, ds.GatewayStatusKeys[keys[0]])
-	require.True(t, ds.HTTPRouteStatusKeys[keys[1]])
-	require.True(t, ds.GRPCRouteStatusKeys[keys[2]])
-	require.True(t, ds.TLSRouteStatusKeys[keys[3]])
-	require.True(t, ds.TCPRouteStatusKeys[keys[4]])
-	require.True(t, ds.UDPRouteStatusKeys[keys[5]])
-	require.True(t, ds.UDPRouteStatusKeys[keys[6]])
-	require.True(t, ds.BackendStatusKeys[keys[7]])
+	return r, keys
+}
 
+// verifyInitialState checks that all stores and keyCache are properly populated
+func verifyInitialState(t *testing.T, r *Runner) {
+	require.Equal(t, 2, r.InfraIR.Len())
+	require.Equal(t, 2, r.XdsIR.Len())
 	require.Equal(t, 1, r.ProviderResources.GatewayStatuses.Len())
 	require.Equal(t, 1, r.ProviderResources.HTTPRouteStatuses.Len())
 	require.Equal(t, 1, r.ProviderResources.GRPCRouteStatuses.Len())
@@ -199,104 +138,75 @@ func TestDeleteStatusKeys(t *testing.T) {
 	require.Equal(t, 1, r.ProviderResources.TCPRouteStatuses.Len())
 	require.Equal(t, 2, r.ProviderResources.UDPRouteStatuses.Len())
 	require.Equal(t, 1, r.ProviderResources.BackendStatuses.Len())
+	require.Equal(t, 1, r.ProviderResources.BackendTLSPolicyStatuses.Len())
+	require.Equal(t, 1, r.ProviderResources.ClientTrafficPolicyStatuses.Len())
+	require.Equal(t, 1, r.ProviderResources.BackendTrafficPolicyStatuses.Len())
+	require.Equal(t, 1, r.ProviderResources.SecurityPolicyStatuses.Len())
+	require.Equal(t, 1, r.ProviderResources.EnvoyExtensionPolicyStatuses.Len())
+}
 
-	// Delete all keys except the last UDPRouteStatus key
-	delete(ds.UDPRouteStatusKeys, keys[6])
-	r.deleteStatusKeys(ds)
-
+func TestDeleteKeys(t *testing.T) {
+	r, keys := setupTestRunner(t)
+	verifyInitialState(t, r)
+
+	// Create KeyCache with subset of keys to delete (selective deletion)
+	keysToDelete := newKeyCache()
+	keysToDelete.IR["test-ir-1"] = true // Delete only one IR key
+	keysToDelete.GatewayStatus[keys[0]] = true
+	keysToDelete.HTTPRouteStatus[keys[1]] = true
+	keysToDelete.TLSRouteStatus[keys[3]] = true
+	keysToDelete.UDPRouteStatus[keys[5]] = true // Delete only one UDP route
+	keysToDelete.BackendTLSPolicyStatus[keys[8]] = true
+	keysToDelete.SecurityPolicyStatus[keys[11]] = true
+	// Leave some keys to verify selective deletion works
+
+	// Test selective deletion
+	r.deleteKeys(keysToDelete)
+
+	// Verify selective deletion worked
+	require.Equal(t, 1, r.InfraIR.Len()) // One IR key should remain
+	require.Equal(t, 1, r.XdsIR.Len())   // One XDS key should remain
 	require.Equal(t, 0, r.ProviderResources.GatewayStatuses.Len())
 	require.Equal(t, 0, r.ProviderResources.HTTPRouteStatuses.Len())
-	require.Equal(t, 0, r.ProviderResources.GRPCRouteStatuses.Len())
+	require.Equal(t, 1, r.ProviderResources.GRPCRouteStatuses.Len()) // Should remain
 	require.Equal(t, 0, r.ProviderResources.TLSRouteStatuses.Len())
-	require.Equal(t, 0, r.ProviderResources.TCPRouteStatuses.Len())
-	require.Equal(t, 1, r.ProviderResources.UDPRouteStatuses.Len())
-	require.Equal(t, 0, r.ProviderResources.BackendStatuses.Len())
+	require.Equal(t, 1, r.ProviderResources.TCPRouteStatuses.Len()) // Should remain
+	require.Equal(t, 1, r.ProviderResources.UDPRouteStatuses.Len()) // One should remain
+	require.Equal(t, 1, r.ProviderResources.BackendStatuses.Len())  // Should remain
+	require.Equal(t, 0, r.ProviderResources.BackendTLSPolicyStatuses.Len())
+	require.Equal(t, 1, r.ProviderResources.ClientTrafficPolicyStatuses.Len())  // Should remain
+	require.Equal(t, 1, r.ProviderResources.BackendTrafficPolicyStatuses.Len()) // Should remain
