Repository: kubernetes-sigs/gateway-api

Issue:
The grpc implementation is incorrect here - the limit was never raised.
              The grpc implementation is incorrect here - the limit was never raised.

_Originally posted by @howardjohn in https://github.com/kubernetes-sigs/gateway-api/issues/3205#issuecomment-2550219888_
            

Hints from issue comments:
@robscott: /kind bug@EyalPazz: /assign

Solution patch:
diff --git a/.gitignore b/.gitignore
index 4db4fef3..79a29af6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -56,4 +56,3 @@ go.work.sum
 /cache
 .venv/
 release/
-site-src/geps
diff --git a/.openvex/templates/README.md b/.openvex/templates/README.md
index d724e1d0..3961ecf7 100644
--- a/.openvex/templates/README.md
+++ b/.openvex/templates/README.md
@@ -14,7 +14,7 @@ vexctl add --in-place main.openvex.json pkg:oci/test CVE-2014-1234567 fixed
 That will add a new VEX statement expressing that the impact of
 CVE-2014-1234567 is under investigation in the test image. When
 cutting a new release, for `pkg:oci/test` the new file will be
-incorporated to the relase's VEX data.
+incorporated to the release's VEX data.
 
 ## Read more about OpenVEX
 
diff --git a/CHANGELOG/0.x-CHANGELOG.md b/CHANGELOG/0.x-CHANGELOG.md
index 20f76c65..e5f80df8 100644
--- a/CHANGELOG/0.x-CHANGELOG.md
+++ b/CHANGELOG/0.x-CHANGELOG.md
@@ -226,7 +226,7 @@ For more information refer to
 
 - Added the missing ReferenceGrant resource the kustomization.yaml for the
   standard channel (#2084, @howardjohn)
-- Webhook validation now ensures that BackendRefs can not be specified in the
+- Webhook validation now ensures that BackendRefs cannot be specified in the
   same HTTPRoute rule as a Redirect filter (#2161, @slayer321)
 - GRPCRoute: The default match has been removed as it was invalid (it only
   specified a type of "Exact" without a corresponding Service or Method). Note
@@ -407,7 +407,7 @@ For more information, refer to
 
 - Added the missing ReferenceGrant resource the kustomization.yaml for the
   standard channel (#2084, @howardjohn)
-- Webhook validation now ensures that BackendRefs can not be specified in the
+- Webhook validation now ensures that BackendRefs cannot be specified in the
   same HTTPRoute rule as a Redirect filter (#2161, @slayer321)
 
 # v0.7.1
@@ -1089,7 +1089,7 @@ In this release, we've made two release channels available, `experimental` and
 `standard`.
 
 The `experimental` channel contains all resources and fields, while `standard`
-contains only resources that mave moved to beta status.
+contains only resources that have moved to beta status.
 
 We've also added a way to flag particular fields within a resource as
 experimental, and any fields marked in this way are only present in the
@@ -1274,7 +1274,7 @@ In this release, we've made two release channels available, `experimental` and
 `standard`.
 
 The `experimental` channel contains all resources and fields, while `standard`
-contains only resources that mave moved to beta status.
+contains only resources that have moved to beta status.
 
 We've also added a way to flag particular fields within a resource as
 experimental, and any fields marked in this way are only present in the
diff --git a/CHANGELOG/1.0-CHANGELOG.md b/CHANGELOG/1.0-CHANGELOG.md
index 25520bb4..f8793097 100644
--- a/CHANGELOG/1.0-CHANGELOG.md
+++ b/CHANGELOG/1.0-CHANGELOG.md
@@ -142,7 +142,7 @@ Of course there's a lot more in this release:
 - The condition reason `GatewayReasonAddressNotUsable` for `Programmed` has been
   added to deal with situations where a static address has been provided for a
   Gateway which is of a supported type, and is syntactically valid, but for some
-  reason it can not be used for this Gateway (e.g. the address is already in use
+  reason it cannot be used for this Gateway (e.g. the address is already in use
   on the network).
   (#2412 @shaneutt)
 
@@ -332,7 +332,7 @@ Of course there's a lot more in this release:
 - The condition reason `GatewayReasonAddressNotUsable` for `Programmed` has been
   added to deal with situations where a static address has been provided for a
   Gateway which is of a supported type, and is syntactically valid, but for some
-  reason it can not be used for this Gateway (e.g. the address is already in use
+  reason it cannot be used for this Gateway (e.g. the address is already in use
   on the network).
   (#2412 @shaneutt)
 
diff --git a/CHANGELOG/1.2-CHANGELOG.md b/CHANGELOG/1.2-CHANGELOG.md
index 3d614756..ee260c64 100644
--- a/CHANGELOG/1.2-CHANGELOG.md
+++ b/CHANGELOG/1.2-CHANGELOG.md
@@ -864,7 +864,7 @@ The Experimental `supportedFeatures` field in GatewayClass `status` has changed
 from being a list of strings to being a list of objects/structs with a `name`
 field.
 
-This is to allow addding in extra information to each entry at a later date.
+This is to allow adding in extra information to each entry at a later date.
 
 Relevant PRs:
 
diff --git a/CHANGELOG/1.2-TEAM.md b/CHANGELOG/1.2-TEAM.md
index f52ba700..ebd6283d 100644
--- a/CHANGELOG/1.2-TEAM.md
+++ b/CHANGELOG/1.2-TEAM.md
@@ -7,7 +7,7 @@
 | BackendProtocol Support | @dprotaso |
 | HTTPRoute Retries | @mikemorris |
 | Percentage-based request mirroring | @jakebennert |
-| Backend TLS Config improvments | @mkosieradzki, @LiorLieberman |
+| Backend TLS Config improvements | @mkosieradzki, @LiorLieberman |
 | Named Route Rules | @guicassolato, @howardjohn |
 | Conformance Profiles and Reports | @mlavacca, @shaneutt, @xtineskim |
 | Gateway API Maintainers | @mlavacca, @robscott, @shaneutt, @youngnick  |
diff --git a/Makefile b/Makefile
index 7ef6a2a4..4bde1cc5 100644
--- a/Makefile
+++ b/Makefile
@@ -92,16 +92,16 @@ test.crds-validation:
 conformance:
 	go test ${GO_TEST_FLAGS} -v ./conformance -run TestConformance -args ${CONFORMANCE_FLAGS}
 	
-# Install CRD's and example resources to a pre-existing cluster.
+# Install CRD's and example resources to a preexisting cluster.
 .PHONY: install
 install: crd example
 
-# Install the CRD's to a pre-existing cluster.
+# Install the CRD's to a preexisting cluster.
 .PHONY: crd
 crd:
 	kubectl kustomize config/crd | kubectl apply -f -
 
-# Install the example resources to a pre-existing cluster.
+# Install the example resources to a preexisting cluster.
 .PHONY: example
 example:
 	hack/install-examples.sh
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index ab602b55..8bdeafe2 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -4,6 +4,7 @@
 aliases:
   # Reference: https://github.com/kubernetes/org/blob/main/OWNERS_ALIASES
   sig-network-leads:
+    - aojea
     - danwinship
     - shaneutt
     - thockin
diff --git a/RELEASE.md b/RELEASE.md
index 307f33f5..d7275836 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -70,7 +70,7 @@ The following steps must be done by one of the [Gateway API maintainers][gateway
 - Run the `make build-install-yaml` command which will generate install files in the `release/` directory.
   Attach these files to the GitHub release.
 - Update the `README.md` and `site-src/guides/index.md` files to point links and examples to the new release.
-- Update the implementation table path (`nav.Implementations.Comparison`) in the nav of `mkdocs.yml` to point to the latest release file (for example Implementation Comparison points to `implmenetation-table-v1.2.0.md`). Add the now past version under `Past Version Comparisons`, and edit the text blurb in `mkdocs-generate-conformance.py` to also reflect the added past version.
+- Update the implementation table path (`nav.Implementations.Comparison`) in the nav of `mkdocs.yml` to point to the latest release file (for example Implementation Comparison points to `implementation-table-v1.2.0.md`). Add the now past version under `Past Version Comparisons`, and edit the text blurb in `mkdocs-generate-conformance.py` to also reflect the added past version.
 
 #### For an **RC** release:
 - Update `pkg/consts/consts.go` with the new semver tag (like `v1.2.0-rc1`) and any updates to the API review URL.
diff --git a/apis/v1/gateway_types.go b/apis/v1/gateway_types.go
index 83af1c45..e2cf5967 100644
--- a/apis/v1/gateway_types.go
+++ b/apis/v1/gateway_types.go
@@ -223,6 +223,8 @@ type GatewaySpec struct {
 	// Implementations MAY merge separate Gateways onto a single set of
 	// Addresses if all Listeners across all Gateways are compatible.
 	//
+	// In a future release the MinItems=1 requirement MAY be dropped.
+	//
 	// Support: Core
 	//
 	// +listType=map
@@ -279,6 +281,48 @@ type GatewaySpec struct {
 	// +optional
 	// <gateway:experimental>
 	BackendTLS *GatewayBackendTLS `json:"backendTLS,omitempty"`
+
+	// AllowedListeners defines which ListenerSets can be attached to this Gateway.
+	// While this feature is experimental, the default value is to allow no ListenerSets.
+	//
+	// <gateway:experimental>
+	//
+	// +optional
+	AllowedListeners *AllowedListeners `json:"allowedListeners,omitempty"`
+}
+
+// AllowedListeners defines which ListenerSets can be attached to this Gateway.
+type AllowedListeners struct {
+	// Namespaces defines which namespaces ListenerSets can be attached to this Gateway.
+	// While this feature is experimental, the default value is to allow no ListenerSets.
+	//
+	// +optional
+	// +kubebuilder:default={from: None}
+	Namespaces *ListenerNamespaces `json:"namespaces,omitempty"`
+}
+
+// ListenerNamespaces indicate which namespaces ListenerSets should be selected from.
+type ListenerNamespaces struct {
+	// From indicates where ListenerSets can attach to this Gateway. Possible
+	// values are:
+	//
+	// * Same: Only ListenerSets in the same namespace may be attached to this Gateway.
+	// * Selector: ListenerSets in namespaces selected by the selector may be attached to this Gateway.
+	// * All: ListenerSets in all namespaces may be attached to this Gateway.
+	// * None: Only listeners defined in the Gateway's spec are allowed
+	//
+	// While this feature is experimental, the default value None
+	//
+	// +optional
+	// +kubebuilder:default=None
+	From *FromNamespaces `json:"from,omitempty"`
+
+	// Selector must be specified when From is set to "Selector". In that case,
+	// only ListenerSets in Namespaces matching this Selector will be selected by this
+	// Gateway. This field is ignored for other values of "From".
+	//
+	// +optional
+	Selector *metav1.LabelSelector `json:"selector,omitempty"`
 }
 
 // Listener embodies the concept of a logical endpoint where a Gateway accepts
@@ -300,10 +344,31 @@ type Listener struct {
 	//
 	// * TLS: The Listener Hostname MUST match the SNI.
 	// * HTTP: The Listener Hostname MUST match the Host header of the request.
-	// * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
-	//   protocol layers as described above. If an implementation does not
-	//   ensure that both the SNI and Host header match the Listener hostname,
-	//   it MUST clearly document that.
+	// * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.
+	//   Note that this does not require the SNI and Host header to be the same.
+	//   The semantics of this are described in more detail below.
+	//
+	// To ensure security, Section 11.1 of RFC-6066 emphasizes that server
+	// implementations that rely on SNI hostname matching MUST also verify
+	// hostnames within the application protocol.
+	//
+	// Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the
+	// reuse of a connection by responding with the HTTP 421 Misdirected Request
+	// status code. This indicates that the origin server has rejected the
+	// request because it appears to have been misdirected.
+	//
+	// To detect misdirected requests, Gateways SHOULD match the authority of
+	// the requests with all the SNI hostname(s) configured across all the
+	// Gateway Listeners on the same port and protocol:
+	//
+	// * If another Listener has an exact match or more specific wildcard entry,
+	//   the Gateway SHOULD return a 421.
+	// * If the current Listener (selected by SNI matching during ClientHello)
+	//   does not match the Host:
+	//     * If another Listener does match the Host the Gateway SHOULD return a
+	//       421.
+	//     * If no other Listener matches the Host, the Gateway MUST return a
+	//       404.
 	//
 	// For HTTPRoute and TLSRoute resources, there is an interaction with the
 	// `spec.hostnames` array. When both listener and route specify hostnames,
@@ -602,21 +667,23 @@ type AllowedRoutes struct {
 	Kinds []RouteGroupKind `json:"kinds,omitempty"`
 }
 
-// FromNamespaces specifies namespace from which Routes may be attached to a
+// FromNamespaces specifies namespace from which Routes/ListenerSets may be attached to a
 // Gateway.
 //
-// +kubebuilder:validation:Enum=All;Selector;Same
+// +kubebuilder:validation:Enum=All;Selector;Same;None
 type FromNamespaces string
 
 const (
-	// Routes in all namespaces may be attached to this Gateway.
+	// Routes/ListenerSets in all namespaces may be attached to this Gateway.
 	NamespacesFromAll FromNamespaces = "All"
-	// Only Routes in namespaces selected by the selector may be attached to
+	// Only Routes/ListenerSets in namespaces selected by the selector may be attached to
 	// this Gateway.
 	NamespacesFromSelector FromNamespaces = "Selector"
-	// Only Routes in the same namespace as the Gateway may be attached to this
+	// Only Routes/ListenerSets in the same namespace as the Gateway may be attached to this
 	// Gateway.
 	NamespacesFromSame FromNamespaces = "Same"
+	// No Routes/ListenerSets may be attached to this Gateway.
+	NamespacesFromNone FromNamespaces = "None"
 )
 
 // RouteNamespaces indicate which namespaces Routes should be selected from.
@@ -1230,6 +1297,62 @@ const (
 	ListenerReasonPending ListenerConditionReason = "Pending"
 )
 
+const (
+	// This condition indicates that TLS configuration within this Listener
+	// conflicts with TLS configuration in another Listener on the same port.
+	// This could happen for two reasons:
+	//
+	// 1) Overlapping Hostnames: Listener A matches *.example.com while Listener
+	//    B matches foo.example.com.
+	// B) Overlapping Certificates: Listener A contains a certificate with a
+	//    SAN for *.example.com, while Listener B contains a certificate with a
+	//    SAN for foo.example.com.
+	//
+	// This overlapping TLS configuration can be particularly problematic when
+	// combined with HTTP connection coalescing. When clients reuse connections
+	// using this technique, it can have confusing interactions with Gateway
+	// API, such as TLS configuration for one Listener getting used for a
+	// request reusing an existing connection that would not be used if the same
+	// request was initiating a new connection.
+	//
+	// Controllers MUST detect the presence of overlapping hostnames and MAY
+	// detect the presence of overlapping certificates.
+	//
+	// This condition MUST be set on all Listeners with overlapping TLS config.
+	// For example, consider the following listener - hostname mapping:
+	//
+	// A: foo.example.com
+	// B: foo.example.org
+	// C: *.example.com
+	//
+	// In the above example, Listeners A and C would have overlapping hostnames
+	// and therefore this condition should be set for Listeners A and C, but not
+	// B.
+	//
+	// Possible reasons for this condition to be True are:
+	//
+	// * "OverlappingHostnames"
+	// * "OverlappingCertificates"
+	//
+	// If a controller supports checking for both possible reasons and finds
+	// that both are true, it SHOULD set the "OverlappingCertificates" Reason.
+	//
+	// This is a negative polarity condition and MUST NOT be set when it is
+	// False.
+	//
+	// Controllers may raise this condition with other reasons, but should
+	// prefer to use the reasons listed above to improve interoperability.
+	ListenerConditionOverlappingTLSConfig ListenerConditionType = "OverlappingTLSConfig"
+
+	// This reason is used with the "OverlappingTLSConfig" condition when the
+	// condition is true.
+	ListenerReasonOverlappingHostnames ListenerConditionReason = "OverlappingHostnames"
+
+	// This reason is used with the "OverlappingTLSConfig" condition when the
+	// condition is true.
+	ListenerReasonOverlappingCertificates ListenerConditionReason = "OverlappingCertificates"
+)
+
 const (
 	// "Ready" is a condition type reserved for future use. It should not be used by implementations.
 	// Note: This condition is not really "deprecated", but rather "reserved"; however, deprecated triggers Go linters
diff --git a/apis/v1/grpcroute_types.go b/apis/v1/grpcroute_types.go
index 953ba024..0cae5e50 100644
--- a/apis/v1/grpcroute_types.go
+++ b/apis/v1/grpcroute_types.go
@@ -210,7 +210,7 @@ type GRPCRouteRule struct {
 	// the above criteria.
 	//
 	// +optional
-	// +kubebuilder:validation:MaxItems=8
+	// +kubebuilder:validation:MaxItems=64
 	Matches []GRPCRouteMatch `json:"matches,omitempty"`
 
 	// Filters define the filters that are applied to requests that match
@@ -230,7 +230,7 @@ type GRPCRouteRule struct {
 	// Specifying the same filter multiple times is not supported unless explicitly
 	// indicated in the filter.
 	//
-	// If an implementation can not support a combination of filters, it must clearly
+	// If an implementation cannot support a combination of filters, it must clearly
 	// document that limitation. In cases where incompatible or unsupported
 	// filters are specified and cause the `Accepted` condition to be set to status
 	// `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -551,7 +551,7 @@ type GRPCRouteFilter struct {
 	//
 	// +optional
 	//
-	// <gateway:experimental:validation:XValidation:message="Only one of percent or fraction may be specified in HTTPRequestMirrorFilter",rule="!(has(self.percent) && has(self.fraction))">
+	// +kubebuilder:validation:XValidation:message="Only one of percent or fraction may be specified in HTTPRequestMirrorFilter",rule="!(has(self.percent) && has(self.fraction))"
 	RequestMirror *HTTPRequestMirrorFilter `json:"requestMirror,omitempty"`
 
 	// ExtensionRef is an optional, implementation-specific extension to the
diff --git a/apis/v1/httproute_types.go b/apis/v1/httproute_types.go
index a185e370..5021b7ac 100644
--- a/apis/v1/httproute_types.go
+++ b/apis/v1/httproute_types.go
@@ -210,7 +210,7 @@ type HTTPRouteRule struct {
 	// they are specified.
 	//
 	// Implementations MAY choose to implement this ordering strictly, rejecting
-	// any combination or order of filters that can not be supported. If implementations
+	// any combination or order of filters that cannot be supported. If implementations
 	// choose a strict interpretation of filter ordering, they MUST clearly document
 	// that behavior.
 	//
@@ -232,7 +232,7 @@ type HTTPRouteRule struct {
 	//
 	// All filters are expected to be compatible with each other except for the
 	// URLRewrite and RequestRedirect filters, which may not be combined. If an
-	// implementation can not support other combinations of filters, they must clearly
+	// implementation cannot support other combinations of filters, they must clearly
 	// document that limitation. In cases where incompatible or unsupported
 	// filters are specified and cause the `Accepted` condition to be set to status
 	// `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -487,7 +487,7 @@ const (
 	PathMatchExact PathMatchType = "Exact"
 
 	// Matches based on a URL path prefix split by `/`. Matching is
-	// case sensitive and done on a path element by element basis. A
+	// case-sensitive and done on a path element by element basis. A
 	// path element refers to the list of labels in the path split by
 	// the `/` separator. When specified, a trailing `/` is ignored.
 	//
@@ -596,7 +596,7 @@ type HTTPHeaderMatch struct {
 	Type *HeaderMatchType `json:"type,omitempty"`
 
 	// Name is the name of the HTTP Header to be matched. Name matching MUST be
-	// case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+	// case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 	//
 	// If multiple entries specify equivalent header names, only the first
 	// entry with an equivalent name MUST be considered for a match. Subsequent
@@ -701,6 +701,9 @@ type HTTPQueryParamMatch struct {
 // +kubebuilder:validation:Enum=GET;HEAD;POST;PUT;DELETE;CONNECT;OPTIONS;TRACE;PATCH
 type HTTPMethod string
 
+// +kubebuilder:validation:Enum=GET;HEAD;POST;PUT;DELETE;CONNECT;OPTIONS;TRACE;PATCH;*
+type HTTPMethodWithWildcard string
+
 const (
 	HTTPMethodGet     HTTPMethod = "GET"
 	HTTPMethodHead    HTTPMethod = "HEAD"
@@ -787,6 +790,8 @@ type HTTPRouteMatch struct {
 // +kubebuilder:validation:XValidation:message="filter.requestRedirect must be specified for RequestRedirect filter.type",rule="!(!has(self.requestRedirect) && self.type == 'RequestRedirect')"
 // +kubebuilder:validation:XValidation:message="filter.urlRewrite must be nil if the filter.type is not URLRewrite",rule="!(has(self.urlRewrite) && self.type != 'URLRewrite')"
 // +kubebuilder:validation:XValidation:message="filter.urlRewrite must be specified for URLRewrite filter.type",rule="!(!has(self.urlRewrite) && self.type == 'URLRewrite')"
+// <gateway:experimental:validation:XValidation:message="filter.cors must be nil if the filter.type is not CORS",rule="!(has(self.cors) && self.type != 'CORS')">
+// <gateway:experimental:validation:XValidation:message="filter.cors must be specified for CORS filter.type",rule="!(!has(self.cors) && self.type == 'CORS')">
 // +kubebuilder:validation:XValidation:message="filter.extensionRef must be nil if the filter.type is not ExtensionRef",rule="!(has(self.extensionRef) && self.type != 'ExtensionRef')"
 // +kubebuilder:validation:XValidation:message="filter.extensionRef must be specified for ExtensionRef filter.type",rule="!(!has(self.extensionRef) && self.type == 'ExtensionRef')"
 type HTTPRouteFilter struct {
@@ -825,6 +830,7 @@ type HTTPRouteFilter struct {
 	//
 	// +unionDiscriminator
 	// +kubebuilder:validation:Enum=RequestHeaderModifier;ResponseHeaderModifier;RequestMirror;RequestRedirect;URLRewrite;ExtensionRef
+	// <gateway:experimental:validation:Enum=RequestHeaderModifier;ResponseHeaderModifier;RequestMirror;RequestRedirect;URLRewrite;ExtensionRef;CORS>
 	Type HTTPRouteFilterType `json:"type"`
 
 	// RequestHeaderModifier defines a schema for a filter that modifies request
@@ -855,7 +861,7 @@ type HTTPRouteFilter struct {
 	//
 	// +optional
 	//
-	// <gateway:experimental:validation:XValidation:message="Only one of percent or fraction may be specified in HTTPRequestMirrorFilter",rule="!(has(self.percent) && has(self.fraction))">
+	// +kubebuilder:validation:XValidation:message="Only one of percent or fraction may be specified in HTTPRequestMirrorFilter",rule="!(has(self.percent) && has(self.fraction))"
 	RequestMirror *HTTPRequestMirrorFilter `json:"requestMirror,omitempty"`
 
 	// RequestRedirect defines a schema for a filter that responds to the
@@ -873,6 +879,15 @@ type HTTPRouteFilter struct {
 	// +optional
 	URLRewrite *HTTPURLRewriteFilter `json:"urlRewrite,omitempty"`
 
+	// CORS defines a schema for a filter that responds to the
+	// cross-origin request based on HTTP response header.
+	//
+	// Support: Extended
+	//
+	// +optional
+	// <gateway:experimental>
+	CORS *HTTPCORSFilter `json:"cors,omitempty"`
+
 	// ExtensionRef is an optional, implementation-specific extension to the
 	// "filter" behavior.  For example, resource "myroutefilter" in group
 	// "networking.example.net"). ExtensionRef MUST NOT be used for core and
@@ -935,6 +950,15 @@ const (
 	// Support in HTTPBackendRef: Extended
 	HTTPRouteFilterRequestMirror HTTPRouteFilterType = "RequestMirror"
 