+	require.Equal(t, 0, r.ProviderResources.SecurityPolicyStatuses.Len())
+	require.Equal(t, 1, r.ProviderResources.EnvoyExtensionPolicyStatuses.Len()) // Should remain
+
+	// Verify keyCache was updated correctly
+	require.False(t, r.keyCache.IR["test-ir-1"])
+	require.True(t, r.keyCache.IR["test-ir-2"]) // Should remain
+	require.False(t, r.keyCache.GatewayStatus[keys[0]])
+	require.False(t, r.keyCache.HTTPRouteStatus[keys[1]])
+	require.True(t, r.keyCache.GRPCRouteStatus[keys[2]]) // Should remain
+	require.False(t, r.keyCache.TLSRouteStatus[keys[3]])
+	require.True(t, r.keyCache.TCPRouteStatus[keys[4]]) // Should remain
+	require.False(t, r.keyCache.UDPRouteStatus[keys[5]])
+	require.True(t, r.keyCache.UDPRouteStatus[keys[6]]) // Should remain
+	require.True(t, r.keyCache.BackendStatus[keys[7]])  // Should remain
+	require.False(t, r.keyCache.BackendTLSPolicyStatus[keys[8]])
+	require.True(t, r.keyCache.ClientTrafficPolicyStatus[keys[9]])   // Should remain
+	require.True(t, r.keyCache.BackendTrafficPolicyStatus[keys[10]]) // Should remain
+	require.False(t, r.keyCache.SecurityPolicyStatus[keys[11]])
+	require.True(t, r.keyCache.EnvoyExtensionPolicyStatus[keys[12]]) // Should remain
 }
 
-func TestDeleteAllStatusKeys(t *testing.T) {
-	// Setup
-	pResources := new(message.ProviderResources)
-	xdsIR := new(message.XdsIR)
-	infraIR := new(message.InfraIR)
-	cfg, err := config.New(os.Stdout)
-	require.NoError(t, err)
-	extMgr, closeFunc, err := registry.NewInMemoryManager(&egv1a1.ExtensionManager{}, &pb.UnimplementedEnvoyGatewayExtensionServer{})
-	require.NoError(t, err)
-	defer closeFunc()
-	r := New(&Config{
-		Server:            *cfg,
-		ProviderResources: pResources,
-		XdsIR:             xdsIR,
-		InfraIR:           infraIR,
-		ExtensionManager:  extMgr,
-	})
-	ctx := context.Background()
-
-	// Start
-	err = r.Start(ctx)
-	require.NoError(t, err)
-
-	// A new status gets stored
-	keys := []types.NamespacedName{
-		{
-			Name:      "test1",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test2",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test3",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test4",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test5",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test6",
-			Namespace: "test-namespace",
-		},
-		{
-			Name:      "test7",
-			Namespace: "test-namespace",
-		},
-	}
-
-	r.ProviderResources.GatewayStatuses.Store(keys[0], &gwapiv1.GatewayStatus{})
-	r.ProviderResources.HTTPRouteStatuses.Store(keys[1], &gwapiv1.HTTPRouteStatus{})
-	r.ProviderResources.GRPCRouteStatuses.Store(keys[2], &gwapiv1.GRPCRouteStatus{})
-	r.ProviderResources.TLSRouteStatuses.Store(keys[3], &gwapiv1a2.TLSRouteStatus{})
-	r.ProviderResources.TCPRouteStatuses.Store(keys[4], &gwapiv1a2.TCPRouteStatus{})
-	r.ProviderResources.UDPRouteStatuses.Store(keys[5], &gwapiv1a2.UDPRouteStatus{})
-	r.ProviderResources.BackendStatuses.Store(keys[6], &egv1a1.BackendStatus{})
-
-	// Checks that the keys are successfully stored to DeletableStatus and watchable maps
-	ds := r.getAllStatuses()
+func TestDeleteAllKeys(t *testing.T) {
+	r, _ := setupTestRunner(t)
+	verifyInitialState(t, r)
 
-	require.True(t, ds.GatewayStatusKeys[keys[0]])
-	require.True(t, ds.HTTPRouteStatusKeys[keys[1]])
-	require.True(t, ds.GRPCRouteStatusKeys[keys[2]])
-	require.True(t, ds.TLSRouteStatusKeys[keys[3]])
-	require.True(t, ds.TCPRouteStatusKeys[keys[4]])
-	require.True(t, ds.UDPRouteStatusKeys[keys[5]])
-	require.True(t, ds.BackendStatusKeys[keys[6]])
-
-	require.Equal(t, 1, r.ProviderResources.GatewayStatuses.Len())
-	require.Equal(t, 1, r.ProviderResources.HTTPRouteStatuses.Len())
-	require.Equal(t, 1, r.ProviderResources.GRPCRouteStatuses.Len())
-	require.Equal(t, 1, r.ProviderResources.TLSRouteStatuses.Len())
-	require.Equal(t, 1, r.ProviderResources.TCPRouteStatuses.Len())
-	require.Equal(t, 1, r.ProviderResources.UDPRouteStatuses.Len())
-	require.Equal(t, 1, r.ProviderResources.BackendStatuses.Len())
+	// Test deleteAllKeys functionality
+	r.deleteAllKeys()
 
-	// Delete all keys
-	r.deleteAllStatusKeys()
+	// Verify everything is deleted
+	require.Equal(t, 0, r.InfraIR.Len())
+	require.Equal(t, 0, r.XdsIR.Len())
 	require.Equal(t, 0, r.ProviderResources.GatewayStatuses.Len())
 	require.Equal(t, 0, r.ProviderResources.HTTPRouteStatuses.Len())
 	require.Equal(t, 0, r.ProviderResources.GRPCRouteStatuses.Len())
@@ -304,4 +214,24 @@ func TestDeleteAllStatusKeys(t *testing.T) {
 	require.Equal(t, 0, r.ProviderResources.TCPRouteStatuses.Len())
 	require.Equal(t, 0, r.ProviderResources.UDPRouteStatuses.Len())
 	require.Equal(t, 0, r.ProviderResources.BackendStatuses.Len())
+	require.Equal(t, 0, r.ProviderResources.BackendTLSPolicyStatuses.Len())
+	require.Equal(t, 0, r.ProviderResources.ClientTrafficPolicyStatuses.Len())
+	require.Equal(t, 0, r.ProviderResources.BackendTrafficPolicyStatuses.Len())
+	require.Equal(t, 0, r.ProviderResources.SecurityPolicyStatuses.Len())
+	require.Equal(t, 0, r.ProviderResources.EnvoyExtensionPolicyStatuses.Len())
+
+	// Verify keyCache is reset
+	require.Empty(t, r.keyCache.IR)
+	require.Empty(t, r.keyCache.GatewayStatus)
+	require.Empty(t, r.keyCache.HTTPRouteStatus)
+	require.Empty(t, r.keyCache.GRPCRouteStatus)
+	require.Empty(t, r.keyCache.TLSRouteStatus)
+	require.Empty(t, r.keyCache.TCPRouteStatus)
+	require.Empty(t, r.keyCache.UDPRouteStatus)
+	require.Empty(t, r.keyCache.BackendStatus)
+	require.Empty(t, r.keyCache.BackendTLSPolicyStatus)
+	require.Empty(t, r.keyCache.ClientTrafficPolicyStatus)
+	require.Empty(t, r.keyCache.BackendTrafficPolicyStatus)
+	require.Empty(t, r.keyCache.SecurityPolicyStatus)
+	require.Empty(t, r.keyCache.EnvoyExtensionPolicyStatus)
 }
diff --git a/internal/provider/kubernetes/helpers_test.go b/internal/provider/kubernetes/helpers_test.go
index 38a634f9c..dd7aa92ea 100644
--- a/internal/provider/kubernetes/helpers_test.go
+++ b/internal/provider/kubernetes/helpers_test.go
@@ -111,6 +111,21 @@ func TestGatewaysOfClass(t *testing.T) {
 	}
 }
 
+// gatewaysOfClass returns a list of gateways that reference gc from the provided gwList.
+func gatewaysOfClass(gc *gwapiv1.GatewayClass, gwList *gwapiv1.GatewayList) []gwapiv1.Gateway {
+	var gateways []gwapiv1.Gateway
+	if gwList == nil || gc == nil {
+		return gateways
+	}
+	for i := range gwList.Items {
+		gw := gwList.Items[i]
+		if string(gw.Spec.GatewayClassName) == gc.Name {
+			gateways = append(gateways, gw)
+		}
+	}
+	return gateways
+}
+
 func TestIsGatewayClassAccepted(t *testing.T) {
 	testCases := []struct {
 		name   string
@@ -185,12 +200,26 @@ func TestIsGatewayClassAccepted(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			actual := isAccepted(tc.gc)
+			actual := isGatewayClassAccepted(tc.gc)
 			require.Equal(t, tc.expect, actual)
 		})
 	}
 }
 
+// isAccepted returns true if the provided gatewayclass contains the Accepted=true
+// status condition.