+	// HTTPRouteFilterCORS can be used to add CORS headers to an
+	// HTTP response before it is sent to the client.
+	//
+	// Support in HTTPRouteRule: Extended
+	//
+	// Support in HTTPBackendRef: Extended
+	// <gateway:experimental>
+	HTTPRouteFilterCORS HTTPRouteFilterType = "CORS"
+
 	// HTTPRouteFilterExtensionRef should be used for configuring custom
 	// HTTP filters.
 	//
@@ -947,7 +971,7 @@ const (
 // HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.
 type HTTPHeader struct {
 	// Name is the name of the HTTP Header to be matched. Name matching MUST be
-	// case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+	// case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 	//
 	// If multiple entries specify equivalent header names, the first entry with
 	// an equivalent name MUST be considered for a match. Subsequent entries
@@ -1263,7 +1287,6 @@ type HTTPRequestMirrorFilter struct {
 	// +optional
 	// +kubebuilder:validation:Minimum=0
 	// +kubebuilder:validation:Maximum=100
-	// <gateway:experimental>
 	Percent *int32 `json:"percent,omitempty"`
 
 	// Fraction represents the fraction of requests that should be
@@ -1273,10 +1296,223 @@ type HTTPRequestMirrorFilter struct {
 	// is specified, 100% of requests will be mirrored.
 	//
 	// +optional
-	// <gateway:experimental>
 	Fraction *Fraction `json:"fraction,omitempty"`
 }
 
+// HTTPCORSFilter defines a filter that that configures Cross-Origin Request
+// Sharing (CORS).
+type HTTPCORSFilter struct {
+	// AllowOrigins indicates whether the response can be shared with requested
+	// resource from the given `Origin`.
+	//
+	// The `Origin` consists of a scheme and a host, with an optional port, and
+	// takes the form `<scheme>://<host>(:<port>)`.
+	//
+	// Valid values for scheme are: `http` and `https`.
+	//
+	// Valid values for port are any integer between 1 and 65535 (the list of
+	// available TCP/UDP ports). Note that, if not included, port `80` is
+	// assumed for `http` scheme origins, and port `443` is assumed for `https`
+	// origins. This may affect origin matching.
+	//
+	// The host part of the origin may contain the wildcard character `*`. These
+	// wildcard characters behave as follows:
+	//
+	// * `*` is a greedy match to the _left_, including any number of
+	//   DNS labels to the left of its position. This also means that
+	//   `*` will include any number of period `.` characters to the
+	//   left of its position.
+	// * A wildcard by itself matches all hosts.
+	//
+	// An origin value that includes _only_ the `*` character indicates requests
+	// from all `Origin`s are allowed.
+	//
+	// When the `AllowOrigins` field is configured with multiple origins, it
+	// means the server supports clients from multiple origins. If the request
+	// `Origin` matches the configured allowed origins, the gateway must return
+	// the given `Origin` and sets value of the header
+	// `Access-Control-Allow-Origin` same as the `Origin` header provided by the
+	// client.
+	//
+	// The status code of a successful response to a "preflight" request is
+	// always an OK status (i.e., 204 or 200).
+	//
+	// If the request `Origin` does not match the configured allowed origins,
+	// the gateway returns 204/200 response but doesn't set the relevant
+	// cross-origin response headers. Alternatively, the gateway responds with
+	// 403 status to the "preflight" request is denied, coupled with omitting
+	// the CORS headers. The cross-origin request fails on the client side.
+	// Therefore, the client doesn't attempt the actual cross-origin request.
+	//
+	// The `Access-Control-Allow-Origin` response header can only use `*`
+	// wildcard as value when the `AllowCredentials` field is unspecified.
+	//
+	// When the `AllowCredentials` field is specified and `AllowOrigins` field
+	// specified with the `*` wildcard, the gateway must return a single origin
+	// in the value of the `Access-Control-Allow-Origin` response header,
+	// instead of specifying the `*` wildcard. The value of the header
+	// `Access-Control-Allow-Origin` is same as the `Origin` header provided by
+	// the client.
+	//
+	// Support: Extended
+	// +listType=set
+	// +kubebuilder:validation:MaxItems=64
+	AllowOrigins []AbsoluteURI `json:"allowOrigins,omitempty"`
+
+	// AllowCredentials indicates whether the actual cross-origin request allows
+	// to include credentials.
+	//
+	// The only valid value for the `Access-Control-Allow-Credentials` response
+	// header is true (case-sensitive).
+	//
+	// If the credentials are not allowed in cross-origin requests, the gateway
+	// will omit the header `Access-Control-Allow-Credentials` entirely rather
+	// than setting its value to false.
+	//
+	// Support: Extended
+	//
+	// +optional
+	AllowCredentials TrueField `json:"allowCredentials,omitempty"`
+
+	// AllowMethods indicates which HTTP methods are supported for accessing the
+	// requested resource.
+	//
+	// Valid values are any method defined by RFC9110, along with the special
+	// value `*`, which represents all HTTP methods are allowed.
+	//
+	// Method names are case sensitive, so these values are also case-sensitive.
+	// (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
+	//
+	// Multiple method names in the value of the `Access-Control-Allow-Methods`
+	// response header are separated by a comma (",").
+	//
+	// A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
+	// (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The
+	// CORS-safelisted methods are always allowed, regardless of whether they
+	// are specified in the `AllowMethods` field.
+	//
+	// When the `AllowMethods` field is configured with one or more methods, the
+	// gateway must return the `Access-Control-Allow-Methods` response header
+	// which value is present in the `AllowMethods` field.
+	//
+	// If the HTTP method of the `Access-Control-Request-Method` request header
+	// is not included in the list of methods specified by the response header
+	// `Access-Control-Allow-Methods`, it will present an error on the client
+	// side.
+	//
+	// The `Access-Control-Allow-Methods` response header can only use `*`
+	// wildcard as value when the `AllowCredentials` field is unspecified.
+	//
+	// When the `AllowCredentials` field is specified and `AllowMethods` field
+	// specified with the `*` wildcard, the gateway must specify one HTTP method
+	// in the value of the Access-Control-Allow-Methods response header. The
+	// value of the header `Access-Control-Allow-Methods` is same as the
+	// `Access-Control-Request-Method` header provided by the client. If the
+	// header `Access-Control-Request-Method` is not included in the request,
+	// the gateway will omit the `Access-Control-Allow-Methods` response header,
+	// instead of specifying the `*` wildcard. A Gateway implementation may
+	// choose to add implementation-specific default methods.
+	//
+	// Support: Extended
+	//
+	// +listType=set
+	// +kubebuilder:validation:MaxItems=9
+	AllowMethods []HTTPMethodWithWildcard `json:"allowMethods,omitempty"`
+
+	// AllowHeaders indicates which HTTP request headers are supported for
+	// accessing the requested resource.
+	//
+	// Header names are not case sensitive.
+	//
+	// Multiple header names in the value of the `Access-Control-Allow-Headers`
+	// response header are separated by a comma (",").
+	//
+	// When the `AllowHeaders` field is configured with one or more headers, the
+	// gateway must return the `Access-Control-Allow-Headers` response header
+	// which value is present in the `AllowHeaders` field.
+	//
+	// If any header name in the `Access-Control-Request-Headers` request header
+	// is not included in the list of header names specified by the response
+	// header `Access-Control-Allow-Headers`, it will present an error on the
+	// client side.
+	//
+	// If any header name in the `Access-Control-Allow-Headers` response header
+	// does not recognize by the client, it will also occur an error on the
+	// client side.
+	//
+	// A wildcard indicates that the requests with all HTTP headers are allowed.
+	// The `Access-Control-Allow-Headers` response header can only use `*`
+	// wildcard as value when the `AllowCredentials` field is unspecified.
+	//
+	// When the `AllowCredentials` field is specified and `AllowHeaders` field
+	// specified with the `*` wildcard, the gateway must specify one or more
+	// HTTP headers in the value of the `Access-Control-Allow-Headers` response
+	// header. The value of the header `Access-Control-Allow-Headers` is same as
+	// the `Access-Control-Request-Headers` header provided by the client. If
+	// the header `Access-Control-Request-Headers` is not included in the
+	// request, the gateway will omit the `Access-Control-Allow-Headers`
+	// response header, instead of specifying the `*` wildcard. A Gateway
+	// implementation may choose to add implementation-specific default headers.
+	//
+	// Support: Extended
+	//
+	// +listType=set
+	// +kubebuilder:validation:MaxItems=64
+	AllowHeaders []HTTPHeaderName `json:"allowHeaders,omitempty"`
+
+	// ExposeHeaders indicates which HTTP response headers can be exposed
+	// to client-side scripts in response to a cross-origin request.
+	//
+	// A CORS-safelisted response header is an HTTP header in a CORS response
+	// that it is considered safe to expose to the client scripts.
+	// The CORS-safelisted response headers include the following headers:
+	// `Cache-Control`
+	// `Content-Language`
+	// `Content-Length`
+	// `Content-Type`
+	// `Expires`
+	// `Last-Modified`
+	// `Pragma`
+	// (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name)
+	// The CORS-safelisted response headers are exposed to client by default.
+	//
+	// When an HTTP header name is specified using the `ExposeHeaders` field,
+	// this additional header will be exposed as part of the response to the
+	// client.
+	//
+	// Header names are not case sensitive.
+	//
+	// Multiple header names in the value of the `Access-Control-Expose-Headers`
+	// response header are separated by a comma (",").
+	//
+	// A wildcard indicates that the responses with all HTTP headers are exposed
+	// to clients. The `Access-Control-Expose-Headers` response header can only
+	// use `*` wildcard as value when the `AllowCredentials` field is
+	// unspecified.
+	//
+	// Support: Extended
+	//
+	// +optional
+	// +listType=set
+	// +kubebuilder:validation:MaxItems=64
+	ExposeHeaders []HTTPHeaderName `json:"exposeHeaders,omitempty"`
+
+	// MaxAge indicates the duration (in seconds) for the client to cache the
+	// results of a "preflight" request.
+	//
+	// The information provided by the `Access-Control-Allow-Methods` and
+	// `Access-Control-Allow-Headers` response headers can be cached by the
+	// client until the time specified by `Access-Control-Max-Age` elapses.
+	//
+	// The default value of `Access-Control-Max-Age` response header is 5
+	// (seconds).
+	//
+	// +optional
+	// +kubebuilder:default=5
+	// +kubebuilder:validation:Minimum=1
+	MaxAge int32 `json:"maxAge,omitempty"`
+}
+
 // HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.
 //
 // Note that when a namespace different than the local namespace is specified, a
diff --git a/apis/v1/object_reference_types.go b/apis/v1/object_reference_types.go
index 421572ac..dd507b21 100644
--- a/apis/v1/object_reference_types.go
+++ b/apis/v1/object_reference_types.go
@@ -156,7 +156,7 @@ type BackendObjectReference struct {
 // on the containing object.
 type ObjectReference struct {
 	// Group is the group of the referent. For example, "gateway.networking.k8s.io".
-	// When unspecified or empty string, core API group is inferred.
+	// When set to the empty string, core API group is inferred.
 	Group Group `json:"group"`
 
 	// Kind is kind of the referent. For example "ConfigMap" or "Service".
diff --git a/apis/v1/shared_types.go b/apis/v1/shared_types.go
index 998c7793..e059b981 100644
--- a/apis/v1/shared_types.go
+++ b/apis/v1/shared_types.go
@@ -469,7 +469,7 @@ type RouteParentStatus struct {
 	// There are a number of cases where the "Accepted" condition may not be set
 	// due to lack of controller visibility, that includes when:
 	//
-	// * The Route refers to a non-existent parent.
+	// * The Route refers to a nonexistent parent.
 	// * The Route is of a type that the controller does not support.
 	// * The Route is in a namespace the controller does not have access to.
 	//
@@ -675,7 +675,7 @@ type GatewayController string
 // Invalid values include:
 //
 // * example~ - "~" is an invalid character
-// * example.com. - can not start or end with "."
+// * example.com. - cannot start or end with "."
 //
 // +kubebuilder:validation:MinLength=1
 // +kubebuilder:validation:MaxLength=253
@@ -705,7 +705,7 @@ type AnnotationValue string
 // Invalid values include:
 //
 // * example~ - "~" is an invalid character
-// * example.com. - can not start or end with "."
+// * example.com. - cannot start or end with "."
 //
 // +kubebuilder:validation:MinLength=1
 // +kubebuilder:validation:MaxLength=253
@@ -764,6 +764,11 @@ type HeaderName string
 // +kubebuilder:validation:Pattern=`^([0-9]{1,5}(h|m|s|ms)){1,4}$`
 type Duration string
 
+// TrueField is a boolean value that can only be set to true
+//
+// +kubebuilder:validation:Enum=true
+type TrueField bool
+
 const (
 	// A textual representation of a numeric IP address. IPv4
 	// addresses must be in dotted-decimal form. IPv6 addresses
@@ -771,7 +776,7 @@ const (
 	// (see [RFC 5952](https://tools.ietf.org/html/rfc5952)).
 	//
 	// This type is intended for specific addresses. Address ranges are not
-	// supported (e.g. you can not use a CIDR range like 127.0.0.0/24 as an
+	// supported (e.g. you cannot use a CIDR range like 127.0.0.0/24 as an
 	// IPAddress).
 	//
 	// Support: Extended
diff --git a/apis/v1/zz_generated.deepcopy.go b/apis/v1/zz_generated.deepcopy.go
index 62fb99b0..f0c7e1f8 100644
--- a/apis/v1/zz_generated.deepcopy.go
+++ b/apis/v1/zz_generated.deepcopy.go
@@ -25,6 +25,26 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AllowedListeners) DeepCopyInto(out *AllowedListeners) {
+	*out = *in
+	if in.Namespaces != nil {
+		in, out := &in.Namespaces, &out.Namespaces
+		*out = new(ListenerNamespaces)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AllowedListeners.
+func (in *AllowedListeners) DeepCopy() *AllowedListeners {
+	if in == nil {
+		return nil
+	}
+	out := new(AllowedListeners)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AllowedRoutes) DeepCopyInto(out *AllowedRoutes) {
 	*out = *in
@@ -747,6 +767,11 @@ func (in *GatewaySpec) DeepCopyInto(out *GatewaySpec) {
 		*out = new(GatewayBackendTLS)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.AllowedListeners != nil {
+		in, out := &in.AllowedListeners, &out.AllowedListeners
+		*out = new(AllowedListeners)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GatewaySpec.
@@ -877,6 +902,41 @@ func (in *HTTPBackendRef) DeepCopy() *HTTPBackendRef {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPCORSFilter) DeepCopyInto(out *HTTPCORSFilter) {
+	*out = *in
+	if in.AllowOrigins != nil {
+		in, out := &in.AllowOrigins, &out.AllowOrigins
+		*out = make([]AbsoluteURI, len(*in))
+		copy(*out, *in)
+	}
+	if in.AllowMethods != nil {
+		in, out := &in.AllowMethods, &out.AllowMethods
+		*out = make([]HTTPMethodWithWildcard, len(*in))
+		copy(*out, *in)
+	}
+	if in.AllowHeaders != nil {
+		in, out := &in.AllowHeaders, &out.AllowHeaders
+		*out = make([]HTTPHeaderName, len(*in))
+		copy(*out, *in)
+	}
+	if in.ExposeHeaders != nil {
+		in, out := &in.ExposeHeaders, &out.ExposeHeaders
+		*out = make([]HTTPHeaderName, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPCORSFilter.
+func (in *HTTPCORSFilter) DeepCopy() *HTTPCORSFilter {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPCORSFilter)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HTTPHeader) DeepCopyInto(out *HTTPHeader) {
 	*out = *in
@@ -1133,6 +1193,11 @@ func (in *HTTPRouteFilter) DeepCopyInto(out *HTTPRouteFilter) {
 		*out = new(HTTPURLRewriteFilter)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.CORS != nil {
+		in, out := &in.CORS, &out.CORS
+		*out = new(HTTPCORSFilter)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.ExtensionRef != nil {
 		in, out := &in.ExtensionRef, &out.ExtensionRef
 		*out = new(LocalObjectReference)
@@ -1431,6 +1496,31 @@ func (in *Listener) DeepCopy() *Listener {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenerNamespaces) DeepCopyInto(out *ListenerNamespaces) {
+	*out = *in
+	if in.From != nil {
+		in, out := &in.From, &out.From
+		*out = new(FromNamespaces)
+		**out = **in
+	}
+	if in.Selector != nil {
+		in, out := &in.Selector, &out.Selector
+		*out = new(metav1.LabelSelector)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenerNamespaces.
+func (in *ListenerNamespaces) DeepCopy() *ListenerNamespaces {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenerNamespaces)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ListenerStatus) DeepCopyInto(out *ListenerStatus) {
 	*out = *in
diff --git a/apis/v1alpha2/shared_types.go b/apis/v1alpha2/shared_types.go
index af04601e..2fb84d5f 100644
--- a/apis/v1alpha2/shared_types.go
+++ b/apis/v1alpha2/shared_types.go
@@ -313,7 +313,7 @@ type GatewayController = v1.GatewayController
 // Invalid values include:
 //
 // * example~ - "~" is an invalid character
-// * example.com. - can not start or end with "."
+// * example.com. - cannot start or end with "."
 //
 // +kubebuilder:validation:MinLength=1
 // +kubebuilder:validation:MaxLength=253
@@ -360,7 +360,7 @@ const (
 	// (see [RFC 5952](https://tools.ietf.org/html/rfc5952)).
 	//
 	// This type is intended for specific addresses. Address ranges are not
-	// supported (e.g. you can not use a CIDR range like 127.0.0.0/24 as an
+	// supported (e.g. you cannot use a CIDR range like 127.0.0.0/24 as an
 	// IPAddress).
 	//
 	// Support: Extended
diff --git a/apis/v1alpha2/tcproute_types.go b/apis/v1alpha2/tcproute_types.go
index b79253dd..e383af49 100644
--- a/apis/v1alpha2/tcproute_types.go
+++ b/apis/v1alpha2/tcproute_types.go
@@ -67,7 +67,7 @@ type TCPRouteRule struct {
 	Name *SectionName `json:"name,omitempty"`
 
 	// BackendRefs defines the backend(s) where matching requests should be
-	// sent. If unspecified or invalid (refers to a non-existent resource or a
+	// sent. If unspecified or invalid (refers to a nonexistent resource or a
 	// Service with no endpoints), the underlying implementation MUST actively
 	// reject connection attempts to this backend. Connection rejections must
 	// respect weight; if an invalid backend is requested to have 80% of
diff --git a/apis/v1alpha2/tlsroute_types.go b/apis/v1alpha2/tlsroute_types.go
index 26dfde77..f21fe3fc 100644
--- a/apis/v1alpha2/tlsroute_types.go
+++ b/apis/v1alpha2/tlsroute_types.go
@@ -108,7 +108,7 @@ type TLSRouteRule struct {
 	Name *SectionName `json:"name,omitempty"`
 
 	// BackendRefs defines the backend(s) where matching requests should be
-	// sent. If unspecified or invalid (refers to a non-existent resource or
+	// sent. If unspecified or invalid (refers to a nonexistent resource or
 	// a Service with no endpoints), the rule performs no forwarding; if no
 	// filters are specified that would result in a response being sent, the
 	// underlying implementation must actively reject request attempts to this
diff --git a/apis/v1alpha2/udproute_types.go b/apis/v1alpha2/udproute_types.go
index 9e7fe3ff..c7e92b92 100644
--- a/apis/v1alpha2/udproute_types.go
+++ b/apis/v1alpha2/udproute_types.go
@@ -67,7 +67,7 @@ type UDPRouteRule struct {
 	Name *SectionName `json:"name,omitempty"`
 
 	// BackendRefs defines the backend(s) where matching requests should be
-	// sent. If unspecified or invalid (refers to a non-existent resource or a
+	// sent. If unspecified or invalid (refers to a nonexistent resource or a
 	// Service with no endpoints), the underlying implementation MUST actively
 	// reject connection attempts to this backend. Packet drops must
 	// respect weight; if an invalid backend is requested to have 80% of
diff --git a/apis/v1alpha3/backendtlspolicy_types.go b/apis/v1alpha3/backendtlspolicy_types.go
index dd52d5d1..394fa46c 100644
--- a/apis/v1alpha3/backendtlspolicy_types.go
+++ b/apis/v1alpha3/backendtlspolicy_types.go
@@ -112,7 +112,7 @@ type BackendTLSPolicyValidation struct {
 	//
 	// If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
 	// specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
-	// not both. If CACertifcateRefs is empty or unspecified, the configuration for
+	// not both. If CACertificateRefs is empty or unspecified, the configuration for
 	// WellKnownCACertificates MUST be honored instead if supported by the implementation.
 	//
 	// References to a resource in a different namespace are invalid for the
@@ -151,7 +151,7 @@ type BackendTLSPolicyValidation struct {
 	// backends:
 	//
 	// 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
-	// 2. If SubjectAltNames is not specified, Hostname MUST be used for
+	// 2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.
 	//    authentication and MUST match the certificate served by the matching
 	//    backend.
 	//
@@ -159,10 +159,10 @@ type BackendTLSPolicyValidation struct {
 	Hostname v1.PreciseHostname `json:"hostname"`
 