+func isGatewayClassAccepted(gc *gwapiv1.GatewayClass) bool {
+	if gc == nil {
+		return false
+	}
+	for _, cond := range gc.Status.Conditions {
+		if cond.Type == string(gwapiv1.GatewayClassConditionStatusAccepted) && cond.Status == metav1.ConditionTrue {
+			return true
+		}
+	}
+	return false
+}
+
 func TestRefsEnvoyProxy(t *testing.T) {
 	testCases := []struct {
 		name   string
diff --git a/internal/provider/kubernetes/predicates_test.go b/internal/provider/kubernetes/predicates_test.go
index 7478febea..81ab3aa02 100644
--- a/internal/provider/kubernetes/predicates_test.go
+++ b/internal/provider/kubernetes/predicates_test.go
@@ -143,7 +143,7 @@ func TestValidateGatewayForReconcile(t *testing.T) {
 	testCases := []struct {
 		name    string
 		configs []client.Object
-		gateway client.Object
+		gateway *gwapiv1.Gateway
 		expect  bool
 	}{
 		{
@@ -343,7 +343,7 @@ func TestValidateSecretForReconcile(t *testing.T) {
 	testCases := []struct {
 		name    string
 		configs []client.Object
-		secret  client.Object
+		secret  *corev1.Secret
 		expect  bool
 	}{
 		{
diff --git a/internal/provider/kubernetes/status_test.go b/internal/provider/kubernetes/status_test.go
index 63b7fdea7..1cb4c5730 100644
--- a/internal/provider/kubernetes/status_test.go
+++ b/internal/provider/kubernetes/status_test.go
@@ -361,6 +361,24 @@ func Test_mergeRouteParentStatus(t *testing.T) {
 						},
 					},
 				},
+				{
+					ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
+					ParentRef: gwapiv1.ParentReference{
+						Name: "gateway2",
+					},
+					Conditions: []metav1.Condition{
+						{
+							Type:   string(gwapiv1.RouteConditionAccepted),
+							Status: metav1.ConditionTrue,
+							Reason: "Accepted",
+						},
+						{
+							Type:   string(gwapiv1.RouteConditionResolvedRefs),
+							Status: metav1.ConditionTrue,
+							Reason: "ResolvedRefs",
+						},
+					},
+				},
 				{
 					ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
 					ParentRef: gwapiv1.ParentReference{
@@ -456,6 +474,24 @@ func Test_mergeRouteParentStatus(t *testing.T) {
 						},
 					},
 				},
+				{
+					ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
+					ParentRef: gwapiv1.ParentReference{
+						Name: "gateway2",
+					},
+					Conditions: []metav1.Condition{
+						{
+							Type:   string(gwapiv1.RouteConditionAccepted),
+							Status: metav1.ConditionTrue,
+							Reason: "Accepted",
+						},
+						{
+							Type:   string(gwapiv1.RouteConditionResolvedRefs),
+							Status: metav1.ConditionTrue,
+							Reason: "ResolvedRefs",
+						},
+					},
+				},
 			},
 		},
 
@@ -670,6 +706,24 @@ func Test_mergeRouteParentStatus(t *testing.T) {
 				},
 			},
 			want: []gwapiv1.RouteParentStatus{
+				{
+					ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
+					ParentRef: gwapiv1.ParentReference{
+						Name: "gateway2",
+					},
+					Conditions: []metav1.Condition{
+						{
+							Type:   string(gwapiv1.RouteConditionAccepted),
+							Status: metav1.ConditionTrue,
+							Reason: "Accepted",
+						},
+						{
+							Type:   string(gwapiv1.RouteConditionResolvedRefs),
+							Status: metav1.ConditionTrue,
+							Reason: "ResolvedRefs",
+						},
+					},
+				},
 				{
 					ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
 					ParentRef: gwapiv1.ParentReference{
@@ -690,9 +744,10 @@ func Test_mergeRouteParentStatus(t *testing.T) {
 				},
 			},
 		},
-		// Similar note about practicality of occurrence.
+		// Test that parent refs managed by our controller are preserved even when not in new update.
+		// This is important for routes with multiple parent references.
 		{
-			name: "old contains one parentRef of ours, and it gets dropped in new.",
+			name: "old contains one parentRef of ours, and it's not in new - should be preserved.",
 			args: args{
 				old: []gwapiv1.RouteParentStatus{
 					{
@@ -716,12 +771,118 @@ func Test_mergeRouteParentStatus(t *testing.T) {
 				},
 				new: []gwapiv1.RouteParentStatus{},
 			},
-			want: []gwapiv1.RouteParentStatus{},
+			want: []gwapiv1.RouteParentStatus{
+				{
+					ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
+					ParentRef: gwapiv1.ParentReference{
+						Name: "gateway2",
+					},
+					Conditions: []metav1.Condition{
+						{
+							Type:   string(gwapiv1.RouteConditionAccepted),
+							Status: metav1.ConditionTrue,
+							Reason: "Accepted",
+						},
+						{
+							Type:   string(gwapiv1.RouteConditionResolvedRefs),
+							Status: metav1.ConditionTrue,
+							Reason: "ResolvedRefs",
+						},
+					},
+				},
+			},
+		},
+		// Test multi-parent scenario where only one parent is updated at a time.
+		{
+			name: "multiple parents from same controller - update one, preserve others",
+			args: args{
+				old: []gwapiv1.RouteParentStatus{
+					{
+						ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
+						ParentRef: gwapiv1.ParentReference{
+							Name: "gateway1",
+						},
+						Conditions: []metav1.Condition{
+							{
+								Type:   string(gwapiv1.RouteConditionAccepted),
+								Status: metav1.ConditionTrue,
+								Reason: "Accepted",
+							},
+						},
+					},
+					{
+						ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
+						ParentRef: gwapiv1.ParentReference{
+							Name: "gateway2",
+						},
+						Conditions: []metav1.Condition{
+							{
+								Type:   string(gwapiv1.RouteConditionAccepted),
+								Status: metav1.ConditionTrue,
+								Reason: "Accepted",
+							},
+						},
+					},
+				},
+				new: []gwapiv1.RouteParentStatus{
+					{
+						ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
+						ParentRef: gwapiv1.ParentReference{
+							Name: "gateway1",
+						},
+						Conditions: []metav1.Condition{
+							{
+								Type:   string(gwapiv1.RouteConditionAccepted),
+								Status: metav1.ConditionTrue,
+								Reason: "Accepted",
+							},
+							{
+								Type:   string(gwapiv1.RouteConditionResolvedRefs),
+								Status: metav1.ConditionTrue,
+								Reason: "ResolvedRefs",
+							},
+						},
+					},
+				},
+			},
+			want: []gwapiv1.RouteParentStatus{
+				{
+					ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
+					ParentRef: gwapiv1.ParentReference{
+						Name: "gateway1",
+					},
+					Conditions: []metav1.Condition{
+						{
+							Type:   string(gwapiv1.RouteConditionAccepted),
+							Status: metav1.ConditionTrue,
+							Reason: "Accepted",
+						},
+						{
+							Type:   string(gwapiv1.RouteConditionResolvedRefs),
+							Status: metav1.ConditionTrue,
+							Reason: "ResolvedRefs",
+						},
+					},
+				},
+				{
+					ControllerName: "gateway.envoyproxy.io/gatewayclass-controller",
+					ParentRef: gwapiv1.ParentReference{
+						Name: "gateway2",
+					},
+					Conditions: []metav1.Condition{
+						{
+							Type:   string(gwapiv1.RouteConditionAccepted),
+							Status: metav1.ConditionTrue,
+							Reason: "Accepted",
+						},
+					},
+				},
+			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := mergeRouteParentStatus("default", "gateway.envoyproxy.io/gatewayclass-controller", tt.args.old, tt.args.new); !reflect.DeepEqual(got, tt.want) {
+			if got := mergeRouteParentStatus("default", tt.args.old, tt.args.new); !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("mergeRouteParentStatus() = %v, want %v", got, tt.want)
 			}
 		})
diff --git a/internal/xds/translator/testdata/in/xds-ir/authorization-jwt-claim.yaml b/internal/xds/translator/testdata/in/xds-ir/authorization-jwt-claim.yaml
index 321ad85ef..d2a6caf02 100644
--- a/internal/xds/translator/testdata/in/xds-ir/authorization-jwt-claim.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/authorization-jwt-claim.yaml
@@ -55,6 +55,7 @@ http:
           name: example1
           remoteJWKS:
             uri: https://two.example.com/jwt/public-key/jwks.json
+            cacheDuration: 300s
   - destination:
       name: httproute/default/httproute-2/rule/0
       settings:
@@ -99,3 +100,5 @@ http:
           name: example1
           remoteJWKS:
             uri: https://one.example.com/jwt/public-key/jwks.json
+            cacheDuration: 300s
+
diff --git a/internal/xds/translator/testdata/in/xds-ir/authorization-jwt-scope.yaml b/internal/xds/translator/testdata/in/xds-ir/authorization-jwt-scope.yaml
index 95ffc4a94..df3d838fb 100644
--- a/internal/xds/translator/testdata/in/xds-ir/authorization-jwt-scope.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/authorization-jwt-scope.yaml
@@ -55,6 +55,7 @@ http:
           name: example1
           remoteJWKS:
             uri: https://two.example.com/jwt/public-key/jwks.json
+            cacheDuration: 300s
   - destination:
       name: httproute/default/httproute-2/rule/0
       settings:
@@ -95,3 +96,5 @@ http:
           name: example1
           remoteJWKS:
             uri: https://one.example.com/jwt/public-key/jwks.json
+            cacheDuration: 300s
+
diff --git a/internal/xds/translator/testdata/in/xds-ir/custom-filter-order.yaml b/internal/xds/translator/testdata/in/xds-ir/custom-filter-order.yaml
index 4971328e8..7f224f4f1 100644
--- a/internal/xds/translator/testdata/in/xds-ir/custom-filter-order.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/custom-filter-order.yaml
@@ -52,6 +52,7 @@ http:
           name: example1
           remoteJWKS:
             uri: https://one.example.com/jwt/public-key/jwks.json