 	// SubjectAltNames contains one or more Subject Alternative Names.
-	// When specified, the certificate served from the backend MUST have at least one
-	// Subject Alternate Name matching one of the specified SubjectAltNames.
+	// When specified the certificate served from the backend MUST
+	// have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
 	//
-	// Support: Core
+	// Support: Extended
 	//
 	// +optional
 	// +kubebuilder:validation:MaxItems=5
diff --git a/apis/v1beta1/shared_types.go b/apis/v1beta1/shared_types.go
index 2dfbb926..3dbcc280 100644
--- a/apis/v1beta1/shared_types.go
+++ b/apis/v1beta1/shared_types.go
@@ -313,7 +313,7 @@ type GatewayController = v1.GatewayController
 // Invalid values include:
 //
 // * example~ - "~" is an invalid character
-// * example.com. - can not start or end with "."
+// * example.com. - cannot start or end with "."
 //
 // +kubebuilder:validation:MinLength=1
 // +kubebuilder:validation:MaxLength=253
@@ -360,7 +360,7 @@ const (
 	// (see [RFC 5952](https://tools.ietf.org/html/rfc5952)).
 	//
 	// This type is intended for specific addresses. Address ranges are not
-	// supported (e.g. you can not use a CIDR range like 127.0.0.0/24 as an
+	// supported (e.g. you cannot use a CIDR range like 127.0.0.0/24 as an
 	// IPAddress).
 	//
 	// Support: Extended
diff --git a/apisx/doc.go b/apisx/doc.go
new file mode 100644
index 00000000..5d5d1194
--- /dev/null
+++ b/apisx/doc.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apisx
diff --git a/apisx/v1alpha1/backendtrafficpolicy_types.go b/apisx/v1alpha1/backendtrafficpolicy_types.go
new file mode 100644
index 00000000..802decd4
--- /dev/null
+++ b/apisx/v1alpha1/backendtrafficpolicy_types.go
@@ -0,0 +1,159 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+// +kubebuilder:resource:categories=gateway-api,shortName=btrafficpolicy
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+//
+// BackendTrafficPolicy is a Direct Attached Policy.
+// +kubebuilder:metadata:labels="gateway.networking.k8s.io/policy=Direct"
+
+// BackendTrafficPolicy defines the configuration for how traffic to a
+// target backend should be handled.
+type BackendTrafficPolicy struct {
+	// Support: Extended
+	//
+	// +optional
+
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec defines the desired state of BackendTrafficPolicy.
+	Spec BackendTrafficPolicySpec `json:"spec"`
+
+	// Status defines the current state of BackendTrafficPolicy.
+	Status PolicyStatus `json:"status,omitempty"`
+}
+
+// BackendTrafficPolicyList contains a list of BackendTrafficPolicies
+// +kubebuilder:object:root=true
+type BackendTrafficPolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []BackendTrafficPolicy `json:"items"`
+}
+
+// BackendTrafficPolicySpec define the desired state of BackendTrafficPolicy
+// Note: there is no Override or Default policy configuration.
+type BackendTrafficPolicySpec struct {
+	// TargetRefs identifies API object(s) to apply this policy to.
+	// Currently, Backends (A grouping of like endpoints such as Service,
+	// ServiceImport, or any implementation-specific backendRef) are the only
+	// valid API target references.
+	//
+	// Currently, a TargetRef can not be scoped to a specific port on a
+	// Service.
+	//
+	// +listType=map
+	// +listMapKey=group
+	// +listMapKey=kind
+	// +listMapKey=name
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=16
+	TargetRefs []LocalPolicyTargetReference `json:"targetRefs"`
+
+	// RetryConstraint defines the configuration for when to allow or prevent
+	// further retries to a target backend, by dynamically calculating a 'retry
+	// budget'. This budget is calculated based on the percentage of incoming
+	// traffic composed of retries over a given time interval. Once the budget
+	// is exceeded, additional retries will be rejected.
+	//
+	// For example, if the retry budget interval is 10 seconds, there have been
+	// 1000 active requests in the past 10 seconds, and the allowed percentage
+	// of requests that can be retried is 20% (the default), then 200 of those
+	// requests may be composed of retries. Active requests will only be
+	// considered for the duration of the interval when calculating the retry
+	// budget. Retrying the same original request multiple times within the
+	// retry budget interval will lead to each retry being counted towards
+	// calculating the budget.
+	//
+	// Configuring a RetryConstraint in BackendTrafficPolicy is compatible with
+	// HTTPRoute Retry settings for each HTTPRouteRule that targets the same
+	// backend. While the HTTPRouteRule Retry stanza can specify whether a
+	// request will be retried, and the number of retry attempts each client
+	// may perform, RetryConstraint helps prevent cascading failures such as
+	// retry storms during periods of consistent failures.
+	//
+	// After the retry budget has been exceeded, additional retries to the
+	// backend MUST return a 503 response to the client.
+	//
+	// Additional configurations for defining a constraint on retries MAY be
+	// defined in the future.
+	//
+	// Support: Extended
+	//
+	// +optional
+	// <gateway:experimental>
+	RetryConstraint *RetryConstraint `json:"retryConstraint,omitempty"`
+
+	// SessionPersistence defines and configures session persistence
+	// for the backend.
+	//
+	// Support: Extended
+	//
+	// +optional
+	SessionPersistence *SessionPersistence `json:"sessionPersistence,omitempty"`
+}
+
+// RetryConstraint defines the configuration for when to retry a request.
+type RetryConstraint struct {
+	// BudgetPercent defines the maximum percentage of active requests that may
+	// be made up of retries.
+	//
+	// Support: Extended
+	//
+	// +optional
+	// +kubebuilder:default=20
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=100
+	BudgetPercent *int `json:"budgetPercent,omitempty"`
+
+	// BudgetInterval defines the duration in which requests will be considered
+	// for calculating the budget for retries.
+	//
+	// Support: Extended
+	//
+	// +optional
+	// +kubebuilder:default="10s"
+	// +kubebuilder:validation:XValidation:message="budgetInterval can not be greater than one hour or less than one second",rule="!(duration(self) < duration('1s') || duration(self) > duration('1h'))"
+	BudgetInterval *Duration `json:"budgetInterval,omitempty"`
+
+	// MinRetryRate defines the minimum rate of retries that will be allowable
+	// over a specified duration of time.
+	//
+	// The effective overall minimum rate of retries targeting the backend
+	// service may be much higher, as there can be any number of clients which
+	// are applying this setting locally.
+	//
+	// This ensures that requests can still be retried during periods of low
+	// traffic, where the budget for retries may be calculated as a very low
+	// value.
+	//
+	// Support: Extended
+	//
+	// +optional
+	// +kubebuilder:default={count: 10, interval: "1s"}
+	MinRetryRate *RequestRate `json:"minRetryRate,omitempty"`
+}
diff --git a/apisx/v1alpha1/doc.go b/apisx/v1alpha1/doc.go
new file mode 100644
index 00000000..f347614f
--- /dev/null
+++ b/apisx/v1alpha1/doc.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1alpha1 contains API Schema definitions for the gateway.networking.k8s-x.io
+// API group.
+//
+// +k8s:openapi-gen=true
+// +kubebuilder:object:generate=true
+// +groupName=gateway.networking.x-k8s.io
+// +groupGoName=Experimental
+package v1alpha1
diff --git a/apisx/v1alpha1/listenerset_types.go b/apisx/v1alpha1/listenerset_types.go
new file mode 100644
index 00000000..a46cc3ab
--- /dev/null
+++ b/apisx/v1alpha1/listenerset_types.go
@@ -0,0 +1,589 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:categories=gateway-api,shortName=lset
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+// +kubebuilder:printcolumn:name="Accepted",type=string,JSONPath=`.status.conditions[?(@.type=="Accepted")].status`
+// +kubebuilder:printcolumn:name="Programmed",type=string,JSONPath=`.status.conditions[?(@.type=="Programmed")].status`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+
+// ListenerSet defines a set of additional listeners
+// to attach to an existing Gateway.
+type ListenerSet struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec defines the desired state of ListenerSet.
+	Spec ListenerSetSpec `json:"spec"`
+
+	// Status defines the current state of ListenerSet.
+	//
+	// +kubebuilder:default={conditions: {{type: "Accepted", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"},{type: "Programmed", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"}}}
+	Status ListenerSetStatus `json:"status,omitempty"`
+}
+
+// ListenerSetSpec defines the desired state of a ListenerSet.
+type ListenerSetSpec struct {
+	// ParentRef references the Gateway that the listeners are attached to.
+	ParentRef ParentGatewayReference `json:"parentRef"`
+
+	// Listeners associated with this ListenerSet. Listeners define
+	// logical endpoints that are bound on this referenced parent Gateway's addresses.
+	//
+	// Listeners in a `Gateway` and their attached `ListenerSets` are concatenated
+	// as a list when programming the underlying infrastructure. Each listener
+	// name does not need to be unique across the Gateway and ListenerSets.
+	// See ListenerEntry.Name for more details.
+	//
+	// Implementations MUST treat the parent Gateway as having the merged
+	// list of all listeners from itself and attached ListenerSets using
+	// the following precedence:
+	//
+	// 1. "parent" Gateway
+	// 2. ListenerSet ordered by creation time (oldest first)
+	// 3. ListenerSet ordered alphabetically by “{namespace}/{name}”.
+	//
+	// An implementation MAY reject listeners by setting the ListenerEntryStatus
+	// `Accepted`` condition to False with the Reason `TooManyListeners`
+	//
+	// If a listener has a conflict, this will be reported in the
+	// Status.ListenerEntryStatus setting the `Conflicted` condition to True.
+	//
+	// Implementations SHOULD be cautious about what information from the
+	// parent or siblings are reported to avoid accidentally leaking
+	// sensitive information that the child would not otherwise have access
+	// to. This can include contents of secrets etc.
+	//
+	// +listType=map
+	// +listMapKey=name
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=64
+	// +kubebuilder:validation:XValidation:message="tls must not be specified for protocols ['HTTP', 'TCP', 'UDP']",rule="self.all(l, l.protocol in ['HTTP', 'TCP', 'UDP'] ? !has(l.tls) : true)"
+	// +kubebuilder:validation:XValidation:message="tls mode must be Terminate for protocol HTTPS",rule="self.all(l, (l.protocol == 'HTTPS' && has(l.tls)) ? (l.tls.mode == '' || l.tls.mode == 'Terminate') : true)"
+	// +kubebuilder:validation:XValidation:message="hostname must not be specified for protocols ['TCP', 'UDP']",rule="self.all(l, l.protocol in ['TCP', 'UDP']  ? (!has(l.hostname) || l.hostname == '') : true)"
+	// +kubebuilder:validation:XValidation:message="Listener name must be unique within the Gateway",rule="self.all(l1, self.exists_one(l2, l1.name == l2.name))"
+	// +kubebuilder:validation:XValidation:message="Combination of port, protocol and hostname must be unique for each listener",rule="self.all(l1, !has(l1.port) || self.exists_one(l2, has(l2.port) && l1.port == l2.port && l1.protocol == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))"
+	Listeners []ListenerEntry `json:"listeners"`
+}
+
+type ListenerEntry struct {
+	// Name is the name of the Listener. This name MUST be unique within a
+	// ListenerSet.
+	//
+	// Name is not required to be unique across a Gateway and ListenerSets.
+	// Routes can attach to a Listener by having a ListenerSet as a parentRef
+	// and setting the SectionName
+	Name SectionName `json:"name"`
+
+	// Hostname specifies the virtual hostname to match for protocol types that
+	// define this concept. When unspecified, all hostnames are matched. This
+	// field is ignored for protocols that don't require hostname based
+	// matching.
+	//
+	// Implementations MUST apply Hostname matching appropriately for each of
+	// the following protocols:
+	//
+	// * TLS: The Listener Hostname MUST match the SNI.
+	// * HTTP: The Listener Hostname MUST match the Host header of the request.
+	// * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
+	//   protocol layers as described above. If an implementation does not
+	//   ensure that both the SNI and Host header match the Listener hostname,
+	//   it MUST clearly document that.
+	//
+	// For HTTPRoute and TLSRoute resources, there is an interaction with the
+	// `spec.hostnames` array. When both listener and route specify hostnames,
+	// there MUST be an intersection between the values for a Route to be
+	// accepted. For more information, refer to the Route specific Hostnames
+	// documentation.
+	//
+	// Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
+	// as a suffix match. That means that a match for `*.example.com` would match
+	// both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
+	//
+	// +optional
+	Hostname *Hostname `json:"hostname,omitempty"`
+
+	// Port is the network port. Multiple listeners may use the
+	// same port, subject to the Listener compatibility rules.
+	//
+	// +optional
+	Port PortNumber `json:"port,omitempty"`
+
+	// Protocol specifies the network protocol this listener expects to receive.
+	Protocol ProtocolType `json:"protocol"`
+
+	// TLS is the TLS configuration for the Listener. This field is required if
+	// the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
+	// if the Protocol field is "HTTP", "TCP", or "UDP".
+	//
+	// The association of SNIs to Certificate defined in GatewayTLSConfig is
+	// defined based on the Hostname field for this listener.
+	//
+	// The GatewayClass MUST use the longest matching SNI out of all
+	// available certificates for any TLS handshake.
+	//
+	// +optional
+	TLS *GatewayTLSConfig `json:"tls,omitempty"`
+
+	// AllowedRoutes defines the types of routes that MAY be attached to a
+	// Listener and the trusted namespaces where those Route resources MAY be
+	// present.
+	//
+	// Although a client request may match multiple route rules, only one rule
+	// may ultimately receive the request. Matching precedence MUST be
+	// determined in order of the following criteria:
+	//
+	// * The most specific match as defined by the Route type.
+	// * The oldest Route based on creation timestamp. For example, a Route with
+	//   a creation timestamp of "2020-09-08 01:02:03" is given precedence over
+	//   a Route with a creation timestamp of "2020-09-08 01:02:04".
+	// * If everything else is equivalent, the Route appearing first in
+	//   alphabetical order (namespace/name) should be given precedence. For
+	//   example, foo/bar is given precedence over foo/baz.
+	//
+	// All valid rules within a Route attached to this Listener should be
+	// implemented. Invalid Route rules can be ignored (sometimes that will mean
+	// the full Route). If a Route rule transitions from valid to invalid,
+	// support for that Route rule should be dropped to ensure consistency. For
+	// example, even if a filter specified by a Route rule is invalid, the rest
+	// of the rules within that Route should still be supported.
+	//
+	// +kubebuilder:default={namespaces:{from: Same}}
+	// +optional
+	AllowedRoutes *AllowedRoutes `json:"allowedRoutes,omitempty"`
+}
+
+type ListenerSetStatus struct {
+	// Conditions describe the current conditions of the ListenerSet.
+	//
+	// Implementations MUST express ListenerSet conditions using the
+	// `ListenerSetConditionType` and `ListenerSetConditionReason`
+	// constants so that operators and tools can converge on a common
+	// vocabulary to describe ListenerSet state.
+	//
+	// Known condition types are:
+	//
+	// * "Accepted"
+	// * "Programmed"
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=type
+	// +kubebuilder:validation:MaxItems=8
+	// +kubebuilder:default={{type: "Accepted", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"},{type: "Programmed", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"}}
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+
+	// Listeners provide status for each unique listener port defined in the Spec.
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +kubebuilder:validation:MaxItems=64
+	Listeners []ListenerEntryStatus `json:"listeners,omitempty"`
+}
+
+// ListenerStatus is the status associated with a Listener.
+type ListenerEntryStatus struct {
+	// Name is the name of the Listener that this status corresponds to.
+	Name SectionName `json:"name"`
+
+	// Port is the network port the listener is configured to listen on.
+	Port PortNumber `json:"port"`
+
+	// SupportedKinds is the list indicating the Kinds supported by this
+	// listener. This MUST represent the kinds an implementation supports for
+	// that Listener configuration.
+	//
+	// If kinds are specified in Spec that are not supported, they MUST NOT
+	// appear in this list and an implementation MUST set the "ResolvedRefs"
+	// condition to "False" with the "InvalidRouteKinds" reason. If both valid
+	// and invalid Route kinds are specified, the implementation MUST
+	// reference the valid Route kinds that have been specified.
+	//
+	// +kubebuilder:validation:MaxItems=8
+	SupportedKinds []RouteGroupKind `json:"supportedKinds"`
+
+	// AttachedRoutes represents the total number of Routes that have been
+	// successfully attached to this Listener.
+	//
+	// Successful attachment of a Route to a Listener is based solely on the
+	// combination of the AllowedRoutes field on the corresponding Listener
+	// and the Route's ParentRefs field. A Route is successfully attached to
+	// a Listener when it is selected by the Listener's AllowedRoutes field
+	// AND the Route has a valid ParentRef selecting the whole Gateway
+	// resource or a specific Listener as a parent resource (more detail on
+	// attachment semantics can be found in the documentation on the various
+	// Route kinds ParentRefs fields). Listener or Route status does not impact
+	// successful attachment, i.e. the AttachedRoutes field count MUST be set
+	// for Listeners with condition Accepted: false and MUST count successfully
+	// attached Routes that may themselves have Accepted: false conditions.
+	//
+	// Uses for this field include troubleshooting Route attachment and
+	// measuring blast radius/impact of changes to a Listener.
+	AttachedRoutes int32 `json:"attachedRoutes"`
+
+	// Conditions describe the current condition of this listener.
+	//
+	// +listType=map
+	// +listMapKey=type
+	// +kubebuilder:validation:MaxItems=8
+	Conditions []metav1.Condition `json:"conditions"`
+}
+
+// ListenerSetConditionType is a type of condition associated with a
+// ListenerSet. This type should be used with the ListenerSetStatus.Conditions
+// field.
+type ListenerSetConditionType string
+
+// ListenerSetConditionReason defines the set of reasons that explain why a
+// particular ListenerSet condition type has been raised.
+type ListenerSetConditionReason string
+
+const (
+	// This condition indicates whether a ListenerSet has generated some
+	// configuration that is assumed to be ready soon in the underlying data
+	// plane.
+	//
+	// It is a positive-polarity summary condition, and so should always be
+	// present on the resource with ObservedGeneration set.
+	//
+	// It should be set to Unknown if the controller performs updates to the
+	// status before it has all the information it needs to be able to determine
+	// if the condition is true.
+	//
+	// Possible reasons for this condition to be True are:
+	//
+	// * "Programmed"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "Invalid"
+	// * "ParentNotProgrammed"
+	//
+	// Additional reasons for this condition to be False are influenced by
+	// child ListenerEntry conditions:
+	//
+	// * "PortUnavailable"
+	//
+	// Possible reasons for this condition to be Unknown are:
+	//
+	// * "Pending"
+	//
+	// Controllers may raise this condition with other reasons,
+	// but should prefer to use the reasons listed above to improve
+	// interoperability.
+	ListenerSetConditionProgrammed ListenerSetConditionType = "Programmed"
+
+	// This reason is used with the "Programmed" condition when the condition is
+	// true.
+	ListenerSetReasonProgrammed ListenerSetConditionReason = "Programmed"
+)
+
+const (
+	// This condition is true when the controller managing the ListenerSet is
+	// syntactically and semantically valid enough to produce some configuration
+	// in the underlying data plane. This does not indicate whether or not the
+	// configuration has been propagated to the data plane.
+	//
+	// Possible reasons for this condition to be True are:
+	//
+	// * "Accepted"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "Invalid"
+	// * "NotAllowed"
+	// * "ParentNotAccepted"
+	// * "ListenersNotValid"
+	//
+	// Possible reasons for this condition to be Unknown are:
+	//
+	// * "Pending"
+	//
+	// Controllers may raise this condition with other reasons,
+	// but should prefer to use the reasons listed above to improve
+	// interoperability.
+	ListenerSetConditionAccepted ListenerSetConditionType = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the condition is
+	// True.
+	ListenerSetReasonAccepted ListenerSetConditionReason = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the
+	// ListenerSet is not allowed to be attached to the Gateway.
+	ListenerSetReasonNotAllowed ListenerSetConditionReason = "NotAllowed"
+
+	// This reason is used with the "Accepted" condition when the
+	// parent Gateway is not accepted.
+	ListenerSetReasonParentNotAccepted ListenerSetConditionReason = "ParentNotAccepted"
+
+	// This reason is used with the "Accepted" condition when one or
+	// more Listeners have an invalid or unsupported configuration
+	// and cannot be configured on the Gateway.
+	// This can be the reason when "Accepted" is "True" or "False", depending on whether
+	// the listener being invalid causes the entire Gateway to not be accepted.
+	ListenerSetReasonListenersNotValid ListenerSetConditionReason = "ListenersNotValid"
+)
+
+// Shared ListenerSet Reasons
+const (
+	// This reason is used with the "Programmed" and "Accepted" conditions when
+	// the ListenerSet is syntactically or semantically invalid. For example, this
+	// could include unspecified TLS configuration, or some unrecognized or
+	// invalid values in the TLS configuration.
+	ListenerSetReasonInvalid ListenerSetConditionReason = "Invalid"
+
+	// This reason is used with the "Accepted" and "Programmed"
+	// conditions when the status is "Unknown" and no controller has reconciled
+	// the Gateway.
+	ListenerSetReasonPending ListenerSetConditionReason = "Pending"
+)
+
+// ListenerEntryConditionType is a type of condition associated with the
+// listener. This type should be used with the ListenerEntryStatus.Conditions
+// field.
+type ListenerEntryConditionType string
+
+// ListenerEntryConditionReason defines the set of reasons that explain
+// why a particular ListenerEntry condition type has been raised.
+type ListenerEntryConditionReason string
+
+const (
+	// This condition indicates that the controller was unable to resolve
+	// conflicting specification requirements for this Listener. If a
+	// Listener is conflicted, its network port should not be configured
+	// on any network elements.
+	//
+	// Possible reasons for this condition to be true are:
+	//
+	// * "HostnameConflict"
+	// * "ProtocolConflict"
+	// * "ListenerConflict"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "NoConflicts"
+	//
+	// Controllers may raise this condition with other reasons,
+	// but should prefer to use the reasons listed above to improve
+	// interoperability.
+	ListenerEntryConditionConflicted ListenerEntryConditionType = "Conflicted"
+
+	// This reason is used with the "Conflicted" condition when
+	// the Listener conflicts with hostnames in other Listeners. For
+	// example, this reason would be used when multiple Listeners on
+	// the same port use `example.com` in the hostname field.
+	ListenerEntryReasonHostnameConflict ListenerEntryConditionReason = "HostnameConflict"
+
+	// This reason is used with the "Conflicted" condition when
+	// multiple Listeners are specified with the same Listener port
+	// number, but have conflicting protocol specifications.
+	ListenerEntryReasonProtocolConflict ListenerEntryConditionReason = "ProtocolConflict"
+
+	// This reason is used with the "Conflicted" condition when the condition
+	// is True.
+	//
+	// Implementations should prioritize surfacing the most specific conflict
+	// reason. For example, if a Listener is conflicted because it has the same
+	// port as another Listener, and it also has the same hostname as another
+	// Listener, the reason should be "ListenerConflict" and not
+	// "HostnameConflict" or "ProtocolConflict".
+	ListenerEntryReasonListenerConflict ListenerEntryConditionReason = "ListenerConflict"
+)
+
+const (
+	// This condition indicates that the listener is syntactically and
+	// semantically valid, and that all features used in the listener's spec are
+	// supported.
+	//
+	// In general, a Listener will be marked as Accepted when the supplied
+	// configuration will generate at least some data plane configuration.
+	//
+	// For example, a Listener with an unsupported protocol will never generate
+	// any data plane config, and so will have Accepted set to `false.`
+	// Conversely, a Listener that does not have any Routes will be able to
+	// generate data plane config, and so will have Accepted set to `true`.
+	//
+	// Possible reasons for this condition to be True are:
+	//
+	// * "Accepted"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "PortUnavailable"
+	// * "UnsupportedProtocol"
+	// * "TooManyListeners"
+	//
+	// Possible reasons for this condition to be Unknown are:
+	//
+	// * "Pending"
+	//
+	// Controllers may raise this condition with other reasons,
+	// but should prefer to use the reasons listed above to improve
+	// interoperability.
+	ListenerEntryConditionAccepted ListenerEntryConditionType = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the condition is
+	// True.
+	ListenerEntryReasonAccepted ListenerEntryConditionReason = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the
+	// Listener could not be attached to be Gateway because its
+	// protocol type is not supported.
+	ListenerEntryReasonUnsupportedProtocol ListenerEntryConditionReason = "UnsupportedProtocol"
+
+	// This reason is used with the "Accepted" condition when the
+	// Listener could not be attached to be Gateway because the Gateway
+	// has too many Listeners.
+	ListenerEntryReasonTooManyListeners ListenerEntryConditionReason = "TooManyListeners"
+)
+
+const (
+	// This condition indicates whether the controller was able to
+	// resolve all the object references for the Listener.
+	//
+	// Possible reasons for this condition to be true are:
+	//
+	// * "ResolvedRefs"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "InvalidCertificateRef"
+	// * "InvalidRouteKinds"
+	// * "RefNotPermitted"
+	//
+	// Controllers may raise this condition with other reasons,
+	// but should prefer to use the reasons listed above to improve
+	// interoperability.
+	ListenerEntryConditionResolvedRefs ListenerEntryConditionType = "ResolvedRefs"
+
+	// This reason is used with the "ResolvedRefs" condition when the condition
+	// is true.
+	ListenerEntryReasonResolvedRefs ListenerEntryConditionReason = "ResolvedRefs"
+
+	// This reason is used with the "ResolvedRefs" condition when the
+	// Listener has a TLS configuration with at least one TLS CertificateRef
+	// that is invalid or does not exist.
+	// A CertificateRef is considered invalid when it refers to a nonexistent
+	// or unsupported resource or kind, or when the data within that resource
+	// is malformed.
+	// This reason must be used only when the reference is allowed, either by
+	// referencing an object in the same namespace as the Gateway, or when
+	// a cross-namespace reference has been explicitly allowed by a ReferenceGrant.
+	// If the reference is not allowed, the reason RefNotPermitted must be used
+	// instead.
+	ListenerEntryReasonInvalidCertificateRef ListenerEntryConditionReason = "InvalidCertificateRef"
+
+	// This reason is used with the "ResolvedRefs" condition when an invalid or
+	// unsupported Route kind is specified by the Listener.
+	ListenerEntryReasonInvalidRouteKinds ListenerEntryConditionReason = "InvalidRouteKinds"
+
+	// This reason is used with the "ResolvedRefs" condition when the
+	// Listener has a TLS configuration that references an object in another
+	// namespace, where the object in the other namespace does not have a
+	// ReferenceGrant explicitly allowing the reference.
+	ListenerEntryReasonRefNotPermitted ListenerEntryConditionReason = "RefNotPermitted"
+)
+
+const (
+	// This condition indicates whether a Listener has generated some
+	// configuration that will soon be ready in the underlying data plane.
+	//
+	// It is a positive-polarity summary condition, and so should always be
+	// present on the resource with ObservedGeneration set.
+	//
+	// It should be set to Unknown if the controller performs updates to the
+	// status before it has all the information it needs to be able to determine
+	// if the condition is true.
+	//
+	// Possible reasons for this condition to be True are:
+	//
+	// * "Programmed"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "Invalid"
+	// * "PortUnavailable"
+	//
+	// Possible reasons for this condition to be Unknown are:
+	//
+	// * "Pending"
+	//
+	// Controllers may raise this condition with other reasons,
+	// but should prefer to use the reasons listed above to improve
+	// interoperability.
+	ListenerEntryConditionProgrammed ListenerEntryConditionType = "Programmed"
+
+	// This reason is used with the "Programmed" condition when the condition is
+	// true.
+	ListenerEntryReasonProgrammed ListenerEntryConditionReason = "Programmed"
+)
+
+// Shared ListenerEntry "Accepted" & "Programmed" Reasons
+const (
+	// This reason is used with the "Accepted" condition when the Listener
+	// requests a port that cannot be used on the Gateway. This reason could be
+	// used in a number of instances, including:
+	//
+	// * The port is already in use.
+	// * The port is not supported by the implementation.
+	// * The implementation is unable to assign the port to the Listener.
+	ListenerEntryReasonPortUnavailable ListenerEntryConditionReason = "PortUnavailable"
+
+	// This reason is used with the "Accepted" and "Programmed"
+	// conditions when the Listener is either not yet reconciled or not yet not
+	// online and ready to accept client traffic.
+	ListenerEntryReasonPending ListenerEntryConditionReason = "Pending"
+
+	// This reason is used with the "Accepted" and "Programmed" conditions when the
+	// Listener is syntactically or semantically invalid.
+	ListenerEntryReasonInvalid ListenerEntryConditionReason = "Invalid"
+)
+
+const (
+	// "Ready" is a condition type reserved for future use. It should not be used by implementations.
+	// Note: This condition is not really "deprecated", but rather "reserved"; however, deprecated triggers Go linters
+	// to alert about usage.
+	//
+	// If used in the future, "Ready" will represent the final state where all configuration is confirmed good
+	// _and has completely propagated to the data plane_. That is, it is a _guarantee_ that, as soon as something
+	// sees the Condition as `true`, then connections will be correctly routed _immediately_.
+	//
+	// This is a very strong guarantee, and to date no implementation has satisfied it enough to implement it.
+	// This reservation can be discussed in the future if necessary.
+	//
+	// Deprecated: Ready is reserved for future use
+	ListenerEntryConditionReady ListenerEntryConditionType = "Ready"
+
+	// Deprecated: Ready is reserved for future use
+	ListenerEntryReasonReady ListenerEntryConditionReason = "Ready"
+)
+
+// +kubebuilder:object:root=true
+type ListenerSetList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ListenerSet `json:"items"`
+}
diff --git a/apisx/v1alpha1/shared_types.go b/apisx/v1alpha1/shared_types.go
new file mode 100644
index 00000000..f811ace8
--- /dev/null
+++ b/apisx/v1alpha1/shared_types.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+type (
+	// +k8s:deepcopy-gen=false
+	AllowedRoutes = v1.AllowedRoutes
+	// +k8s:deepcopy-gen=false
+	GatewayTLSConfig = v1.GatewayTLSConfig
+	// +k8s:deepcopy-gen=false
+	Group = v1.Group
+	// +k8s:deepcopy-gen=false
+	Hostname = v1.Hostname
+	// +k8s:deepcopy-gen=false
+	Kind = v1.Kind
+	// +k8s:deepcopy-gen=false
+	ObjectName = v1.ObjectName
+	// +k8s:deepcopy-gen=false
+	PortNumber = v1.PortNumber
+	// +k8s:deepcopy-gen=false
+	ProtocolType = v1.ProtocolType
+	// +k8s:deepcopy-gen=false
+	RouteGroupKind = v1.RouteGroupKind
+	// +k8s:deepcopy-gen=false
+	SectionName = v1.SectionName
+	// +k8s:deepcopy-gen=false
+	Namespace = v1.Namespace
+	// +k8s:deepcopy-gen=false
+	Duration = v1.Duration
+	// +k8s:deepcopy-gen=false
+	PolicyStatus = v1alpha2.PolicyStatus
+	// +k8s:deepcopy-gen=false
+	LocalPolicyTargetReference = v1alpha2.LocalPolicyTargetReference
+	// +k8s:deepcopy-gen=false
+	SessionPersistence = v1.SessionPersistence
+)
+
+// ParentGatewayReference identifies an API object including its namespace,
+// defaulting to Gateway.
+type ParentGatewayReference struct {
+	// Group is the group of the referent.
+	//
+	// +optional
+	// +kubebuilder:default="gateway.networking.k8s.io"
+	Group *Group `json:"group"`
+
+	// Kind is kind of the referent. For example "Gateway".
+	//
+	// +optional
+	// +kubebuilder:default=Gateway
+	Kind *Kind `json:"kind"`
+
+	// Name is the name of the referent.
+	Name ObjectName `json:"name"`
+
+	// Namespace is the namespace of the referent.  If not present,
+	// the namespace of the referent is assumed to be the same as
+	// the namespace of the referring object.
+	//
+	// +optional
+	Namespace *Namespace `json:"namespace,omitempty"`
+}
+
+// RequestRate expresses a rate of requests over a given period of time.
+type RequestRate struct {
+	// Count specifies the number of requests per time interval.
+	//
+	// Support: Extended
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=1000000
+	Count *int `json:"count,omitempty"`
+
+	// Interval specifies the divisor of the rate of requests, the amount of
+	// time during which the given count of requests occur.
+	//
+	// Support: Extended
+	// +kubebuilder:validation:XValidation:message="interval can not be greater than one hour",rule="!(duration(self) == duration('0s') || duration(self) > duration('1h'))"
+	Interval *Duration `json:"interval,omitempty"`
+}
diff --git a/apisx/v1alpha1/zz_generated.deepcopy.go b/apisx/v1alpha1/zz_generated.deepcopy.go
new file mode 100644
index 00000000..985d4b3a
--- /dev/null
+++ b/apisx/v1alpha1/zz_generated.deepcopy.go
@@ -0,0 +1,372 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendTrafficPolicy) DeepCopyInto(out *BackendTrafficPolicy) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendTrafficPolicy.
+func (in *BackendTrafficPolicy) DeepCopy() *BackendTrafficPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendTrafficPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *BackendTrafficPolicy) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendTrafficPolicyList) DeepCopyInto(out *BackendTrafficPolicyList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]BackendTrafficPolicy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendTrafficPolicyList.
+func (in *BackendTrafficPolicyList) DeepCopy() *BackendTrafficPolicyList {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendTrafficPolicyList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *BackendTrafficPolicyList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendTrafficPolicySpec) DeepCopyInto(out *BackendTrafficPolicySpec) {
+	*out = *in
+	if in.TargetRefs != nil {
+		in, out := &in.TargetRefs, &out.TargetRefs
+		*out = make([]v1alpha2.LocalPolicyTargetReference, len(*in))
+		copy(*out, *in)
+	}
+	if in.RetryConstraint != nil {
+		in, out := &in.RetryConstraint, &out.RetryConstraint
+		*out = new(RetryConstraint)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.SessionPersistence != nil {
+		in, out := &in.SessionPersistence, &out.SessionPersistence
+		*out = new(v1.SessionPersistence)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendTrafficPolicySpec.
+func (in *BackendTrafficPolicySpec) DeepCopy() *BackendTrafficPolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendTrafficPolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenerEntry) DeepCopyInto(out *ListenerEntry) {
+	*out = *in
+	if in.Hostname != nil {
+		in, out := &in.Hostname, &out.Hostname
+		*out = new(v1.Hostname)
+		**out = **in
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(v1.GatewayTLSConfig)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.AllowedRoutes != nil {
+		in, out := &in.AllowedRoutes, &out.AllowedRoutes
+		*out = new(v1.AllowedRoutes)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenerEntry.
+func (in *ListenerEntry) DeepCopy() *ListenerEntry {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenerEntry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenerEntryStatus) DeepCopyInto(out *ListenerEntryStatus) {
+	*out = *in
+	if in.SupportedKinds != nil {
+		in, out := &in.SupportedKinds, &out.SupportedKinds
+		*out = make([]v1.RouteGroupKind, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenerEntryStatus.
+func (in *ListenerEntryStatus) DeepCopy() *ListenerEntryStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenerEntryStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenerSet) DeepCopyInto(out *ListenerSet) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenerSet.
+func (in *ListenerSet) DeepCopy() *ListenerSet {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenerSet)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ListenerSet) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenerSetList) DeepCopyInto(out *ListenerSetList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ListenerSet, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenerSetList.
+func (in *ListenerSetList) DeepCopy() *ListenerSetList {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenerSetList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ListenerSetList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenerSetSpec) DeepCopyInto(out *ListenerSetSpec) {
+	*out = *in
+	in.ParentRef.DeepCopyInto(&out.ParentRef)
+	if in.Listeners != nil {
+		in, out := &in.Listeners, &out.Listeners
+		*out = make([]ListenerEntry, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenerSetSpec.
+func (in *ListenerSetSpec) DeepCopy() *ListenerSetSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenerSetSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenerSetStatus) DeepCopyInto(out *ListenerSetStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Listeners != nil {
+		in, out := &in.Listeners, &out.Listeners
+		*out = make([]ListenerEntryStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenerSetStatus.
+func (in *ListenerSetStatus) DeepCopy() *ListenerSetStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenerSetStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ParentGatewayReference) DeepCopyInto(out *ParentGatewayReference) {
+	*out = *in
+	if in.Group != nil {
+		in, out := &in.Group, &out.Group
+		*out = new(v1.Group)
+		**out = **in
+	}
+	if in.Kind != nil {
+		in, out := &in.Kind, &out.Kind
+		*out = new(v1.Kind)
+		**out = **in
+	}
+	if in.Namespace != nil {
+		in, out := &in.Namespace, &out.Namespace
+		*out = new(v1.Namespace)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ParentGatewayReference.
+func (in *ParentGatewayReference) DeepCopy() *ParentGatewayReference {
+	if in == nil {
+		return nil
+	}
+	out := new(ParentGatewayReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestRate) DeepCopyInto(out *RequestRate) {
+	*out = *in
+	if in.Count != nil {
+		in, out := &in.Count, &out.Count
+		*out = new(int)
+		**out = **in
+	}
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestRate.
+func (in *RequestRate) DeepCopy() *RequestRate {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestRate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RetryConstraint) DeepCopyInto(out *RetryConstraint) {
+	*out = *in
+	if in.BudgetPercent != nil {
+		in, out := &in.BudgetPercent, &out.BudgetPercent
+		*out = new(int)
+		**out = **in
+	}
+	if in.BudgetInterval != nil {
+		in, out := &in.BudgetInterval, &out.BudgetInterval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MinRetryRate != nil {
+		in, out := &in.MinRetryRate, &out.MinRetryRate
+		*out = new(RequestRate)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RetryConstraint.
+func (in *RetryConstraint) DeepCopy() *RetryConstraint {
+	if in == nil {
+		return nil
+	}
+	out := new(RetryConstraint)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/apisx/v1alpha1/zz_generated.register.go b/apisx/v1alpha1/zz_generated.register.go
new file mode 100644
index 00000000..ecbd1092
--- /dev/null
+++ b/apisx/v1alpha1/zz_generated.register.go
@@ -0,0 +1,72 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "gateway.networking.x-k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = v1.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+// SchemeGroupVersion is group version used to register these objects
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&BackendTrafficPolicy{},
+		&BackendTrafficPolicyList{},
+		&ListenerSet{},
+		&ListenerSetList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	v1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/applyconfiguration/apis/v1/allowedlisteners.go b/applyconfiguration/apis/v1/allowedlisteners.go
new file mode 100644
index 00000000..61da03af
--- /dev/null
+++ b/applyconfiguration/apis/v1/allowedlisteners.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// AllowedListenersApplyConfiguration represents a declarative configuration of the AllowedListeners type for use
+// with apply.
+type AllowedListenersApplyConfiguration struct {
+	Namespaces *ListenerNamespacesApplyConfiguration `json:"namespaces,omitempty"`
+}
+
+// AllowedListenersApplyConfiguration constructs a declarative configuration of the AllowedListeners type for use with
+// apply.
+func AllowedListeners() *AllowedListenersApplyConfiguration {
+	return &AllowedListenersApplyConfiguration{}
+}
+
+// WithNamespaces sets the Namespaces field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespaces field is set to the value of the last call.
+func (b *AllowedListenersApplyConfiguration) WithNamespaces(value *ListenerNamespacesApplyConfiguration) *AllowedListenersApplyConfiguration {
+	b.Namespaces = value
+	return b
+}
diff --git a/apis/applyconfiguration/apis/v1/allowedroutes.go b/applyconfiguration/apis/v1/allowedroutes.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/allowedroutes.go
rename to applyconfiguration/apis/v1/allowedroutes.go
diff --git a/apis/applyconfiguration/apis/v1/backendobjectreference.go b/applyconfiguration/apis/v1/backendobjectreference.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/backendobjectreference.go
rename to applyconfiguration/apis/v1/backendobjectreference.go
diff --git a/apis/applyconfiguration/apis/v1/backendref.go b/applyconfiguration/apis/v1/backendref.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/backendref.go
rename to applyconfiguration/apis/v1/backendref.go
diff --git a/apis/applyconfiguration/apis/v1/commonroutespec.go b/applyconfiguration/apis/v1/commonroutespec.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/commonroutespec.go
rename to applyconfiguration/apis/v1/commonroutespec.go
diff --git a/apis/applyconfiguration/apis/v1/cookieconfig.go b/applyconfiguration/apis/v1/cookieconfig.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/cookieconfig.go
rename to applyconfiguration/apis/v1/cookieconfig.go
diff --git a/apis/applyconfiguration/apis/v1/fraction.go b/applyconfiguration/apis/v1/fraction.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/fraction.go
rename to applyconfiguration/apis/v1/fraction.go
diff --git a/apis/applyconfiguration/apis/v1/frontendtlsvalidation.go b/applyconfiguration/apis/v1/frontendtlsvalidation.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/frontendtlsvalidation.go
rename to applyconfiguration/apis/v1/frontendtlsvalidation.go
diff --git a/apis/applyconfiguration/apis/v1/gateway.go b/applyconfiguration/apis/v1/gateway.go
similarity index 99%
rename from apis/applyconfiguration/apis/v1/gateway.go
rename to applyconfiguration/apis/v1/gateway.go
index 8e8f27e6..965ae383 100644
--- a/apis/applyconfiguration/apis/v1/gateway.go
+++ b/applyconfiguration/apis/v1/gateway.go
@@ -23,8 +23,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	gatewayapiapisv1 "sigs.k8s.io/gateway-api/apis/v1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // GatewayApplyConfiguration represents a declarative configuration of the Gateway type for use
diff --git a/apis/applyconfiguration/apis/v1/gatewayaddress.go b/applyconfiguration/apis/v1/gatewayaddress.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/gatewayaddress.go
rename to applyconfiguration/apis/v1/gatewayaddress.go
diff --git a/apis/applyconfiguration/apis/v1/gatewaybackendtls.go b/applyconfiguration/apis/v1/gatewaybackendtls.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/gatewaybackendtls.go
rename to applyconfiguration/apis/v1/gatewaybackendtls.go
diff --git a/apis/applyconfiguration/apis/v1/gatewayclass.go b/applyconfiguration/apis/v1/gatewayclass.go
similarity index 99%
rename from apis/applyconfiguration/apis/v1/gatewayclass.go
rename to applyconfiguration/apis/v1/gatewayclass.go
index 7d1cfcbc..a356c501 100644
--- a/apis/applyconfiguration/apis/v1/gatewayclass.go
+++ b/applyconfiguration/apis/v1/gatewayclass.go
@@ -23,8 +23,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	gatewayapiapisv1 "sigs.k8s.io/gateway-api/apis/v1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // GatewayClassApplyConfiguration represents a declarative configuration of the GatewayClass type for use
diff --git a/apis/applyconfiguration/apis/v1/gatewayclassspec.go b/applyconfiguration/apis/v1/gatewayclassspec.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/gatewayclassspec.go
rename to applyconfiguration/apis/v1/gatewayclassspec.go
diff --git a/apis/applyconfiguration/apis/v1/gatewayclassstatus.go b/applyconfiguration/apis/v1/gatewayclassstatus.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/gatewayclassstatus.go
rename to applyconfiguration/apis/v1/gatewayclassstatus.go
diff --git a/apis/applyconfiguration/apis/v1/gatewayinfrastructure.go b/applyconfiguration/apis/v1/gatewayinfrastructure.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/gatewayinfrastructure.go
rename to applyconfiguration/apis/v1/gatewayinfrastructure.go
diff --git a/apis/applyconfiguration/apis/v1/gatewayspec.go b/applyconfiguration/apis/v1/gatewayspec.go
similarity index 87%
rename from apis/applyconfiguration/apis/v1/gatewayspec.go
rename to applyconfiguration/apis/v1/gatewayspec.go
index 89ff6b48..9ba7ecb2 100644
--- a/apis/applyconfiguration/apis/v1/gatewayspec.go
+++ b/applyconfiguration/apis/v1/gatewayspec.go
@@ -30,6 +30,7 @@ type GatewaySpecApplyConfiguration struct {
 	Addresses        []GatewayAddressApplyConfiguration       `json:"addresses,omitempty"`
 	Infrastructure   *GatewayInfrastructureApplyConfiguration `json:"infrastructure,omitempty"`
 	BackendTLS       *GatewayBackendTLSApplyConfiguration     `json:"backendTLS,omitempty"`
+	AllowedListeners *AllowedListenersApplyConfiguration      `json:"allowedListeners,omitempty"`
 }
 