+            cacheDuration: 300s
         - audiences:
           - two.foo.com
           claimToHeaders:
@@ -61,6 +62,7 @@ http:
           name: example2
           remoteJWKS:
             uri: http://two.example.com/jwt/public-key/jwks.json
+            cacheDuration: 300s
     envoyExtensions:
       wasms:
       - config:
diff --git a/internal/xds/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml b/internal/xds/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml
index 66fc43f92..07e8fdd38 100644
--- a/internal/xds/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml
@@ -21,6 +21,7 @@ http:
           - foo.com
           remoteJWKS:
             uri: https://localhost/jwt/public-key/jwks.json
+            cacheDuration: 300s
           extractFrom:
             cookies:
             - session_access_token
diff --git a/internal/xds/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml b/internal/xds/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml
index f2ebba7af..e1ae6a567 100644
--- a/internal/xds/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml
@@ -21,6 +21,7 @@ http:
           - foo.com
           remoteJWKS:
             uri: http://localhost/jwt/public-key/jwks.json
+            cacheDuration: 300s
           claimToHeaders:
           - header: one-route-example-key1
             claim: claim.neteased.key
@@ -64,6 +65,7 @@ http:
           - foo.com
           remoteJWKS:
             uri: http://localhost/jwt/public-key/jwks.json
+            cacheDuration: 300s
           claimToHeaders:
           - header: second-route-example-key1
             claim: claim.neteased.key
@@ -74,6 +76,7 @@ http:
           - two.foo.com
           remoteJWKS:
             uri: https://192.168.1.250:8080/jwt/public-key/jwks.json
+            cacheDuration: 300s
     destination:
       name: "second-route-www.test.com-dest"
       settings:
diff --git a/internal/xds/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml b/internal/xds/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml
index 4944995ad..6e9de3de4 100644
--- a/internal/xds/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml
@@ -26,6 +26,7 @@ http:
           - foo.com
           remoteJWKS:
             uri: https://localhost/jwt/public-key/jwks.json
+            cacheDuration: 300s
           claimToHeaders:
           - header: first-route-key
             claim: claim.neteased.key
@@ -49,6 +50,7 @@ http:
           - foo.com
           remoteJWKS:
             uri: https://localhost/jwt/public-key/jwks.json
+            cacheDuration: 300s
     destination:
       name: "second-route-dest"
       settings:
diff --git a/internal/xds/translator/testdata/in/xds-ir/jwt-optional.yaml b/internal/xds/translator/testdata/in/xds-ir/jwt-optional.yaml
index 18baee23c..0eb580353 100644
--- a/internal/xds/translator/testdata/in/xds-ir/jwt-optional.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/jwt-optional.yaml
@@ -21,6 +21,7 @@ http:
           - foo.com
           remoteJWKS:
             uri: https://localhost/jwt/public-key/jwks.json
+            cacheDuration: 300s
           extractFrom:
             cookies:
             - session_access_token
diff --git a/internal/xds/translator/testdata/in/xds-ir/jwt-ratelimit.yaml b/internal/xds/translator/testdata/in/xds-ir/jwt-ratelimit.yaml
index b84df0fb0..3c69d1ac8 100644
--- a/internal/xds/translator/testdata/in/xds-ir/jwt-ratelimit.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/jwt-ratelimit.yaml
@@ -43,6 +43,7 @@ http:
           - foo.com
           remoteJWKS:
             uri: https://192.168.1.250/jwt/public-key/jwks.json
+            cacheDuration: 300s
   - name: "second-route"
     hostname: "*"
     traffic:
diff --git a/internal/xds/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml b/internal/xds/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml
index efa91fec8..2094b3ac5 100644
--- a/internal/xds/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml
@@ -21,6 +21,7 @@ http:
           - foo.com
           remoteJWKS:
             uri: https://localhost/jwt/public-key/jwks.json
+            cacheDuration: 300s
     destination:
       name: "first-route-dest"
       settings:
diff --git a/internal/xds/translator/testdata/in/xds-ir/jwt-with-backend-tls-retry.yaml b/internal/xds/translator/testdata/in/xds-ir/jwt-with-backend-tls-retry.yaml
index f1ba24346..ca4e8e284 100644
--- a/internal/xds/translator/testdata/in/xds-ir/jwt-with-backend-tls-retry.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/jwt-with-backend-tls-retry.yaml
@@ -75,3 +75,4 @@ http:
                   - gateway-error
                   - reset
             uri: https://foo.bar.com/jwt/public-key/jwks.json
+            cacheDuration: 300s
diff --git a/internal/xds/translator/testdata/in/xds-ir/oidc-and-jwt-with-passthrough.yaml b/internal/xds/translator/testdata/in/xds-ir/oidc-and-jwt-with-passthrough.yaml
index 4cddbaafd..b93364c10 100644
--- a/internal/xds/translator/testdata/in/xds-ir/oidc-and-jwt-with-passthrough.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/oidc-and-jwt-with-passthrough.yaml
@@ -28,6 +28,7 @@ http:
                 name: example1
                 remoteJWKS:
                   uri: https://oauth.foo.com/jwt/public-key/jwks.json
+                  cacheDuration: 300s
               - issuer: https://oauth.foo.com
                 name: example2
                 extractFrom:
@@ -37,6 +38,7 @@ http:
                     - name: MyHeaderNoPrefix
                 remoteJWKS:
                   uri: https://oauth.foo.com/jwt/public-key/jwks.json
+                  cacheDuration: 300s
               - issuer: https://oauth.foo.com
                 name: example3
                 extractFrom:
@@ -45,6 +47,7 @@ http:
                     - Cookie1
                 remoteJWKS:
                   uri: https://oauth.foo.com/jwt/public-key/jwks.json
+                  cacheDuration: 300s
               - issuer: https://oauth.foo.com
                 name: example4
                 extractFrom:
@@ -53,6 +56,7 @@ http:
                     - Param1
                 remoteJWKS:
                   uri: https://oauth.foo.com/jwt/public-key/jwks.json
+                  cacheDuration: 300s
           oidc:
             clientID: client.oauth.foo.com
             clientSecret: Y2xpZW50MTpzZWNyZXQK
diff --git a/internal/xds/translator/testdata/in/xds-ir/securitypolicy-with-oidc-jwt-authz.yaml b/internal/xds/translator/testdata/in/xds-ir/securitypolicy-with-oidc-jwt-authz.yaml
index f3e839938..a9352668d 100644
--- a/internal/xds/translator/testdata/in/xds-ir/securitypolicy-with-oidc-jwt-authz.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/securitypolicy-with-oidc-jwt-authz.yaml
@@ -61,6 +61,7 @@ http:
           name: exjwt
           remoteJWKS:
             uri: https://oidc.example.com/auth/realms/example/protocol/openid-connect/certs
+            cacheDuration: 300s
       oidc:
         clientID: prometheus
         clientSecret: '[redacted]'
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 070d62c4d..113e45648 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -4370,6 +4370,7 @@ _Appears in:_
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
 | `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `uri` | _string_ |  true  |  | URI is the HTTPS URI to fetch the JWKS. Envoy's system trust bundle is used to validate the server certificate.<br />If a custom trust bundle is needed, it can be specified in a BackendTLSConfig resource and target the BackendRefs. |
+| `cacheDuration` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | 300s |  |
 
 
 #### ReplaceRegexMatch
diff --git a/test/benchmark/config/nighthawk-client.yaml b/test/benchmark/config/nighthawk-client.yaml
index 35553eda6..6d689a203 100644
--- a/test/benchmark/config/nighthawk-client.yaml
+++ b/test/benchmark/config/nighthawk-client.yaml
@@ -9,7 +9,7 @@ spec:
     spec:
       containers:
         - name: nighthawk-client
-          image: envoyproxy/nighthawk-dev:latest
+          image: envoyproxy/nighthawk-dev:6198df0e01dc85f8d5efa3ef188f3bcdcc6eecac
           imagePullPolicy: IfNotPresent
           command:
             - /usr/local/bin/nighthawk_client
diff --git a/test/benchmark/config/nighthawk-test-server.yaml b/test/benchmark/config/nighthawk-test-server.yaml
index 75fa0bfbd..c1ce968e6 100644
--- a/test/benchmark/config/nighthawk-test-server.yaml
+++ b/test/benchmark/config/nighthawk-test-server.yaml
@@ -17,7 +17,7 @@ spec:
       serviceAccountName: default
       containers:
         - name: nighthawk-server
-          image: envoyproxy/nighthawk-dev:latest
+          image: envoyproxy/nighthawk-dev:6198df0e01dc85f8d5efa3ef188f3bcdcc6eecac
           imagePullPolicy: IfNotPresent
           args: ["-c", "/etc/test-server-config/nighthawk-test-server-config.yaml"]
           ports:
diff --git a/test/e2e/testdata/jwt-backend-remote-jwks.yaml b/test/e2e/testdata/jwt-backend-remote-jwks.yaml
index 17c335df4..816541ac2 100644
--- a/test/e2e/testdata/jwt-backend-remote-jwks.yaml
+++ b/test/e2e/testdata/jwt-backend-remote-jwks.yaml
@@ -152,6 +152,7 @@ spec:
               retryOn:
                 triggers: ["5xx", "gateway-error", "reset"]
           uri: https://remote-jwks-server.gateway-conformance-infra/jwt/jwks.json
+          cacheDuration: 300s
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