 // GatewaySpecApplyConfiguration constructs a declarative configuration of the GatewaySpec type for use with
@@ -87,3 +88,11 @@ func (b *GatewaySpecApplyConfiguration) WithBackendTLS(value *GatewayBackendTLSA
 	b.BackendTLS = value
 	return b
 }
+
+// WithAllowedListeners sets the AllowedListeners field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AllowedListeners field is set to the value of the last call.
+func (b *GatewaySpecApplyConfiguration) WithAllowedListeners(value *AllowedListenersApplyConfiguration) *GatewaySpecApplyConfiguration {
+	b.AllowedListeners = value
+	return b
+}
diff --git a/apis/applyconfiguration/apis/v1/gatewaystatus.go b/applyconfiguration/apis/v1/gatewaystatus.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/gatewaystatus.go
rename to applyconfiguration/apis/v1/gatewaystatus.go
diff --git a/apis/applyconfiguration/apis/v1/gatewaystatusaddress.go b/applyconfiguration/apis/v1/gatewaystatusaddress.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/gatewaystatusaddress.go
rename to applyconfiguration/apis/v1/gatewaystatusaddress.go
diff --git a/apis/applyconfiguration/apis/v1/gatewaytlsconfig.go b/applyconfiguration/apis/v1/gatewaytlsconfig.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/gatewaytlsconfig.go
rename to applyconfiguration/apis/v1/gatewaytlsconfig.go
diff --git a/apis/applyconfiguration/apis/v1/grpcbackendref.go b/applyconfiguration/apis/v1/grpcbackendref.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/grpcbackendref.go
rename to applyconfiguration/apis/v1/grpcbackendref.go
diff --git a/apis/applyconfiguration/apis/v1/grpcheadermatch.go b/applyconfiguration/apis/v1/grpcheadermatch.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/grpcheadermatch.go
rename to applyconfiguration/apis/v1/grpcheadermatch.go
diff --git a/apis/applyconfiguration/apis/v1/grpcmethodmatch.go b/applyconfiguration/apis/v1/grpcmethodmatch.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/grpcmethodmatch.go
rename to applyconfiguration/apis/v1/grpcmethodmatch.go
diff --git a/apis/applyconfiguration/apis/v1/grpcroute.go b/applyconfiguration/apis/v1/grpcroute.go
similarity index 99%
rename from apis/applyconfiguration/apis/v1/grpcroute.go
rename to applyconfiguration/apis/v1/grpcroute.go
index 3c3b376d..5728e583 100644
--- a/apis/applyconfiguration/apis/v1/grpcroute.go
+++ b/applyconfiguration/apis/v1/grpcroute.go
@@ -23,8 +23,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	gatewayapiapisv1 "sigs.k8s.io/gateway-api/apis/v1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // GRPCRouteApplyConfiguration represents a declarative configuration of the GRPCRoute type for use
diff --git a/apis/applyconfiguration/apis/v1/grpcroutefilter.go b/applyconfiguration/apis/v1/grpcroutefilter.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/grpcroutefilter.go
rename to applyconfiguration/apis/v1/grpcroutefilter.go
diff --git a/apis/applyconfiguration/apis/v1/grpcroutematch.go b/applyconfiguration/apis/v1/grpcroutematch.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/grpcroutematch.go
rename to applyconfiguration/apis/v1/grpcroutematch.go
diff --git a/apis/applyconfiguration/apis/v1/grpcrouterule.go b/applyconfiguration/apis/v1/grpcrouterule.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/grpcrouterule.go
rename to applyconfiguration/apis/v1/grpcrouterule.go
diff --git a/apis/applyconfiguration/apis/v1/grpcroutespec.go b/applyconfiguration/apis/v1/grpcroutespec.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/grpcroutespec.go
rename to applyconfiguration/apis/v1/grpcroutespec.go
diff --git a/apis/applyconfiguration/apis/v1/httpbackendref.go b/applyconfiguration/apis/v1/httpbackendref.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httpbackendref.go
rename to applyconfiguration/apis/v1/httpbackendref.go
diff --git a/applyconfiguration/apis/v1/httpcorsfilter.go b/applyconfiguration/apis/v1/httpcorsfilter.go
new file mode 100644
index 00000000..9addcf95
--- /dev/null
+++ b/applyconfiguration/apis/v1/httpcorsfilter.go
@@ -0,0 +1,96 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// HTTPCORSFilterApplyConfiguration represents a declarative configuration of the HTTPCORSFilter type for use
+// with apply.
+type HTTPCORSFilterApplyConfiguration struct {
+	AllowOrigins     []v1.AbsoluteURI            `json:"allowOrigins,omitempty"`
+	AllowCredentials *v1.TrueField               `json:"allowCredentials,omitempty"`
+	AllowMethods     []v1.HTTPMethodWithWildcard `json:"allowMethods,omitempty"`
+	AllowHeaders     []v1.HTTPHeaderName         `json:"allowHeaders,omitempty"`
+	ExposeHeaders    []v1.HTTPHeaderName         `json:"exposeHeaders,omitempty"`
+	MaxAge           *int32                      `json:"maxAge,omitempty"`
+}
+
+// HTTPCORSFilterApplyConfiguration constructs a declarative configuration of the HTTPCORSFilter type for use with
+// apply.
+func HTTPCORSFilter() *HTTPCORSFilterApplyConfiguration {
+	return &HTTPCORSFilterApplyConfiguration{}
+}
+
+// WithAllowOrigins adds the given value to the AllowOrigins field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the AllowOrigins field.
+func (b *HTTPCORSFilterApplyConfiguration) WithAllowOrigins(values ...v1.AbsoluteURI) *HTTPCORSFilterApplyConfiguration {
+	for i := range values {
+		b.AllowOrigins = append(b.AllowOrigins, values[i])
+	}
+	return b
+}
+
+// WithAllowCredentials sets the AllowCredentials field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AllowCredentials field is set to the value of the last call.
+func (b *HTTPCORSFilterApplyConfiguration) WithAllowCredentials(value v1.TrueField) *HTTPCORSFilterApplyConfiguration {
+	b.AllowCredentials = &value
+	return b
+}
+
+// WithAllowMethods adds the given value to the AllowMethods field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the AllowMethods field.
+func (b *HTTPCORSFilterApplyConfiguration) WithAllowMethods(values ...v1.HTTPMethodWithWildcard) *HTTPCORSFilterApplyConfiguration {
+	for i := range values {
+		b.AllowMethods = append(b.AllowMethods, values[i])
+	}
+	return b
+}
+
+// WithAllowHeaders adds the given value to the AllowHeaders field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the AllowHeaders field.
+func (b *HTTPCORSFilterApplyConfiguration) WithAllowHeaders(values ...v1.HTTPHeaderName) *HTTPCORSFilterApplyConfiguration {
+	for i := range values {
+		b.AllowHeaders = append(b.AllowHeaders, values[i])
+	}
+	return b
+}
+
+// WithExposeHeaders adds the given value to the ExposeHeaders field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the ExposeHeaders field.
+func (b *HTTPCORSFilterApplyConfiguration) WithExposeHeaders(values ...v1.HTTPHeaderName) *HTTPCORSFilterApplyConfiguration {
+	for i := range values {
+		b.ExposeHeaders = append(b.ExposeHeaders, values[i])
+	}
+	return b
+}
+
+// WithMaxAge sets the MaxAge field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MaxAge field is set to the value of the last call.
+func (b *HTTPCORSFilterApplyConfiguration) WithMaxAge(value int32) *HTTPCORSFilterApplyConfiguration {
+	b.MaxAge = &value
+	return b
+}
diff --git a/apis/applyconfiguration/apis/v1/httpheader.go b/applyconfiguration/apis/v1/httpheader.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httpheader.go
rename to applyconfiguration/apis/v1/httpheader.go
diff --git a/apis/applyconfiguration/apis/v1/httpheaderfilter.go b/applyconfiguration/apis/v1/httpheaderfilter.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httpheaderfilter.go
rename to applyconfiguration/apis/v1/httpheaderfilter.go
diff --git a/apis/applyconfiguration/apis/v1/httpheadermatch.go b/applyconfiguration/apis/v1/httpheadermatch.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httpheadermatch.go
rename to applyconfiguration/apis/v1/httpheadermatch.go
diff --git a/apis/applyconfiguration/apis/v1/httppathmatch.go b/applyconfiguration/apis/v1/httppathmatch.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httppathmatch.go
rename to applyconfiguration/apis/v1/httppathmatch.go
diff --git a/apis/applyconfiguration/apis/v1/httppathmodifier.go b/applyconfiguration/apis/v1/httppathmodifier.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httppathmodifier.go
rename to applyconfiguration/apis/v1/httppathmodifier.go
diff --git a/apis/applyconfiguration/apis/v1/httpqueryparammatch.go b/applyconfiguration/apis/v1/httpqueryparammatch.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httpqueryparammatch.go
rename to applyconfiguration/apis/v1/httpqueryparammatch.go
diff --git a/apis/applyconfiguration/apis/v1/httprequestmirrorfilter.go b/applyconfiguration/apis/v1/httprequestmirrorfilter.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httprequestmirrorfilter.go
rename to applyconfiguration/apis/v1/httprequestmirrorfilter.go
diff --git a/apis/applyconfiguration/apis/v1/httprequestredirectfilter.go b/applyconfiguration/apis/v1/httprequestredirectfilter.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httprequestredirectfilter.go
rename to applyconfiguration/apis/v1/httprequestredirectfilter.go
diff --git a/apis/applyconfiguration/apis/v1/httproute.go b/applyconfiguration/apis/v1/httproute.go
similarity index 99%
rename from apis/applyconfiguration/apis/v1/httproute.go
rename to applyconfiguration/apis/v1/httproute.go
index 0fabf88c..ee961e01 100644
--- a/apis/applyconfiguration/apis/v1/httproute.go
+++ b/applyconfiguration/apis/v1/httproute.go
@@ -23,8 +23,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	gatewayapiapisv1 "sigs.k8s.io/gateway-api/apis/v1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // HTTPRouteApplyConfiguration represents a declarative configuration of the HTTPRoute type for use
diff --git a/apis/applyconfiguration/apis/v1/httproutefilter.go b/applyconfiguration/apis/v1/httproutefilter.go
similarity index 90%
rename from apis/applyconfiguration/apis/v1/httproutefilter.go
rename to applyconfiguration/apis/v1/httproutefilter.go
index a1c9b2e6..647b1dba 100644
--- a/apis/applyconfiguration/apis/v1/httproutefilter.go
+++ b/applyconfiguration/apis/v1/httproutefilter.go
@@ -31,6 +31,7 @@ type HTTPRouteFilterApplyConfiguration struct {
 	RequestMirror          *HTTPRequestMirrorFilterApplyConfiguration   `json:"requestMirror,omitempty"`
 	RequestRedirect        *HTTPRequestRedirectFilterApplyConfiguration `json:"requestRedirect,omitempty"`
 	URLRewrite             *HTTPURLRewriteFilterApplyConfiguration      `json:"urlRewrite,omitempty"`
+	CORS                   *HTTPCORSFilterApplyConfiguration            `json:"cors,omitempty"`
 	ExtensionRef           *LocalObjectReferenceApplyConfiguration      `json:"extensionRef,omitempty"`
 }
 
@@ -88,6 +89,14 @@ func (b *HTTPRouteFilterApplyConfiguration) WithURLRewrite(value *HTTPURLRewrite
 	return b
 }
 
+// WithCORS sets the CORS field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CORS field is set to the value of the last call.
+func (b *HTTPRouteFilterApplyConfiguration) WithCORS(value *HTTPCORSFilterApplyConfiguration) *HTTPRouteFilterApplyConfiguration {
+	b.CORS = value
+	return b
+}
+
 // WithExtensionRef sets the ExtensionRef field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the ExtensionRef field is set to the value of the last call.
diff --git a/apis/applyconfiguration/apis/v1/httproutematch.go b/applyconfiguration/apis/v1/httproutematch.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httproutematch.go
rename to applyconfiguration/apis/v1/httproutematch.go
diff --git a/apis/applyconfiguration/apis/v1/httprouteretry.go b/applyconfiguration/apis/v1/httprouteretry.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httprouteretry.go
rename to applyconfiguration/apis/v1/httprouteretry.go
diff --git a/apis/applyconfiguration/apis/v1/httprouterule.go b/applyconfiguration/apis/v1/httprouterule.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httprouterule.go
rename to applyconfiguration/apis/v1/httprouterule.go
diff --git a/apis/applyconfiguration/apis/v1/httproutespec.go b/applyconfiguration/apis/v1/httproutespec.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httproutespec.go
rename to applyconfiguration/apis/v1/httproutespec.go
diff --git a/apis/applyconfiguration/apis/v1/httproutetimeouts.go b/applyconfiguration/apis/v1/httproutetimeouts.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httproutetimeouts.go
rename to applyconfiguration/apis/v1/httproutetimeouts.go
diff --git a/apis/applyconfiguration/apis/v1/httpurlrewritefilter.go b/applyconfiguration/apis/v1/httpurlrewritefilter.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httpurlrewritefilter.go
rename to applyconfiguration/apis/v1/httpurlrewritefilter.go
diff --git a/apis/applyconfiguration/apis/v1/listener.go b/applyconfiguration/apis/v1/listener.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/listener.go
rename to applyconfiguration/apis/v1/listener.go
diff --git a/applyconfiguration/apis/v1/listenernamespaces.go b/applyconfiguration/apis/v1/listenernamespaces.go
new file mode 100644
index 00000000..d6869648
--- /dev/null
+++ b/applyconfiguration/apis/v1/listenernamespaces.go
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// ListenerNamespacesApplyConfiguration represents a declarative configuration of the ListenerNamespaces type for use
+// with apply.
+type ListenerNamespacesApplyConfiguration struct {
+	From     *v1.FromNamespaces                      `json:"from,omitempty"`
+	Selector *metav1.LabelSelectorApplyConfiguration `json:"selector,omitempty"`
+}
+
+// ListenerNamespacesApplyConfiguration constructs a declarative configuration of the ListenerNamespaces type for use with
+// apply.
+func ListenerNamespaces() *ListenerNamespacesApplyConfiguration {
+	return &ListenerNamespacesApplyConfiguration{}
+}
+
+// WithFrom sets the From field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the From field is set to the value of the last call.
+func (b *ListenerNamespacesApplyConfiguration) WithFrom(value v1.FromNamespaces) *ListenerNamespacesApplyConfiguration {
+	b.From = &value
+	return b
+}
+
+// WithSelector sets the Selector field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Selector field is set to the value of the last call.
+func (b *ListenerNamespacesApplyConfiguration) WithSelector(value *metav1.LabelSelectorApplyConfiguration) *ListenerNamespacesApplyConfiguration {
+	b.Selector = value
+	return b
+}
diff --git a/apis/applyconfiguration/apis/v1/listenerstatus.go b/applyconfiguration/apis/v1/listenerstatus.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/listenerstatus.go
rename to applyconfiguration/apis/v1/listenerstatus.go
diff --git a/apis/applyconfiguration/apis/v1/localobjectreference.go b/applyconfiguration/apis/v1/localobjectreference.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/localobjectreference.go
rename to applyconfiguration/apis/v1/localobjectreference.go
diff --git a/apis/applyconfiguration/apis/v1/localparametersreference.go b/applyconfiguration/apis/v1/localparametersreference.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/localparametersreference.go
rename to applyconfiguration/apis/v1/localparametersreference.go
diff --git a/apis/applyconfiguration/apis/v1/objectreference.go b/applyconfiguration/apis/v1/objectreference.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/objectreference.go
rename to applyconfiguration/apis/v1/objectreference.go
diff --git a/apis/applyconfiguration/apis/v1/parametersreference.go b/applyconfiguration/apis/v1/parametersreference.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/parametersreference.go
rename to applyconfiguration/apis/v1/parametersreference.go
diff --git a/apis/applyconfiguration/apis/v1/parentreference.go b/applyconfiguration/apis/v1/parentreference.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/parentreference.go
rename to applyconfiguration/apis/v1/parentreference.go
diff --git a/apis/applyconfiguration/apis/v1/routegroupkind.go b/applyconfiguration/apis/v1/routegroupkind.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/routegroupkind.go
rename to applyconfiguration/apis/v1/routegroupkind.go
diff --git a/apis/applyconfiguration/apis/v1/routenamespaces.go b/applyconfiguration/apis/v1/routenamespaces.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/routenamespaces.go
rename to applyconfiguration/apis/v1/routenamespaces.go
diff --git a/apis/applyconfiguration/apis/v1/routeparentstatus.go b/applyconfiguration/apis/v1/routeparentstatus.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/routeparentstatus.go
rename to applyconfiguration/apis/v1/routeparentstatus.go
diff --git a/apis/applyconfiguration/apis/v1/secretobjectreference.go b/applyconfiguration/apis/v1/secretobjectreference.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/secretobjectreference.go
rename to applyconfiguration/apis/v1/secretobjectreference.go
diff --git a/apis/applyconfiguration/apis/v1/sessionpersistence.go b/applyconfiguration/apis/v1/sessionpersistence.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/sessionpersistence.go
rename to applyconfiguration/apis/v1/sessionpersistence.go
diff --git a/apis/applyconfiguration/apis/v1/supportedfeature.go b/applyconfiguration/apis/v1/supportedfeature.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/supportedfeature.go
rename to applyconfiguration/apis/v1/supportedfeature.go
diff --git a/apis/applyconfiguration/apis/v1alpha2/backendlbpolicy.go b/applyconfiguration/apis/v1alpha2/backendlbpolicy.go
similarity index 99%
rename from apis/applyconfiguration/apis/v1alpha2/backendlbpolicy.go
rename to applyconfiguration/apis/v1alpha2/backendlbpolicy.go
index e63c8cd6..4c648144 100644
--- a/apis/applyconfiguration/apis/v1alpha2/backendlbpolicy.go
+++ b/applyconfiguration/apis/v1alpha2/backendlbpolicy.go
@@ -23,8 +23,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // BackendLBPolicyApplyConfiguration represents a declarative configuration of the BackendLBPolicy type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/backendlbpolicyspec.go b/applyconfiguration/apis/v1alpha2/backendlbpolicyspec.go
similarity index 97%
rename from apis/applyconfiguration/apis/v1alpha2/backendlbpolicyspec.go
rename to applyconfiguration/apis/v1alpha2/backendlbpolicyspec.go
index b443579a..9c8db9e6 100644
--- a/apis/applyconfiguration/apis/v1alpha2/backendlbpolicyspec.go
+++ b/applyconfiguration/apis/v1alpha2/backendlbpolicyspec.go
@@ -19,7 +19,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	v1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // BackendLBPolicySpecApplyConfiguration represents a declarative configuration of the BackendLBPolicySpec type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/grpcroute.go b/applyconfiguration/apis/v1alpha2/grpcroute.go
similarity index 98%
rename from apis/applyconfiguration/apis/v1alpha2/grpcroute.go
rename to applyconfiguration/apis/v1alpha2/grpcroute.go
index 7e6f806b..b0896d92 100644
--- a/apis/applyconfiguration/apis/v1alpha2/grpcroute.go
+++ b/applyconfiguration/apis/v1alpha2/grpcroute.go
@@ -23,9 +23,9 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // GRPCRouteApplyConfiguration represents a declarative configuration of the GRPCRoute type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/localpolicytargetreference.go b/applyconfiguration/apis/v1alpha2/localpolicytargetreference.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1alpha2/localpolicytargetreference.go
rename to applyconfiguration/apis/v1alpha2/localpolicytargetreference.go
diff --git a/apis/applyconfiguration/apis/v1alpha2/localpolicytargetreferencewithsectionname.go b/applyconfiguration/apis/v1alpha2/localpolicytargetreferencewithsectionname.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1alpha2/localpolicytargetreferencewithsectionname.go
rename to applyconfiguration/apis/v1alpha2/localpolicytargetreferencewithsectionname.go
diff --git a/apis/applyconfiguration/apis/v1alpha2/policyancestorstatus.go b/applyconfiguration/apis/v1alpha2/policyancestorstatus.go
similarity index 97%
rename from apis/applyconfiguration/apis/v1alpha2/policyancestorstatus.go
rename to applyconfiguration/apis/v1alpha2/policyancestorstatus.go
index d59b5c78..2237f51d 100644
--- a/apis/applyconfiguration/apis/v1alpha2/policyancestorstatus.go
+++ b/applyconfiguration/apis/v1alpha2/policyancestorstatus.go
@@ -20,8 +20,8 @@ package v1alpha2
 
 import (
 	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	v1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // PolicyAncestorStatusApplyConfiguration represents a declarative configuration of the PolicyAncestorStatus type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/policystatus.go b/applyconfiguration/apis/v1alpha2/policystatus.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1alpha2/policystatus.go
rename to applyconfiguration/apis/v1alpha2/policystatus.go
diff --git a/apis/applyconfiguration/apis/v1alpha2/referencegrant.go b/applyconfiguration/apis/v1alpha2/referencegrant.go
similarity index 98%
rename from apis/applyconfiguration/apis/v1alpha2/referencegrant.go
rename to applyconfiguration/apis/v1alpha2/referencegrant.go
index e25a74a6..e8ea62c9 100644
--- a/apis/applyconfiguration/apis/v1alpha2/referencegrant.go
+++ b/applyconfiguration/apis/v1alpha2/referencegrant.go
@@ -23,9 +23,9 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	v1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	v1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // ReferenceGrantApplyConfiguration represents a declarative configuration of the ReferenceGrant type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/tcproute.go b/applyconfiguration/apis/v1alpha2/tcproute.go
similarity index 99%
rename from apis/applyconfiguration/apis/v1alpha2/tcproute.go
rename to applyconfiguration/apis/v1alpha2/tcproute.go
index 1edbd0d7..b56a8198 100644
--- a/apis/applyconfiguration/apis/v1alpha2/tcproute.go
+++ b/applyconfiguration/apis/v1alpha2/tcproute.go
@@ -23,8 +23,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // TCPRouteApplyConfiguration represents a declarative configuration of the TCPRoute type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/tcprouterule.go b/applyconfiguration/apis/v1alpha2/tcprouterule.go
similarity index 97%
rename from apis/applyconfiguration/apis/v1alpha2/tcprouterule.go
rename to applyconfiguration/apis/v1alpha2/tcprouterule.go
index 450d8999..ea91c016 100644
--- a/apis/applyconfiguration/apis/v1alpha2/tcprouterule.go
+++ b/applyconfiguration/apis/v1alpha2/tcprouterule.go
@@ -19,8 +19,8 @@ limitations under the License.
 package v1alpha2
 
 import (
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // TCPRouteRuleApplyConfiguration represents a declarative configuration of the TCPRouteRule type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/tcproutespec.go b/applyconfiguration/apis/v1alpha2/tcproutespec.go
similarity index 97%
rename from apis/applyconfiguration/apis/v1alpha2/tcproutespec.go
rename to applyconfiguration/apis/v1alpha2/tcproutespec.go
index 375a7f4b..c693e96c 100644
--- a/apis/applyconfiguration/apis/v1alpha2/tcproutespec.go
+++ b/applyconfiguration/apis/v1alpha2/tcproutespec.go
@@ -19,7 +19,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	v1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // TCPRouteSpecApplyConfiguration represents a declarative configuration of the TCPRouteSpec type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/tlsroute.go b/applyconfiguration/apis/v1alpha2/tlsroute.go
similarity index 99%
rename from apis/applyconfiguration/apis/v1alpha2/tlsroute.go
rename to applyconfiguration/apis/v1alpha2/tlsroute.go
index 5cfdd673..7dfe99da 100644
--- a/apis/applyconfiguration/apis/v1alpha2/tlsroute.go
+++ b/applyconfiguration/apis/v1alpha2/tlsroute.go
@@ -23,8 +23,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // TLSRouteApplyConfiguration represents a declarative configuration of the TLSRoute type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/tlsrouterule.go b/applyconfiguration/apis/v1alpha2/tlsrouterule.go
similarity index 97%
rename from apis/applyconfiguration/apis/v1alpha2/tlsrouterule.go
rename to applyconfiguration/apis/v1alpha2/tlsrouterule.go
index e7124fc8..c8aecf0b 100644
--- a/apis/applyconfiguration/apis/v1alpha2/tlsrouterule.go
+++ b/applyconfiguration/apis/v1alpha2/tlsrouterule.go
@@ -19,8 +19,8 @@ limitations under the License.
 package v1alpha2
 
 import (
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // TLSRouteRuleApplyConfiguration represents a declarative configuration of the TLSRouteRule type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/tlsroutespec.go b/applyconfiguration/apis/v1alpha2/tlsroutespec.go
similarity index 97%
rename from apis/applyconfiguration/apis/v1alpha2/tlsroutespec.go
rename to applyconfiguration/apis/v1alpha2/tlsroutespec.go
index a8e3745f..4fc149ec 100644
--- a/apis/applyconfiguration/apis/v1alpha2/tlsroutespec.go
+++ b/applyconfiguration/apis/v1alpha2/tlsroutespec.go
@@ -19,8 +19,8 @@ limitations under the License.
 package v1alpha2
 
 import (
-	v1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // TLSRouteSpecApplyConfiguration represents a declarative configuration of the TLSRouteSpec type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/udproute.go b/applyconfiguration/apis/v1alpha2/udproute.go
similarity index 99%
rename from apis/applyconfiguration/apis/v1alpha2/udproute.go
rename to applyconfiguration/apis/v1alpha2/udproute.go
index 377e85d8..2ea4d5b4 100644
--- a/apis/applyconfiguration/apis/v1alpha2/udproute.go
+++ b/applyconfiguration/apis/v1alpha2/udproute.go
@@ -23,8 +23,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // UDPRouteApplyConfiguration represents a declarative configuration of the UDPRoute type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/udprouterule.go b/applyconfiguration/apis/v1alpha2/udprouterule.go
similarity index 97%
rename from apis/applyconfiguration/apis/v1alpha2/udprouterule.go
rename to applyconfiguration/apis/v1alpha2/udprouterule.go
index fd6171a2..4d77460d 100644
--- a/apis/applyconfiguration/apis/v1alpha2/udprouterule.go
+++ b/applyconfiguration/apis/v1alpha2/udprouterule.go
@@ -19,8 +19,8 @@ limitations under the License.
 package v1alpha2
 
 import (
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // UDPRouteRuleApplyConfiguration represents a declarative configuration of the UDPRouteRule type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/udproutespec.go b/applyconfiguration/apis/v1alpha2/udproutespec.go
similarity index 97%
rename from apis/applyconfiguration/apis/v1alpha2/udproutespec.go
rename to applyconfiguration/apis/v1alpha2/udproutespec.go
index eed19369..c75a0b52 100644
--- a/apis/applyconfiguration/apis/v1alpha2/udproutespec.go
+++ b/applyconfiguration/apis/v1alpha2/udproutespec.go
@@ -19,7 +19,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	v1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // UDPRouteSpecApplyConfiguration represents a declarative configuration of the UDPRouteSpec type for use
diff --git a/apis/applyconfiguration/apis/v1alpha3/backendtlspolicy.go b/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
similarity index 98%
rename from apis/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
rename to applyconfiguration/apis/v1alpha3/backendtlspolicy.go
index 5cbf6a8d..ba89d4f2 100644
--- a/apis/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
+++ b/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
@@ -23,9 +23,9 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	v1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	apisv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
+	v1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // BackendTLSPolicyApplyConfiguration represents a declarative configuration of the BackendTLSPolicy type for use
diff --git a/apis/applyconfiguration/apis/v1alpha3/backendtlspolicyspec.go b/applyconfiguration/apis/v1alpha3/backendtlspolicyspec.go
similarity index 97%
rename from apis/applyconfiguration/apis/v1alpha3/backendtlspolicyspec.go
rename to applyconfiguration/apis/v1alpha3/backendtlspolicyspec.go
index 5290a35f..97efdbcd 100644
--- a/apis/applyconfiguration/apis/v1alpha3/backendtlspolicyspec.go
+++ b/applyconfiguration/apis/v1alpha3/backendtlspolicyspec.go
@@ -19,8 +19,8 @@ limitations under the License.
 package v1alpha3
 
 import (
-	v1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	v1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 )
 