diff --git a/test/e2e/testdata/jwt.yaml b/test/e2e/testdata/jwt.yaml
index 32b1d96dc..46e10602e 100644
--- a/test/e2e/testdata/jwt.yaml
+++ b/test/e2e/testdata/jwt.yaml
@@ -21,6 +21,7 @@ spec:
             header: x-name
         remoteJWKS:
           uri: http://static-file-server.gateway-conformance-infra/jwt/jwks.json
+          cacheDuration: 300s
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
diff --git a/test/e2e/testdata/oidc-securitypolicy.yaml b/test/e2e/testdata/oidc-securitypolicy.yaml
index 37aaafcdd..4477fd739 100644
--- a/test/e2e/testdata/oidc-securitypolicy.yaml
+++ b/test/e2e/testdata/oidc-securitypolicy.yaml
@@ -85,6 +85,8 @@ spec:
     - name: "keycloak"  # This is needed so JWTs generated through the OIDC flow can be validated
       remoteJWKS:
         uri: "http://keycloak.gateway-conformance-infra/realms/master/protocol/openid-connect/certs"
+        cacheDuration: 300s
     - name: "example"  # This allows us to use the static JWTs in the test
       remoteJWKS:
         uri: "http://static-file-server.gateway-conformance-infra/jwt/jwks.json"
+        cacheDuration: 300s
diff --git a/test/e2e/tests/oidc.go b/test/e2e/tests/oidc.go
index f1be90267..2e7e1de2a 100644
--- a/test/e2e/tests/oidc.go
+++ b/test/e2e/tests/oidc.go
@@ -111,15 +111,7 @@ var OIDCTest = suite.ConformanceTest{
 				t.Run(tc.GetTestCaseName(i), func(t *testing.T) {
 					t.Parallel()
 
-					req := gwhttp.MakeRequest(t, &tc, gwAddr, "HTTP", "http")
-					cReq, cResp, err := suite.RoundTripper.CaptureRoundTrip(req)
-					if err != nil {
-						t.Errorf("failed to get expected response: %v", err)
-					}
-
-					if err := gwhttp.CompareRequest(t, &req, cReq, cResp, tc); err != nil {
-						t.Errorf("failed to compare request and response: %v", err)
-					}
+					gwhttp.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, tc)
 				})
 			}
 		})
diff --git a/test/e2e/tests/udproute.go b/test/e2e/tests/udproute.go
index a63936256..6174917d5 100644
--- a/test/e2e/tests/udproute.go
+++ b/test/e2e/tests/udproute.go
@@ -75,12 +75,12 @@ type GatewayRef struct {
 
 // NewGatewayRef creates a GatewayRef resource.  ListenerNames are optional.
 func NewGatewayRef(nn types.NamespacedName, listenerNames ...string) GatewayRef {
-	var listeners []*gwapiv1.SectionName
-
 	if len(listenerNames) == 0 {
 		listenerNames = append(listenerNames, "")
 	}
 
+	listeners := make([]*gwapiv1.SectionName, 0, len(listenerNames))
+
 	for _, listener := range listenerNames {
 		sectionName := gwapiv1.SectionName(listener)
 		listeners = append(listeners, &sectionName)
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
index 518673af3..4ec1931a6 100644
--- a/test/helm/gateway-crds-helm/all.out.yaml
+++ b/test/helm/gateway-crds-helm/all.out.yaml
@@ -43575,6 +43575,13 @@ spec:
                                       type: object
                                   type: object
                               type: object
+                            cacheDuration:
+                              default: 300s
+                              description: |-
+                                Duration is a string value representing a duration in time. The format is as specified
+                                in GEP-2257, a strict subset of the syntax parsed by Golang time.ParseDuration.
+                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                              type: string
                             uri:
                               description: |-
                                 URI is the HTTPS URI to fetch the JWKS. Envoy's system trust bundle is used to validate the server certificate.
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
index a34779284..8875240ca 100644
--- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
+++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
@@ -26263,6 +26263,13 @@ spec:
                                       type: object
                                   type: object
                               type: object
+                            cacheDuration:
+                              default: 300s
+                              description: |-
+                                Duration is a string value representing a duration in time. The format is as specified
+                                in GEP-2257, a strict subset of the syntax parsed by Golang time.ParseDuration.
+                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                              type: string
                             uri:
                               description: |-
                                 URI is the HTTPS URI to fetch the JWKS. Envoy's system trust bundle is used to validate the server certificate.