 // BackendTLSPolicySpecApplyConfiguration represents a declarative configuration of the BackendTLSPolicySpec type for use
diff --git a/apis/applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go b/applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go
similarity index 98%
rename from apis/applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go
rename to applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go
index 1245e285..4f0f5d92 100644
--- a/apis/applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go
+++ b/applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go
@@ -19,9 +19,9 @@ limitations under the License.
 package v1alpha3
 
 import (
-	v1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
 	v1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // BackendTLSPolicyValidationApplyConfiguration represents a declarative configuration of the BackendTLSPolicyValidation type for use
diff --git a/apis/applyconfiguration/apis/v1alpha3/subjectaltname.go b/applyconfiguration/apis/v1alpha3/subjectaltname.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1alpha3/subjectaltname.go
rename to applyconfiguration/apis/v1alpha3/subjectaltname.go
diff --git a/apis/applyconfiguration/apis/v1beta1/gateway.go b/applyconfiguration/apis/v1beta1/gateway.go
similarity index 98%
rename from apis/applyconfiguration/apis/v1beta1/gateway.go
rename to applyconfiguration/apis/v1beta1/gateway.go
index 8046345c..49ec4b21 100644
--- a/apis/applyconfiguration/apis/v1beta1/gateway.go
+++ b/applyconfiguration/apis/v1beta1/gateway.go
@@ -23,9 +23,9 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // GatewayApplyConfiguration represents a declarative configuration of the Gateway type for use
diff --git a/apis/applyconfiguration/apis/v1beta1/gatewayclass.go b/applyconfiguration/apis/v1beta1/gatewayclass.go
similarity index 98%
rename from apis/applyconfiguration/apis/v1beta1/gatewayclass.go
rename to applyconfiguration/apis/v1beta1/gatewayclass.go
index 938c6ba0..4ca42d5b 100644
--- a/apis/applyconfiguration/apis/v1beta1/gatewayclass.go
+++ b/applyconfiguration/apis/v1beta1/gatewayclass.go
@@ -23,9 +23,9 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // GatewayClassApplyConfiguration represents a declarative configuration of the GatewayClass type for use
diff --git a/apis/applyconfiguration/apis/v1beta1/httproute.go b/applyconfiguration/apis/v1beta1/httproute.go
similarity index 98%
rename from apis/applyconfiguration/apis/v1beta1/httproute.go
rename to applyconfiguration/apis/v1beta1/httproute.go
index 84a40d9a..aa85c307 100644
--- a/apis/applyconfiguration/apis/v1beta1/httproute.go
+++ b/applyconfiguration/apis/v1beta1/httproute.go
@@ -23,9 +23,9 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // HTTPRouteApplyConfiguration represents a declarative configuration of the HTTPRoute type for use
diff --git a/apis/applyconfiguration/apis/v1beta1/referencegrant.go b/applyconfiguration/apis/v1beta1/referencegrant.go
similarity index 99%
rename from apis/applyconfiguration/apis/v1beta1/referencegrant.go
rename to applyconfiguration/apis/v1beta1/referencegrant.go
index b6b8c2e5..79c19df8 100644
--- a/apis/applyconfiguration/apis/v1beta1/referencegrant.go
+++ b/applyconfiguration/apis/v1beta1/referencegrant.go
@@ -23,8 +23,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	apisv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // ReferenceGrantApplyConfiguration represents a declarative configuration of the ReferenceGrant type for use
diff --git a/apis/applyconfiguration/apis/v1beta1/referencegrantfrom.go b/applyconfiguration/apis/v1beta1/referencegrantfrom.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1beta1/referencegrantfrom.go
rename to applyconfiguration/apis/v1beta1/referencegrantfrom.go
diff --git a/apis/applyconfiguration/apis/v1beta1/referencegrantspec.go b/applyconfiguration/apis/v1beta1/referencegrantspec.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1beta1/referencegrantspec.go
rename to applyconfiguration/apis/v1beta1/referencegrantspec.go
diff --git a/apis/applyconfiguration/apis/v1beta1/referencegrantto.go b/applyconfiguration/apis/v1beta1/referencegrantto.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1beta1/referencegrantto.go
rename to applyconfiguration/apis/v1beta1/referencegrantto.go
diff --git a/applyconfiguration/apisx/v1alpha1/backendtrafficpolicy.go b/applyconfiguration/apisx/v1alpha1/backendtrafficpolicy.go
new file mode 100644
index 00000000..49288efc
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/backendtrafficpolicy.go
@@ -0,0 +1,265 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	v1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
+)
+
+// BackendTrafficPolicyApplyConfiguration represents a declarative configuration of the BackendTrafficPolicy type for use
+// with apply.
+type BackendTrafficPolicyApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *BackendTrafficPolicySpecApplyConfiguration `json:"spec,omitempty"`
+	Status                           *v1alpha2.PolicyStatusApplyConfiguration    `json:"status,omitempty"`
+}
+
+// BackendTrafficPolicy constructs a declarative configuration of the BackendTrafficPolicy type for use with
+// apply.
+func BackendTrafficPolicy(name, namespace string) *BackendTrafficPolicyApplyConfiguration {
+	b := &BackendTrafficPolicyApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("BackendTrafficPolicy")
+	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
+	return b
+}
+
+// ExtractBackendTrafficPolicy extracts the applied configuration owned by fieldManager from
+// backendTrafficPolicy. If no managedFields are found in backendTrafficPolicy for fieldManager, a
+// BackendTrafficPolicyApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// backendTrafficPolicy must be a unmodified BackendTrafficPolicy API object that was retrieved from the Kubernetes API.
+// ExtractBackendTrafficPolicy provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+// Experimental!
+func ExtractBackendTrafficPolicy(backendTrafficPolicy *apisxv1alpha1.BackendTrafficPolicy, fieldManager string) (*BackendTrafficPolicyApplyConfiguration, error) {
+	return extractBackendTrafficPolicy(backendTrafficPolicy, fieldManager, "")
+}
+
+// ExtractBackendTrafficPolicyStatus is the same as ExtractBackendTrafficPolicy except
+// that it extracts the status subresource applied configuration.
+// Experimental!
+func ExtractBackendTrafficPolicyStatus(backendTrafficPolicy *apisxv1alpha1.BackendTrafficPolicy, fieldManager string) (*BackendTrafficPolicyApplyConfiguration, error) {
+	return extractBackendTrafficPolicy(backendTrafficPolicy, fieldManager, "status")
+}
+
+func extractBackendTrafficPolicy(backendTrafficPolicy *apisxv1alpha1.BackendTrafficPolicy, fieldManager string, subresource string) (*BackendTrafficPolicyApplyConfiguration, error) {
+	b := &BackendTrafficPolicyApplyConfiguration{}
+	err := managedfields.ExtractInto(backendTrafficPolicy, internal.Parser().Type("io.k8s.sigs.gateway-api.apisx.v1alpha1.BackendTrafficPolicy"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(backendTrafficPolicy.Name)
+	b.WithNamespace(backendTrafficPolicy.Namespace)
+
+	b.WithKind("BackendTrafficPolicy")
+	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
+	return b, nil
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithKind(value string) *BackendTrafficPolicyApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithAPIVersion(value string) *BackendTrafficPolicyApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithName(value string) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithGenerateName(value string) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithNamespace(value string) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithUID(value types.UID) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithResourceVersion(value string) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithGeneration(value int64) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithCreationTimestamp(value metav1.Time) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *BackendTrafficPolicyApplyConfiguration) WithLabels(entries map[string]string) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *BackendTrafficPolicyApplyConfiguration) WithAnnotations(entries map[string]string) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *BackendTrafficPolicyApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *BackendTrafficPolicyApplyConfiguration) WithFinalizers(values ...string) *BackendTrafficPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *BackendTrafficPolicyApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithSpec(value *BackendTrafficPolicySpecApplyConfiguration) *BackendTrafficPolicyApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *BackendTrafficPolicyApplyConfiguration) WithStatus(value *v1alpha2.PolicyStatusApplyConfiguration) *BackendTrafficPolicyApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *BackendTrafficPolicyApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.Name
+}
diff --git a/applyconfiguration/apisx/v1alpha1/backendtrafficpolicyspec.go b/applyconfiguration/apisx/v1alpha1/backendtrafficpolicyspec.go
new file mode 100644
index 00000000..205609b8
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/backendtrafficpolicyspec.go
@@ -0,0 +1,67 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+	v1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
+)
+
+// BackendTrafficPolicySpecApplyConfiguration represents a declarative configuration of the BackendTrafficPolicySpec type for use
+// with apply.
+type BackendTrafficPolicySpecApplyConfiguration struct {
+	TargetRefs         []v1alpha2.LocalPolicyTargetReferenceApplyConfiguration `json:"targetRefs,omitempty"`
+	RetryConstraint    *RetryConstraintApplyConfiguration                      `json:"retryConstraint,omitempty"`
+	SessionPersistence *v1.SessionPersistenceApplyConfiguration                `json:"sessionPersistence,omitempty"`
+}
+
+// BackendTrafficPolicySpecApplyConfiguration constructs a declarative configuration of the BackendTrafficPolicySpec type for use with
+// apply.
+func BackendTrafficPolicySpec() *BackendTrafficPolicySpecApplyConfiguration {
+	return &BackendTrafficPolicySpecApplyConfiguration{}
+}
+
+// WithTargetRefs adds the given value to the TargetRefs field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the TargetRefs field.
+func (b *BackendTrafficPolicySpecApplyConfiguration) WithTargetRefs(values ...*v1alpha2.LocalPolicyTargetReferenceApplyConfiguration) *BackendTrafficPolicySpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithTargetRefs")
+		}
+		b.TargetRefs = append(b.TargetRefs, *values[i])
+	}
+	return b
+}
+
+// WithRetryConstraint sets the RetryConstraint field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the RetryConstraint field is set to the value of the last call.
+func (b *BackendTrafficPolicySpecApplyConfiguration) WithRetryConstraint(value *RetryConstraintApplyConfiguration) *BackendTrafficPolicySpecApplyConfiguration {
+	b.RetryConstraint = value
+	return b
+}
+
+// WithSessionPersistence sets the SessionPersistence field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SessionPersistence field is set to the value of the last call.
+func (b *BackendTrafficPolicySpecApplyConfiguration) WithSessionPersistence(value *v1.SessionPersistenceApplyConfiguration) *BackendTrafficPolicySpecApplyConfiguration {
+	b.SessionPersistence = value
+	return b
+}
diff --git a/applyconfiguration/apisx/v1alpha1/listenerentry.go b/applyconfiguration/apisx/v1alpha1/listenerentry.go
new file mode 100644
index 00000000..e6396bf1
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/listenerentry.go
@@ -0,0 +1,89 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+)
+
+// ListenerEntryApplyConfiguration represents a declarative configuration of the ListenerEntry type for use
+// with apply.
+type ListenerEntryApplyConfiguration struct {
+	Name          *v1.SectionName                            `json:"name,omitempty"`
+	Hostname      *v1.Hostname                               `json:"hostname,omitempty"`
+	Port          *v1.PortNumber                             `json:"port,omitempty"`
+	Protocol      *v1.ProtocolType                           `json:"protocol,omitempty"`
+	TLS           *apisv1.GatewayTLSConfigApplyConfiguration `json:"tls,omitempty"`
+	AllowedRoutes *apisv1.AllowedRoutesApplyConfiguration    `json:"allowedRoutes,omitempty"`
+}
+
+// ListenerEntryApplyConfiguration constructs a declarative configuration of the ListenerEntry type for use with
+// apply.
+func ListenerEntry() *ListenerEntryApplyConfiguration {
+	return &ListenerEntryApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ListenerEntryApplyConfiguration) WithName(value v1.SectionName) *ListenerEntryApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithHostname sets the Hostname field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Hostname field is set to the value of the last call.
+func (b *ListenerEntryApplyConfiguration) WithHostname(value v1.Hostname) *ListenerEntryApplyConfiguration {
+	b.Hostname = &value
+	return b
+}
+
+// WithPort sets the Port field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Port field is set to the value of the last call.
+func (b *ListenerEntryApplyConfiguration) WithPort(value v1.PortNumber) *ListenerEntryApplyConfiguration {
+	b.Port = &value
+	return b
+}
+
+// WithProtocol sets the Protocol field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Protocol field is set to the value of the last call.
+func (b *ListenerEntryApplyConfiguration) WithProtocol(value v1.ProtocolType) *ListenerEntryApplyConfiguration {
+	b.Protocol = &value
+	return b
+}
+
+// WithTLS sets the TLS field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TLS field is set to the value of the last call.
+func (b *ListenerEntryApplyConfiguration) WithTLS(value *apisv1.GatewayTLSConfigApplyConfiguration) *ListenerEntryApplyConfiguration {
+	b.TLS = value
+	return b
+}
+
+// WithAllowedRoutes sets the AllowedRoutes field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AllowedRoutes field is set to the value of the last call.
+func (b *ListenerEntryApplyConfiguration) WithAllowedRoutes(value *apisv1.AllowedRoutesApplyConfiguration) *ListenerEntryApplyConfiguration {
+	b.AllowedRoutes = value
+	return b
+}
diff --git a/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go b/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go
new file mode 100644
index 00000000..64d652a4
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go
@@ -0,0 +1,91 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+)
+
+// ListenerEntryStatusApplyConfiguration represents a declarative configuration of the ListenerEntryStatus type for use
+// with apply.
+type ListenerEntryStatusApplyConfiguration struct {
+	Name           *v1.SectionName                           `json:"name,omitempty"`
+	Port           *v1.PortNumber                            `json:"port,omitempty"`
+	SupportedKinds []apisv1.RouteGroupKindApplyConfiguration `json:"supportedKinds,omitempty"`
+	AttachedRoutes *int32                                    `json:"attachedRoutes,omitempty"`
+	Conditions     []metav1.ConditionApplyConfiguration      `json:"conditions,omitempty"`
+}
+
+// ListenerEntryStatusApplyConfiguration constructs a declarative configuration of the ListenerEntryStatus type for use with
+// apply.
+func ListenerEntryStatus() *ListenerEntryStatusApplyConfiguration {
+	return &ListenerEntryStatusApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ListenerEntryStatusApplyConfiguration) WithName(value v1.SectionName) *ListenerEntryStatusApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithPort sets the Port field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Port field is set to the value of the last call.
+func (b *ListenerEntryStatusApplyConfiguration) WithPort(value v1.PortNumber) *ListenerEntryStatusApplyConfiguration {
+	b.Port = &value
+	return b
+}
+
+// WithSupportedKinds adds the given value to the SupportedKinds field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SupportedKinds field.
+func (b *ListenerEntryStatusApplyConfiguration) WithSupportedKinds(values ...*apisv1.RouteGroupKindApplyConfiguration) *ListenerEntryStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithSupportedKinds")
+		}
+		b.SupportedKinds = append(b.SupportedKinds, *values[i])
+	}
+	return b
+}
+
+// WithAttachedRoutes sets the AttachedRoutes field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AttachedRoutes field is set to the value of the last call.
+func (b *ListenerEntryStatusApplyConfiguration) WithAttachedRoutes(value int32) *ListenerEntryStatusApplyConfiguration {
+	b.AttachedRoutes = &value
+	return b
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *ListenerEntryStatusApplyConfiguration) WithConditions(values ...*metav1.ConditionApplyConfiguration) *ListenerEntryStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
diff --git a/applyconfiguration/apisx/v1alpha1/listenerset.go b/applyconfiguration/apisx/v1alpha1/listenerset.go
new file mode 100644
index 00000000..b048d951
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/listenerset.go
@@ -0,0 +1,264 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
+)
+
+// ListenerSetApplyConfiguration represents a declarative configuration of the ListenerSet type for use
+// with apply.
+type ListenerSetApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *ListenerSetSpecApplyConfiguration   `json:"spec,omitempty"`
+	Status                           *ListenerSetStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// ListenerSet constructs a declarative configuration of the ListenerSet type for use with
+// apply.
+func ListenerSet(name, namespace string) *ListenerSetApplyConfiguration {
+	b := &ListenerSetApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("ListenerSet")
+	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
+	return b
+}
+
+// ExtractListenerSet extracts the applied configuration owned by fieldManager from
+// listenerSet. If no managedFields are found in listenerSet for fieldManager, a
+// ListenerSetApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// listenerSet must be a unmodified ListenerSet API object that was retrieved from the Kubernetes API.
+// ExtractListenerSet provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+// Experimental!
+func ExtractListenerSet(listenerSet *apisxv1alpha1.ListenerSet, fieldManager string) (*ListenerSetApplyConfiguration, error) {
+	return extractListenerSet(listenerSet, fieldManager, "")
+}
+
+// ExtractListenerSetStatus is the same as ExtractListenerSet except
+// that it extracts the status subresource applied configuration.
+// Experimental!
+func ExtractListenerSetStatus(listenerSet *apisxv1alpha1.ListenerSet, fieldManager string) (*ListenerSetApplyConfiguration, error) {
+	return extractListenerSet(listenerSet, fieldManager, "status")
+}
+
+func extractListenerSet(listenerSet *apisxv1alpha1.ListenerSet, fieldManager string, subresource string) (*ListenerSetApplyConfiguration, error) {
+	b := &ListenerSetApplyConfiguration{}
+	err := managedfields.ExtractInto(listenerSet, internal.Parser().Type("io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerSet"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(listenerSet.Name)
+	b.WithNamespace(listenerSet.Namespace)
+
+	b.WithKind("ListenerSet")
+	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
+	return b, nil
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithKind(value string) *ListenerSetApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithAPIVersion(value string) *ListenerSetApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithName(value string) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithGenerateName(value string) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithNamespace(value string) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithUID(value types.UID) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithResourceVersion(value string) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithGeneration(value int64) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithCreationTimestamp(value metav1.Time) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ListenerSetApplyConfiguration) WithLabels(entries map[string]string) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ListenerSetApplyConfiguration) WithAnnotations(entries map[string]string) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ListenerSetApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ListenerSetApplyConfiguration) WithFinalizers(values ...string) *ListenerSetApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *ListenerSetApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithSpec(value *ListenerSetSpecApplyConfiguration) *ListenerSetApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *ListenerSetApplyConfiguration) WithStatus(value *ListenerSetStatusApplyConfiguration) *ListenerSetApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *ListenerSetApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.Name
+}
diff --git a/applyconfiguration/apisx/v1alpha1/listenersetspec.go b/applyconfiguration/apisx/v1alpha1/listenersetspec.go
new file mode 100644
index 00000000..66fb3c33
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/listenersetspec.go
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ListenerSetSpecApplyConfiguration represents a declarative configuration of the ListenerSetSpec type for use
+// with apply.
+type ListenerSetSpecApplyConfiguration struct {
+	ParentRef *ParentGatewayReferenceApplyConfiguration `json:"parentRef,omitempty"`
+	Listeners []ListenerEntryApplyConfiguration         `json:"listeners,omitempty"`
+}
+
+// ListenerSetSpecApplyConfiguration constructs a declarative configuration of the ListenerSetSpec type for use with
+// apply.
+func ListenerSetSpec() *ListenerSetSpecApplyConfiguration {
+	return &ListenerSetSpecApplyConfiguration{}
+}
+
+// WithParentRef sets the ParentRef field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ParentRef field is set to the value of the last call.
+func (b *ListenerSetSpecApplyConfiguration) WithParentRef(value *ParentGatewayReferenceApplyConfiguration) *ListenerSetSpecApplyConfiguration {
+	b.ParentRef = value
+	return b
+}
+
+// WithListeners adds the given value to the Listeners field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Listeners field.
+func (b *ListenerSetSpecApplyConfiguration) WithListeners(values ...*ListenerEntryApplyConfiguration) *ListenerSetSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithListeners")
+		}
+		b.Listeners = append(b.Listeners, *values[i])
+	}
+	return b
+}
diff --git a/applyconfiguration/apisx/v1alpha1/listenersetstatus.go b/applyconfiguration/apisx/v1alpha1/listenersetstatus.go
new file mode 100644
index 00000000..a55c96b9
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/listenersetstatus.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// ListenerSetStatusApplyConfiguration represents a declarative configuration of the ListenerSetStatus type for use
+// with apply.
+type ListenerSetStatusApplyConfiguration struct {
+	Conditions []v1.ConditionApplyConfiguration        `json:"conditions,omitempty"`
+	Listeners  []ListenerEntryStatusApplyConfiguration `json:"listeners,omitempty"`
+}
+
+// ListenerSetStatusApplyConfiguration constructs a declarative configuration of the ListenerSetStatus type for use with
+// apply.
+func ListenerSetStatus() *ListenerSetStatusApplyConfiguration {
+	return &ListenerSetStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *ListenerSetStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *ListenerSetStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
+
+// WithListeners adds the given value to the Listeners field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Listeners field.
+func (b *ListenerSetStatusApplyConfiguration) WithListeners(values ...*ListenerEntryStatusApplyConfiguration) *ListenerSetStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithListeners")
+		}
+		b.Listeners = append(b.Listeners, *values[i])
+	}
+	return b
+}
diff --git a/applyconfiguration/apisx/v1alpha1/parentgatewayreference.go b/applyconfiguration/apisx/v1alpha1/parentgatewayreference.go
new file mode 100644
index 00000000..7001085d
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/parentgatewayreference.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// ParentGatewayReferenceApplyConfiguration represents a declarative configuration of the ParentGatewayReference type for use
+// with apply.
+type ParentGatewayReferenceApplyConfiguration struct {
+	Group     *v1.Group      `json:"group,omitempty"`
+	Kind      *v1.Kind       `json:"kind,omitempty"`
+	Name      *v1.ObjectName `json:"name,omitempty"`
+	Namespace *v1.Namespace  `json:"namespace,omitempty"`
+}
+
+// ParentGatewayReferenceApplyConfiguration constructs a declarative configuration of the ParentGatewayReference type for use with
+// apply.
+func ParentGatewayReference() *ParentGatewayReferenceApplyConfiguration {
+	return &ParentGatewayReferenceApplyConfiguration{}
+}
+
+// WithGroup sets the Group field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Group field is set to the value of the last call.
+func (b *ParentGatewayReferenceApplyConfiguration) WithGroup(value v1.Group) *ParentGatewayReferenceApplyConfiguration {
+	b.Group = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ParentGatewayReferenceApplyConfiguration) WithKind(value v1.Kind) *ParentGatewayReferenceApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ParentGatewayReferenceApplyConfiguration) WithName(value v1.ObjectName) *ParentGatewayReferenceApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ParentGatewayReferenceApplyConfiguration) WithNamespace(value v1.Namespace) *ParentGatewayReferenceApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
diff --git a/applyconfiguration/apisx/v1alpha1/requestrate.go b/applyconfiguration/apisx/v1alpha1/requestrate.go
new file mode 100644
index 00000000..a5c874a4
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/requestrate.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// RequestRateApplyConfiguration represents a declarative configuration of the RequestRate type for use
+// with apply.
+type RequestRateApplyConfiguration struct {
+	Count    *int         `json:"count,omitempty"`
+	Interval *v1.Duration `json:"interval,omitempty"`
+}
+
+// RequestRateApplyConfiguration constructs a declarative configuration of the RequestRate type for use with
+// apply.
+func RequestRate() *RequestRateApplyConfiguration {
+	return &RequestRateApplyConfiguration{}
+}
+
+// WithCount sets the Count field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Count field is set to the value of the last call.
+func (b *RequestRateApplyConfiguration) WithCount(value int) *RequestRateApplyConfiguration {
+	b.Count = &value
+	return b
+}
+
+// WithInterval sets the Interval field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Interval field is set to the value of the last call.
+func (b *RequestRateApplyConfiguration) WithInterval(value v1.Duration) *RequestRateApplyConfiguration {
+	b.Interval = &value
+	return b
+}
diff --git a/applyconfiguration/apisx/v1alpha1/retryconstraint.go b/applyconfiguration/apisx/v1alpha1/retryconstraint.go
new file mode 100644
index 00000000..4248ea83
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/retryconstraint.go
@@ -0,0 +1,61 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// RetryConstraintApplyConfiguration represents a declarative configuration of the RetryConstraint type for use
+// with apply.
+type RetryConstraintApplyConfiguration struct {
+	BudgetPercent  *int                           `json:"budgetPercent,omitempty"`
+	BudgetInterval *v1.Duration                   `json:"budgetInterval,omitempty"`
+	MinRetryRate   *RequestRateApplyConfiguration `json:"minRetryRate,omitempty"`
+}
+
+// RetryConstraintApplyConfiguration constructs a declarative configuration of the RetryConstraint type for use with
+// apply.
+func RetryConstraint() *RetryConstraintApplyConfiguration {
+	return &RetryConstraintApplyConfiguration{}
+}
+
+// WithBudgetPercent sets the BudgetPercent field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the BudgetPercent field is set to the value of the last call.
+func (b *RetryConstraintApplyConfiguration) WithBudgetPercent(value int) *RetryConstraintApplyConfiguration {
+	b.BudgetPercent = &value
+	return b
+}
+
+// WithBudgetInterval sets the BudgetInterval field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the BudgetInterval field is set to the value of the last call.
+func (b *RetryConstraintApplyConfiguration) WithBudgetInterval(value v1.Duration) *RetryConstraintApplyConfiguration {
+	b.BudgetInterval = &value
+	return b
+}
+
+// WithMinRetryRate sets the MinRetryRate field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MinRetryRate field is set to the value of the last call.
+func (b *RetryConstraintApplyConfiguration) WithMinRetryRate(value *RequestRateApplyConfiguration) *RetryConstraintApplyConfiguration {
+	b.MinRetryRate = value
+	return b
+}
diff --git a/apis/applyconfiguration/internal/internal.go b/applyconfiguration/internal/internal.go
similarity index 87%
rename from apis/applyconfiguration/internal/internal.go
rename to applyconfiguration/internal/internal.go
index 07a0df71..eee1e641 100644
--- a/apis/applyconfiguration/internal/internal.go
+++ b/applyconfiguration/internal/internal.go
@@ -223,6 +223,12 @@ var schemaYAML = typed.YAMLObject(`types:
     elementRelationship: atomic
 - name: io.k8s.apimachinery.pkg.apis.meta.v1.Time
   scalar: untyped
+- name: io.k8s.sigs.gateway-api.apis.v1.AllowedListeners
+  map:
+    fields:
+    - name: namespaces
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.ListenerNamespaces
 - name: io.k8s.sigs.gateway-api.apis.v1.AllowedRoutes
   map:
     fields:
@@ -581,6 +587,9 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.sigs.gateway-api.apis.v1.GatewayAddress
           elementRelationship: atomic
+    - name: allowedListeners
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.AllowedListeners
     - name: backendTLS
       type:
         namedType: io.k8s.sigs.gateway-api.apis.v1.GatewayBackendTLS
@@ -682,6 +691,39 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: weight
       type:
         scalar: numeric
+- name: io.k8s.sigs.gateway-api.apis.v1.HTTPCORSFilter
+  map:
+    fields:
+    - name: allowCredentials
+      type:
+        scalar: boolean
+    - name: allowHeaders
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
+    - name: allowMethods
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
+    - name: allowOrigins
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
+    - name: exposeHeaders
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
+    - name: maxAge
+      type:
+        scalar: numeric
 - name: io.k8s.sigs.gateway-api.apis.v1.HTTPHeader
   map:
     fields:
@@ -823,6 +865,9 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.sigs.gateway-api.apis.v1.HTTPRouteFilter
   map:
     fields:
+    - name: cors
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.HTTPCORSFilter
     - name: extensionRef
       type:
         namedType: io.k8s.sigs.gateway-api.apis.v1.LocalObjectReference
@@ -990,6 +1035,15 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: tls
       type:
         namedType: io.k8s.sigs.gateway-api.apis.v1.GatewayTLSConfig
+- name: io.k8s.sigs.gateway-api.apis.v1.ListenerNamespaces
+  map:
+    fields:
+    - name: from
+      type:
+        scalar: string
+    - name: selector
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector
 - name: io.k8s.sigs.gateway-api.apis.v1.ListenerStatus
   map:
     fields:
@@ -1693,6 +1747,190 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: name
       type:
         scalar: string
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.BackendTrafficPolicy
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.BackendTrafficPolicySpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.PolicyStatus
+      default: {}
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.BackendTrafficPolicySpec
+  map:
+    fields:
+    - name: retryConstraint
+      type:
+        namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.RetryConstraint
+    - name: sessionPersistence
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.SessionPersistence
+    - name: targetRefs
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.LocalPolicyTargetReference
+          elementRelationship: associative
+          keys:
+          - group
+          - kind
+          - name
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerEntry
+  map:
+    fields:
+    - name: allowedRoutes
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.AllowedRoutes
+    - name: hostname
+      type:
+        scalar: string
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: port
+      type:
+        scalar: numeric
+    - name: protocol
+      type:
+        scalar: string
+      default: ""
+    - name: tls
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.GatewayTLSConfig
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerEntryStatus
+  map:
+    fields:
+    - name: attachedRoutes
+      type:
+        scalar: numeric
+      default: 0
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: port
+      type:
+        scalar: numeric
+      default: 0
+    - name: supportedKinds
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apis.v1.RouteGroupKind
+          elementRelationship: atomic
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerSet
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerSetSpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerSetStatus
+      default: {}
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerSetSpec
+  map:
+    fields:
+    - name: listeners
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerEntry
+          elementRelationship: associative
+          keys:
+          - name
+    - name: parentRef
+      type:
+        namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.ParentGatewayReference
+      default: {}
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerSetStatus
+  map:
+    fields:
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: listeners
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerEntryStatus
+          elementRelationship: associative
+          keys:
+          - name
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.ParentGatewayReference
+  map:
+    fields:
+    - name: group
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: namespace
+      type:
+        scalar: string
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.RequestRate
+  map:
+    fields:
+    - name: count
+      type:
+        scalar: numeric
+    - name: interval
+      type:
+        scalar: string
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.RetryConstraint
+  map:
+    fields:
+    - name: budgetInterval
+      type:
+        scalar: string
+    - name: budgetPercent
+      type:
+        scalar: numeric
+    - name: minRetryRate
+      type:
+        namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.RequestRate
 - name: __untyped_atomic_
   scalar: untyped
   list:
diff --git a/apis/applyconfiguration/utils.go b/applyconfiguration/utils.go
similarity index 84%
rename from apis/applyconfiguration/utils.go
rename to applyconfiguration/utils.go
index debd0d9f..b0dc29f0 100644
--- a/apis/applyconfiguration/utils.go
+++ b/applyconfiguration/utils.go
@@ -22,15 +22,17 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	testing "k8s.io/client-go/testing"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
-	apisv1alpha3 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha3"
-	apisv1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
-	internal "sigs.k8s.io/gateway-api/apis/applyconfiguration/internal"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	v1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
+	apisv1alpha3 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha3"
+	apisv1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/applyconfiguration/apisx/v1alpha1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
 // ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
@@ -38,6 +40,8 @@ import (
 func ForKind(kind schema.GroupVersionKind) interface{} {
 	switch kind {
 	// Group=gateway.networking.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithKind("AllowedListeners"):
+		return &apisv1.AllowedListenersApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("AllowedRoutes"):
 		return &apisv1.AllowedRoutesApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("BackendObjectReference"):
@@ -94,6 +98,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apisv1.GRPCRouteStatusApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("HTTPBackendRef"):
 		return &apisv1.HTTPBackendRefApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("HTTPCORSFilter"):
+		return &apisv1.HTTPCORSFilterApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("HTTPHeader"):
 		return &apisv1.HTTPHeaderApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("HTTPHeaderFilter"):
@@ -130,6 +136,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apisv1.HTTPURLRewriteFilterApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("Listener"):
 		return &apisv1.ListenerApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("ListenerNamespaces"):
+		return &apisv1.ListenerNamespacesApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("ListenerStatus"):
 		return &apisv1.ListenerStatusApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("LocalObjectReference"):
@@ -225,6 +233,28 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 	case v1beta1.SchemeGroupVersion.WithKind("ReferenceGrantTo"):
 		return &apisv1beta1.ReferenceGrantToApplyConfiguration{}
 
+		// Group=gateway.networking.x-k8s.io, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithKind("BackendTrafficPolicy"):
+		return &apisxv1alpha1.BackendTrafficPolicyApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("BackendTrafficPolicySpec"):
+		return &apisxv1alpha1.BackendTrafficPolicySpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ListenerEntry"):
+		return &apisxv1alpha1.ListenerEntryApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ListenerEntryStatus"):
+		return &apisxv1alpha1.ListenerEntryStatusApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ListenerSet"):
+		return &apisxv1alpha1.ListenerSetApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ListenerSetSpec"):
+		return &apisxv1alpha1.ListenerSetSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ListenerSetStatus"):
+		return &apisxv1alpha1.ListenerSetStatusApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("ParentGatewayReference"):
+		return &apisxv1alpha1.ParentGatewayReferenceApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("RequestRate"):
+		return &apisxv1alpha1.RequestRateApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("RetryConstraint"):
+		return &apisxv1alpha1.RetryConstraintApplyConfiguration{}
+
 	}
 	return nil
 }
diff --git a/cmd/modelschema/main.go b/cmd/modelschema/main.go
index 42713567..ebfbb7c1 100644
--- a/cmd/modelschema/main.go
+++ b/cmd/modelschema/main.go
@@ -24,7 +24,7 @@ import (
 	"os"
 	"strings"
 
-	openapi "sigs.k8s.io/gateway-api/pkg/generated/openapi"
+	"sigs.k8s.io/gateway-api/pkg/generated/openapi"
 
 	"k8s.io/kube-openapi/pkg/common"
 	"k8s.io/kube-openapi/pkg/validation/spec"
@@ -44,6 +44,7 @@ func output() error {
 		return spec.MustCreateRef(fmt.Sprintf("#/definitions/%s", friendlyName(name)))
 	}
 	defs := openapi.GetOpenAPIDefinitions(refFunc)
+
 	schemaDefs := make(map[string]spec.Schema, len(defs))
 	for k, v := range defs {
 		// Replace top-level schema with v2 if a v2 schema is embedded
diff --git a/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml b/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
index bdf27aaa..c8a19d97 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
@@ -174,7 +174,7 @@ spec:
 
                       If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
                       specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
-                      not both. If CACertifcateRefs is empty or unspecified, the configuration for
+                      not both. If CACertificateRefs is empty or unspecified, the configuration for
                       WellKnownCACertificates MUST be honored instead if supported by the implementation.
 
                       References to a resource in a different namespace are invalid for the
@@ -232,7 +232,7 @@ spec:
                       backends:
 
                       1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
-                      2. If SubjectAltNames is not specified, Hostname MUST be used for
+                      2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.
                          authentication and MUST match the certificate served by the matching
                          backend.
 
@@ -244,10 +244,10 @@ spec:
                   subjectAltNames:
                     description: |-
                       SubjectAltNames contains one or more Subject Alternative Names.
-                      When specified, the certificate served from the backend MUST have at least one
-                      Subject Alternate Name matching one of the specified SubjectAltNames.
+                      When specified the certificate served from the backend MUST
+                      have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
 
-                      Support: Core
+                      Support: Extended
                     items:
                       description: SubjectAltName represents Subject Alternative Name.
                       properties:
diff --git a/config/crd/experimental/gateway.networking.k8s.io_backendtrafficpolicies.yaml b/config/crd/experimental/gateway.networking.k8s.io_backendtrafficpolicies.yaml
new file mode 100644
index 00000000..8e9b185c
--- /dev/null
+++ b/config/crd/experimental/gateway.networking.k8s.io_backendtrafficpolicies.yaml
@@ -0,0 +1,535 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/channel: experimental
+  creationTimestamp: null
+  name: backendtrafficpolicies.gateway.networking.k8s.io
+spec:
+  group: gateway.networking.k8s.io
+  names:
+    kind: BackendTrafficPolicy
+    listKind: BackendTrafficPolicyList
+    plural: backendtrafficpolicies
+    singular: backendtrafficpolicy
+  scope: Namespaced
+  versions:
+  - name: v1alpha2
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of BackendTrafficPolicy.
+            properties:
+              retry:
+                description: |-
+                  Retry defines the configuration for when to retry a request to a target
+                  backend.
+
+                  Implementations SHOULD retry on connection errors (disconnect, reset, timeout,
+                  TCP failure) if a retry stanza is configured.
+
+                  Support: Extended
+                properties:
+                  budgetInterval:
+                    description: |-
+                      BudgetInterval defines the duration in which requests will be considered
+                      for calculating the budget for retries.
+
+                      Support: Extended
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
+                  budgetPercent:
+                    description: |-
+                      BudgetPercent defines the maximum percentage of active requests that may
+                      be made up of retries.
+
+                      Support: Extended
+                    type: integer
+                  minRetryRate:
+                    description: |-
+                      MinRetryRate defines the minimum rate of retries that will be allowable
+                      over a specified duration of time.
+
+                      Ensures that requests can still be retried during periods of low
+                      traffic.
+
+                      Support: Extended
+                    properties:
+                      count:
+                        description: |-
+                          Count specifies the number of requests per time interval.
+
+                          Support: Extended
+                        type: integer
+                      interval:
+                        description: |-
+                          Interval specifies the divisor of the rate of requests, the amount of
+                          time during which the given count of requests occr.
+
+                          Support: Extended
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                        type: string
+                    type: object
+                type: object
+              sessionPersistence:
+                description: |-
+                  SessionPersistence defines and configures session persistence
+                  for the backend.
+
+                  Support: Extended
+                properties:
+                  absoluteTimeout:
+                    description: |-
+                      AbsoluteTimeout defines the absolute timeout of the persistent
+                      session. Once the AbsoluteTimeout duration has elapsed, the
+                      session becomes invalid.
+
+                      Support: Extended
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
+                  cookieConfig:
+                    description: |-
+                      CookieConfig provides configuration settings that are specific
+                      to cookie-based session persistence.
+
+                      Support: Core
+                    properties:
+                      lifetimeType:
+                        default: Session
+                        description: |-
+                          LifetimeType specifies whether the cookie has a permanent or
+                          session-based lifetime. A permanent cookie persists until its
+                          specified expiry time, defined by the Expires or Max-Age cookie
+                          attributes, while a session cookie is deleted when the current
+                          session ends.
+
+                          When set to "Permanent", AbsoluteTimeout indicates the
+                          cookie's lifetime via the Expires or Max-Age cookie attributes
+                          and is required.
+
+                          When set to "Session", AbsoluteTimeout indicates the
+                          absolute lifetime of the cookie tracked by the gateway and
+                          is optional.
+
+                          Defaults to "Session".
+
+                          Support: Core for "Session" type
+
+                          Support: Extended for "Permanent" type
+                        enum:
+                        - Permanent
+                        - Session
+                        type: string
+                    type: object
+                  idleTimeout:
+                    description: |-
+                      IdleTimeout defines the idle timeout of the persistent session.
+                      Once the session has been idle for more than the specified
+                      IdleTimeout duration, the session becomes invalid.
+
+                      Support: Extended
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
+                  sessionName:
+                    description: |-
+                      SessionName defines the name of the persistent session token
+                      which may be reflected in the cookie or the header. Users
+                      should avoid reusing session names to prevent unintended
+                      consequences, such as rejection or unpredictable behavior.
+
+                      Support: Implementation-specific
+                    maxLength: 128
+                    type: string
+                  type:
+                    default: Cookie
+                    description: |-
+                      Type defines the type of session persistence such as through
+                      the use a header or cookie. Defaults to cookie based session
+                      persistence.
+
+                      Support: Core for "Cookie" type
+
+                      Support: Extended for "Header" type
+                    enum:
+                    - Cookie
+                    - Header
+                    type: string
+                type: object
+                x-kubernetes-validations:
+                - message: AbsoluteTimeout must be specified when cookie lifetimeType
+                    is Permanent
+                  rule: '!has(self.cookieConfig) || !has(self.cookieConfig.lifetimeType)
+                    || self.cookieConfig.lifetimeType != ''Permanent'' || has(self.absoluteTimeout)'
+              targetRefs:
+                description: |-
+                  TargetRef identifies an API object to apply policy to.
+                  Currently, Backends (i.e. Service, ServiceImport, or any
+                  implementation-specific backendRef) are the only valid API
+                  target references.
+                items:
+                  description: |-
+                    LocalPolicyTargetReference identifies an API object to apply a direct or
+                    inherited policy to. This should be used as part of Policy resources
+                    that can target Gateway API resources. For more information on how this
+                    policy attachment model works, and a sample Policy resource, refer to
+                    the policy attachment documentation for Gateway API.
+                  properties:
+                    group:
+                      description: Group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    kind:
+                      description: Kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                      type: string
+                    name:
+                      description: Name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                  required:
+                  - group
+                  - kind
+                  - name
+                  type: object
+                maxItems: 16
+                minItems: 1
+                type: array
+                x-kubernetes-list-map-keys:
+                - group
+                - kind
+                - name
+                x-kubernetes-list-type: map
+            required:
+            - targetRefs
+            type: object
+          status:
+            description: Status defines the current state of BackendTrafficPolicy.
+            properties:
+              ancestors:
+                description: |-
+                  Ancestors is a list of ancestor resources (usually Gateways) that are
+                  associated with the policy, and the status of the policy with respect to
+                  each ancestor. When this policy attaches to a parent, the controller that
+                  manages the parent and the ancestors MUST add an entry to this list when
+                  the controller first sees the policy and SHOULD update the entry as
+                  appropriate when the relevant ancestor is modified.
+
+                  Note that choosing the relevant ancestor is left to the Policy designers;
+                  an important part of Policy design is designing the right object level at
+                  which to namespace this status.
+
+                  Note also that implementations MUST ONLY populate ancestor status for
+                  the Ancestor resources they are responsible for. Implementations MUST
+                  use the ControllerName field to uniquely identify the entries in this list
+                  that they are responsible for.
+
+                  Note that to achieve this, the list of PolicyAncestorStatus structs
+                  MUST be treated as a map with a composite key, made up of the AncestorRef
+                  and ControllerName fields combined.
+
+                  A maximum of 16 ancestors will be represented in this list. An empty list
+                  means the Policy is not relevant for any ancestors.
+
+                  If this slice is full, implementations MUST NOT add further entries.
+                  Instead they MUST consider the policy unimplementable and signal that
+                  on any related resources such as the ancestor that would be referenced
+                  here. For example, if this list was full on BackendTLSPolicy, no
+                  additional Gateways would be able to reference the Service targeted by
+                  the BackendTLSPolicy.
+                items:
+                  description: |-
+                    PolicyAncestorStatus describes the status of a route with respect to an
+                    associated Ancestor.
+
+                    Ancestors refer to objects that are either the Target of a policy or above it
+                    in terms of object hierarchy. For example, if a policy targets a Service, the
+                    Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
+                    the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
+                    useful object to place Policy status on, so we recommend that implementations
+                    SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
+                    have a _very_ good reason otherwise.
+
+                    In the context of policy attachment, the Ancestor is used to distinguish which
+                    resource results in a distinct application of this policy. For example, if a policy
+                    targets a Service, it may have a distinct result per attached Gateway.
+
+                    Policies targeting the same resource may have different effects depending on the
+                    ancestors of those resources. For example, different Gateways targeting the same
+                    Service may have different capabilities, especially if they have different underlying
+                    implementations.
+
+                    For example, in BackendTLSPolicy, the Policy attaches to a Service that is
+                    used as a backend in a HTTPRoute that is itself attached to a Gateway.
+                    In this case, the relevant object for status is the Gateway, and that is the
+                    ancestor object referred to in this status.
+
+                    Note that a parent is also an ancestor, so for objects where the parent is the
+                    relevant object for status, this struct SHOULD still be used.
+
+                    This struct is intended to be used in a slice that's effectively a map,
+                    with a composite key made up of the AncestorRef and the ControllerName.
+                  properties:
+                    ancestorRef:
+                      description: |-
+                        AncestorRef corresponds with a ParentRef in the spec that this
+                        PolicyAncestorStatus struct describes the status of.
+                      properties:
+                        group:
+                          default: gateway.networking.k8s.io
+                          description: |-
+                            Group is the group of the referent.
+                            When unspecified, "gateway.networking.k8s.io" is inferred.
+                            To set the core API group (such as for a "Service" kind referent),
+                            Group must be explicitly set to "" (empty string).
+
+                            Support: Core
+                          maxLength: 253
+                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        kind:
+                          default: Gateway
+                          description: |-
+                            Kind is kind of the referent.
+
+                            There are two kinds of parent resources with "Core" support:
+
+                            * Gateway (Gateway conformance profile)
+                            * Service (Mesh conformance profile, ClusterIP Services only)
+
+                            Support for other resources is Implementation-Specific.
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                          type: string
+                        name:
+                          description: |-
+                            Name is the name of the referent.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: |-
+                            Namespace is the namespace of the referent. When unspecified, this refers
+                            to the local namespace of the Route.
+
+                            Note that there are specific rules for ParentRefs which cross namespace
+                            boundaries. Cross-namespace references are only valid if they are explicitly
+                            allowed by something in the namespace they are referring to. For example:
+                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                            generic way to enable any other kind of cross-namespace reference.
+
+
+                            ParentRefs from a Route to a Service in the same namespace are "producer"
+                            routes, which apply default routing rules to inbound connections from
+                            any namespace to the Service.
+
+                            ParentRefs from a Route to a Service in a different namespace are
+                            "consumer" routes, and these routing rules are only applied to outbound
+                            connections originating from the same namespace as the Route, for which
+                            the intended destination of the connections are a Service targeted as a
+                            ParentRef of the Route.
+
+
+                            Support: Core
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                          type: string
+                        port:
+                          description: |-
+                            Port is the network port this Route targets. It can be interpreted
+                            differently based on the type of parent resource.
+
+                            When the parent resource is a Gateway, this targets all listeners
+                            listening on the specified port that also support this kind of Route(and
+                            select this Route). It's not recommended to set `Port` unless the
+                            networking behaviors specified in a Route must apply to a specific port
+                            as opposed to a listener(s) whose port(s) may be changed. When both Port
+                            and SectionName are specified, the name and port of the selected listener
+                            must match both specified values.
+
+
+                            When the parent resource is a Service, this targets a specific port in the
+                            Service spec. When both Port (experimental) and SectionName are specified,
+                            the name and port of the selected port must match both specified values.
+
+
+                            Implementations MAY choose to support other parent resources.
+                            Implementations supporting other types of parent resources MUST clearly
+                            document how/if Port is interpreted.
+
+                            For the purpose of status, an attachment is considered successful as
+                            long as the parent resource accepts it partially. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                            from the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route,
+                            the Route MUST be considered detached from the Gateway.
+
+                            Support: Extended
+                          format: int32
+                          maximum: 65535
+                          minimum: 1
+                          type: integer
+                        sectionName:
+                          description: |-
+                            SectionName is the name of a section within the target resource. In the
+                            following resources, SectionName is interpreted as the following:
+
+                            * Gateway: Listener name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+                            * Service: Port name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+
+                            Implementations MAY choose to support attaching Routes to other resources.
+                            If that is the case, they MUST clearly document how SectionName is
+                            interpreted.
+
+                            When unspecified (empty string), this will reference the entire resource.
+                            For the purpose of status, an attachment is considered successful if at
+                            least one section in the parent resource accepts it. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                            the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route, the
+                            Route MUST be considered detached from the Gateway.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    conditions:
+                      description: Conditions describes the status of the Policy with
+                        respect to the given Ancestor.
+                      items:
+                        description: Condition contains details for one aspect of
+                          the current state of this API Resource.
+                        properties:
+                          lastTransitionTime:
+                            description: |-
+                              lastTransitionTime is the last time the condition transitioned from one status to another.
+                              This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                            format: date-time
+                            type: string
+                          message:
+                            description: |-
+                              message is a human readable message indicating details about the transition.
+                              This may be an empty string.
+                            maxLength: 32768
+                            type: string
+                          observedGeneration:
+                            description: |-
+                              observedGeneration represents the .metadata.generation that the condition was set based upon.
+                              For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                              with respect to the current state of the instance.
+                            format: int64
+                            minimum: 0
+                            type: integer
+                          reason:
+                            description: |-
+                              reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected values and meanings for this field,
+                              and whether the values are considered a guaranteed API.
+                              The value should be a CamelCase string.
+                              This field may not be empty.
+                            maxLength: 1024
+                            minLength: 1
+                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                            type: string
+                          status:
+                            description: status of the condition, one of True, False,
+                              Unknown.
+                            enum:
+                            - "True"
+                            - "False"
+                            - Unknown
+                            type: string
+                          type:
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                            maxLength: 316
+                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                            type: string
+                        required:
+                        - lastTransitionTime
+                        - message
+                        - reason
+                        - status
+                        - type
+                        type: object
+                      maxItems: 8
+                      minItems: 1
+                      type: array
+                      x-kubernetes-list-map-keys:
+                      - type
+                      x-kubernetes-list-type: map
+                    controllerName:
+                      description: |-
+                        ControllerName is a domain/path string that indicates the name of the
+                        controller that wrote this status. This corresponds with the
+                        controllerName field on GatewayClass.
+
+                        Example: "example.net/gateway-controller".
+
+                        The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                        valid Kubernetes names
+                        (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+
+                        Controllers MUST populate this field when writing status. Controllers should ensure that
+                        entries to status populated with their ControllerName are cleaned up when they are no
+                        longer necessary.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                      type: string
+                  required:
+                  - ancestorRef
+                  - controllerName
+                  type: object
+                maxItems: 16
+                type: array
+            required:
+            - ancestors
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
index a13edd80..a8e07236 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
@@ -133,6 +133,87 @@ spec:
                 - message: Hostname values must be unique
                   rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
                     a2.type == a1.type && a2.value == a1.value) : true )'
+              allowedListeners:
+                description: |-
+                  AllowedListeners defines which ListenerSets can be attached to this Gateway.
+                  While this feature is experimental, the default value is to allow no ListenerSets.
+                properties:
+                  namespaces:
+                    default:
+                      from: None
+                    description: |-
+                      Namespaces defines which namespaces ListenerSets can be attached to this Gateway.
+                      While this feature is experimental, the default value is to allow no ListenerSets.
+                    properties:
+                      from:
+                        default: None
+                        description: |-
+                          From indicates where ListenerSets can attach to this Gateway. Possible
+                          values are:
+
+                          * Same: Only ListenerSets in the same namespace may be attached to this Gateway.
+                          * Selector: ListenerSets in namespaces selected by the selector may be attached to this Gateway.
+                          * All: ListenerSets in all namespaces may be attached to this Gateway.
+                          * None: Only listeners defined in the Gateway's spec are allowed
+
+                          While this feature is experimental, the default value None
+                        enum:
+                        - All
+                        - Selector
+                        - Same
+                        - None
+                        type: string
+                      selector:
+                        description: |-
+                          Selector must be specified when From is set to "Selector". In that case,
+                          only ListenerSets in Namespaces matching this Selector will be selected by this
+                          Gateway. This field is ignored for other values of "From".
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                type: object
               backendTLS:
                 description: |-
                   BackendTLS configures TLS settings for when this Gateway is connecting to
@@ -480,6 +561,8 @@ spec:
                   Implementations MAY merge separate Gateways onto a single set of
                   Addresses if all Listeners across all Gateways are compatible.
 
+                  In a future release the MinItems=1 requirement MAY be dropped.
+
                   Support: Core
                 items:
                   description: |-
@@ -575,6 +658,7 @@ spec:
                               - All
                               - Selector
                               - Same
+                              - None
                               type: string
                             selector:
                               description: |-
@@ -641,10 +725,31 @@ spec:
 
                         * TLS: The Listener Hostname MUST match the SNI.
                         * HTTP: The Listener Hostname MUST match the Host header of the request.
-                        * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
-                          protocol layers as described above. If an implementation does not
-                          ensure that both the SNI and Host header match the Listener hostname,
-                          it MUST clearly document that.
+                        * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.
+                          Note that this does not require the SNI and Host header to be the same.
+                          The semantics of this are described in more detail below.
+
+                        To ensure security, Section 11.1 of RFC-6066 emphasizes that server
+                        implementations that rely on SNI hostname matching MUST also verify
+                        hostnames within the application protocol.
+
+                        Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the
+                        reuse of a connection by responding with the HTTP 421 Misdirected Request
+                        status code. This indicates that the origin server has rejected the
+                        request because it appears to have been misdirected.
+
+                        To detect misdirected requests, Gateways SHOULD match the authority of
+                        the requests with all the SNI hostname(s) configured across all the
+                        Gateway Listeners on the same port and protocol:
+
+                        * If another Listener has an exact match or more specific wildcard entry,
+                          the Gateway SHOULD return a 421.
+                        * If the current Listener (selected by SNI matching during ClientHello)
+                          does not match the Host:
+                            * If another Listener does match the Host the Gateway SHOULD return a
+                              421.
+                            * If no other Listener matches the Host, the Gateway MUST return a
+                              404.
 
                         For HTTPRoute and TLSRoute resources, there is an interaction with the
                         `spec.hostnames` array. When both listener and route specify hostnames,
@@ -830,7 +935,7 @@ spec:
                                   group:
                                     description: |-
                                       Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                      When unspecified or empty string, core API group is inferred.
+                                      When set to the empty string, core API group is inferred.
                                     maxLength: 253
                                     pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                     type: string
@@ -1367,6 +1472,87 @@ spec:
                 - message: Hostname values must be unique
                   rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
                     a2.type == a1.type && a2.value == a1.value) : true )'
+              allowedListeners:
+                description: |-
+                  AllowedListeners defines which ListenerSets can be attached to this Gateway.
+                  While this feature is experimental, the default value is to allow no ListenerSets.
+                properties:
+                  namespaces:
+                    default:
+                      from: None
+                    description: |-
+                      Namespaces defines which namespaces ListenerSets can be attached to this Gateway.
+                      While this feature is experimental, the default value is to allow no ListenerSets.
+                    properties:
+                      from:
+                        default: None
+                        description: |-
+                          From indicates where ListenerSets can attach to this Gateway. Possible
+                          values are:
+
+                          * Same: Only ListenerSets in the same namespace may be attached to this Gateway.
+                          * Selector: ListenerSets in namespaces selected by the selector may be attached to this Gateway.
+                          * All: ListenerSets in all namespaces may be attached to this Gateway.
+                          * None: Only listeners defined in the Gateway's spec are allowed
+
+                          While this feature is experimental, the default value None
+                        enum:
+                        - All
+                        - Selector
+                        - Same
+                        - None
+                        type: string
+                      selector:
+                        description: |-
+                          Selector must be specified when From is set to "Selector". In that case,
+                          only ListenerSets in Namespaces matching this Selector will be selected by this
+                          Gateway. This field is ignored for other values of "From".
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                type: object
               backendTLS:
                 description: |-
                   BackendTLS configures TLS settings for when this Gateway is connecting to
@@ -1714,6 +1900,8 @@ spec:
                   Implementations MAY merge separate Gateways onto a single set of
                   Addresses if all Listeners across all Gateways are compatible.
 
+                  In a future release the MinItems=1 requirement MAY be dropped.
+
                   Support: Core
                 items:
                   description: |-
@@ -1809,6 +1997,7 @@ spec:
                               - All
                               - Selector
                               - Same
+                              - None
                               type: string
                             selector:
                               description: |-
@@ -1875,10 +2064,31 @@ spec:
 
                         * TLS: The Listener Hostname MUST match the SNI.
                         * HTTP: The Listener Hostname MUST match the Host header of the request.
-                        * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
-                          protocol layers as described above. If an implementation does not
-                          ensure that both the SNI and Host header match the Listener hostname,
-                          it MUST clearly document that.
+                        * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.
+                          Note that this does not require the SNI and Host header to be the same.
+                          The semantics of this are described in more detail below.
+
+                        To ensure security, Section 11.1 of RFC-6066 emphasizes that server
+                        implementations that rely on SNI hostname matching MUST also verify
+                        hostnames within the application protocol.
+
+                        Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the
+                        reuse of a connection by responding with the HTTP 421 Misdirected Request
+                        status code. This indicates that the origin server has rejected the
+                        request because it appears to have been misdirected.
+
+                        To detect misdirected requests, Gateways SHOULD match the authority of
+                        the requests with all the SNI hostname(s) configured across all the
+                        Gateway Listeners on the same port and protocol:
+
+                        * If another Listener has an exact match or more specific wildcard entry,
+                          the Gateway SHOULD return a 421.
+                        * If the current Listener (selected by SNI matching during ClientHello)
+                          does not match the Host:
+                            * If another Listener does match the Host the Gateway SHOULD return a
+                              421.
+                            * If no other Listener matches the Host, the Gateway MUST return a
+                              404.
 
                         For HTTPRoute and TLSRoute resources, there is an interaction with the
                         `spec.hostnames` array. When both listener and route specify hostnames,
@@ -2064,7 +2274,7 @@ spec:
                                   group:
                                     description: |-
                                       Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                      When unspecified or empty string, core API group is inferred.
+                                      When set to the empty string, core API group is inferred.
                                     maxLength: 253
                                     pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                     type: string
diff --git a/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
index ad994473..f532da37 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
@@ -532,7 +532,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -607,7 +607,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -815,7 +815,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -890,7 +890,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -1099,7 +1099,7 @@ spec:
                         Specifying the same filter multiple times is not supported unless explicitly
                         indicated in the filter.
 
-                        If an implementation can not support a combination of filters, it must clearly
+                        If an implementation cannot support a combination of filters, it must clearly
                         document that limitation. In cases where incompatible or unsupported
                         filters are specified and cause the `Accepted` condition to be set to status
                         `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -1182,7 +1182,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1256,7 +1256,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1463,7 +1463,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1537,7 +1537,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1805,7 +1805,7 @@ spec:
                                 has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""):
                                 true'
                         type: object
-                      maxItems: 8
+                      maxItems: 64
                       type: array
                     name:
                       description: |-
@@ -1975,7 +1975,7 @@ spec:
                         There are a number of cases where the "Accepted" condition may not be set
                         due to lack of controller visibility, that includes when:
 
-                        * The Route refers to a non-existent parent.
+                        * The Route refers to a nonexistent parent.
                         * The Route is of a type that the controller does not support.
                         * The Route is in a namespace the controller does not have access to.
                       items:
diff --git a/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
index 527c795f..a0229b9a 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
@@ -456,6 +456,285 @@ spec:
                                 authentication strategies, rate-limiting, and traffic shaping. API
                                 guarantee/conformance is defined based on the type of the filter.
                               properties:
+                                cors:
+                                  description: |-
+                                    CORS defines a schema for a filter that responds to the
+                                    cross-origin request based on HTTP response header.
+
+                                    Support: Extended
+                                  properties:
+                                    allowCredentials:
+                                      description: |-
+                                        AllowCredentials indicates whether the actual cross-origin request allows
+                                        to include credentials.
+
+                                        The only valid value for the `Access-Control-Allow-Credentials` response
+                                        header is true (case-sensitive).
+
+                                        If the credentials are not allowed in cross-origin requests, the gateway
+                                        will omit the header `Access-Control-Allow-Credentials` entirely rather
+                                        than setting its value to false.
+
+                                        Support: Extended
+                                      enum:
+                                      - true
+                                      type: boolean
+                                    allowHeaders:
+                                      description: |-
+                                        AllowHeaders indicates which HTTP request headers are supported for
+                                        accessing the requested resource.
+
+                                        Header names are not case sensitive.
+
+                                        Multiple header names in the value of the `Access-Control-Allow-Headers`
+                                        response header are separated by a comma (",").
+
+                                        When the `AllowHeaders` field is configured with one or more headers, the
+                                        gateway must return the `Access-Control-Allow-Headers` response header
+                                        which value is present in the `AllowHeaders` field.
+
+                                        If any header name in the `Access-Control-Request-Headers` request header
+                                        is not included in the list of header names specified by the response
+                                        header `Access-Control-Allow-Headers`, it will present an error on the
+                                        client side.
+
+                                        If any header name in the `Access-Control-Allow-Headers` response header
+                                        does not recognize by the client, it will also occur an error on the
+                                        client side.
+
+                                        A wildcard indicates that the requests with all HTTP headers are allowed.
+                                        The `Access-Control-Allow-Headers` response header can only use `*`
+                                        wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                        When the `AllowCredentials` field is specified and `AllowHeaders` field
+                                        specified with the `*` wildcard, the gateway must specify one or more
+                                        HTTP headers in the value of the `Access-Control-Allow-Headers` response
+                                        header. The value of the header `Access-Control-Allow-Headers` is same as
+                                        the `Access-Control-Request-Headers` header provided by the client. If
+                                        the header `Access-Control-Request-Headers` is not included in the
+                                        request, the gateway will omit the `Access-Control-Allow-Headers`
+                                        response header, instead of specifying the `*` wildcard. A Gateway
+                                        implementation may choose to add implementation-specific default headers.
+
+                                        Support: Extended
+                                      items:
+                                        description: |-
+                                          HTTPHeaderName is the name of an HTTP header.
+
+                                          Valid values include:
+
+                                          * "Authorization"
+                                          * "Set-Cookie"
+
+                                          Invalid values include:
+
+                                            - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                              headers are not currently supported by this type.
+                                            - "/invalid" - "/ " is an invalid character
+                                        maxLength: 256
+                                        minLength: 1
+                                        pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                        type: string
+                                      maxItems: 64
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    allowMethods:
+                                      description: |-
+                                        AllowMethods indicates which HTTP methods are supported for accessing the
+                                        requested resource.
+
+                                        Valid values are any method defined by RFC9110, along with the special
+                                        value `*`, which represents all HTTP methods are allowed.
+
+                                        Method names are case sensitive, so these values are also case-sensitive.
+                                        (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
+
+                                        Multiple method names in the value of the `Access-Control-Allow-Methods`
+                                        response header are separated by a comma (",").
+
+                                        A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
+                                        (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The
+                                        CORS-safelisted methods are always allowed, regardless of whether they
+                                        are specified in the `AllowMethods` field.
+
+                                        When the `AllowMethods` field is configured with one or more methods, the
+                                        gateway must return the `Access-Control-Allow-Methods` response header
+                                        which value is present in the `AllowMethods` field.
+
+                                        If the HTTP method of the `Access-Control-Request-Method` request header
+                                        is not included in the list of methods specified by the response header
+                                        `Access-Control-Allow-Methods`, it will present an error on the client
+                                        side.
+
+                                        The `Access-Control-Allow-Methods` response header can only use `*`
+                                        wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                        When the `AllowCredentials` field is specified and `AllowMethods` field
+                                        specified with the `*` wildcard, the gateway must specify one HTTP method
+                                        in the value of the Access-Control-Allow-Methods response header. The
+                                        value of the header `Access-Control-Allow-Methods` is same as the
+                                        `Access-Control-Request-Method` header provided by the client. If the
+                                        header `Access-Control-Request-Method` is not included in the request,
+                                        the gateway will omit the `Access-Control-Allow-Methods` response header,
+                                        instead of specifying the `*` wildcard. A Gateway implementation may
+                                        choose to add implementation-specific default methods.
+
+                                        Support: Extended
+                                      items:
+                                        enum:
+                                        - GET
+                                        - HEAD
+                                        - POST
+                                        - PUT
+                                        - DELETE
+                                        - CONNECT
+                                        - OPTIONS
+                                        - TRACE
+                                        - PATCH
+                                        - '*'
+                                        type: string
+                                      maxItems: 9
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    allowOrigins:
+                                      description: |-
+                                        AllowOrigins indicates whether the response can be shared with requested
+                                        resource from the given `Origin`.
+
+                                        The `Origin` consists of a scheme and a host, with an optional port, and
+                                        takes the form `<scheme>://<host>(:<port>)`.
+
+                                        Valid values for scheme are: `http` and `https`.
+
+                                        Valid values for port are any integer between 1 and 65535 (the list of
+                                        available TCP/UDP ports). Note that, if not included, port `80` is
+                                        assumed for `http` scheme origins, and port `443` is assumed for `https`
+                                        origins. This may affect origin matching.
+
+                                        The host part of the origin may contain the wildcard character `*`. These
+                                        wildcard characters behave as follows:
+
+                                        * `*` is a greedy match to the _left_, including any number of
+                                          DNS labels to the left of its position. This also means that
+                                          `*` will include any number of period `.` characters to the
+                                          left of its position.
+                                        * A wildcard by itself matches all hosts.
+
+                                        An origin value that includes _only_ the `*` character indicates requests
+                                        from all `Origin`s are allowed.
+
+                                        When the `AllowOrigins` field is configured with multiple origins, it
+                                        means the server supports clients from multiple origins. If the request
+                                        `Origin` matches the configured allowed origins, the gateway must return
+                                        the given `Origin` and sets value of the header
+                                        `Access-Control-Allow-Origin` same as the `Origin` header provided by the
+                                        client.
+
+                                        The status code of a successful response to a "preflight" request is
+                                        always an OK status (i.e., 204 or 200).
+
+                                        If the request `Origin` does not match the configured allowed origins,
+                                        the gateway returns 204/200 response but doesn't set the relevant
+                                        cross-origin response headers. Alternatively, the gateway responds with
+                                        403 status to the "preflight" request is denied, coupled with omitting
+                                        the CORS headers. The cross-origin request fails on the client side.
+                                        Therefore, the client doesn't attempt the actual cross-origin request.
+
+                                        The `Access-Control-Allow-Origin` response header can only use `*`
+                                        wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                        When the `AllowCredentials` field is specified and `AllowOrigins` field
+                                        specified with the `*` wildcard, the gateway must return a single origin
+                                        in the value of the `Access-Control-Allow-Origin` response header,
+                                        instead of specifying the `*` wildcard. The value of the header
+                                        `Access-Control-Allow-Origin` is same as the `Origin` header provided by
+                                        the client.
+
+                                        Support: Extended
+                                      items:
+                                        description: |-
+                                          The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                          encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
+                                          scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
+                                          include an authority MUST include a fully qualified domain name or
+                                          IP address as the host.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                        type: string
+                                      maxItems: 64
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    exposeHeaders:
+                                      description: |-
+                                        ExposeHeaders indicates which HTTP response headers can be exposed
+                                        to client-side scripts in response to a cross-origin request.
+
+                                        A CORS-safelisted response header is an HTTP header in a CORS response
+                                        that it is considered safe to expose to the client scripts.
+                                        The CORS-safelisted response headers include the following headers:
+                                        `Cache-Control`
+                                        `Content-Language`
+                                        `Content-Length`
+                                        `Content-Type`
+                                        `Expires`
+                                        `Last-Modified`
+                                        `Pragma`
+                                        (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name)
+                                        The CORS-safelisted response headers are exposed to client by default.
+
+                                        When an HTTP header name is specified using the `ExposeHeaders` field,
+                                        this additional header will be exposed as part of the response to the
+                                        client.
+
+                                        Header names are not case sensitive.
+
+                                        Multiple header names in the value of the `Access-Control-Expose-Headers`
+                                        response header are separated by a comma (",").
+
+                                        A wildcard indicates that the responses with all HTTP headers are exposed
+                                        to clients. The `Access-Control-Expose-Headers` response header can only
+                                        use `*` wildcard as value when the `AllowCredentials` field is
+                                        unspecified.
+
+                                        Support: Extended
+                                      items:
+                                        description: |-
+                                          HTTPHeaderName is the name of an HTTP header.
+
+                                          Valid values include:
+
+                                          * "Authorization"
+                                          * "Set-Cookie"
+
+                                          Invalid values include:
+
+                                            - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                              headers are not currently supported by this type.
+                                            - "/invalid" - "/ " is an invalid character
+                                        maxLength: 256
+                                        minLength: 1
+                                        pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                        type: string
+                                      maxItems: 64
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    maxAge:
+                                      default: 5
+                                      description: |-
+                                        MaxAge indicates the duration (in seconds) for the client to cache the
+                                        results of a "preflight" request.
+
+                                        The information provided by the `Access-Control-Allow-Methods` and
+                                        `Access-Control-Allow-Headers` response headers can be cached by the
+                                        client until the time specified by `Access-Control-Max-Age` elapses.
+
+                                        The default value of `Access-Control-Max-Age` response header is 5
+                                        (seconds).
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
                                 extensionRef:
                                   description: |-
                                     ExtensionRef is an optional, implementation-specific extension to the
@@ -524,7 +803,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -599,7 +878,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -960,7 +1239,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -1035,7 +1314,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -1103,6 +1382,7 @@ spec:
                                   - RequestRedirect
                                   - URLRewrite
                                   - ExtensionRef
+                                  - CORS
                                   type: string
                                 urlRewrite:
                                   description: |-
@@ -1235,6 +1515,11 @@ spec:
                               - message: filter.extensionRef must be specified for
                                   ExtensionRef filter.type
                                 rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
+                              - message: filter.cors must be nil if the filter.type
+                                  is not CORS
+                                rule: '!(has(self.cors) && self.type != ''CORS'')'
+                              - message: filter.cors must be specified for CORS filter.type
+                                rule: '!(!has(self.cors) && self.type == ''CORS'')'
                             maxItems: 16
                             type: array
                             x-kubernetes-validations:
@@ -1356,7 +1641,7 @@ spec:
                         they are specified.
 
                         Implementations MAY choose to implement this ordering strictly, rejecting
-                        any combination or order of filters that can not be supported. If implementations
+                        any combination or order of filters that cannot be supported. If implementations
                         choose a strict interpretation of filter ordering, they MUST clearly document
                         that behavior.
 
@@ -1378,7 +1663,7 @@ spec:
 
                         All filters are expected to be compatible with each other except for the
                         URLRewrite and RequestRedirect filters, which may not be combined. If an
-                        implementation can not support other combinations of filters, they must clearly
+                        implementation cannot support other combinations of filters, they must clearly
                         document that limitation. In cases where incompatible or unsupported
                         filters are specified and cause the `Accepted` condition to be set to status
                         `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -1394,6 +1679,285 @@ spec:
                           authentication strategies, rate-limiting, and traffic shaping. API
                           guarantee/conformance is defined based on the type of the filter.
                         properties:
+                          cors:
+                            description: |-
+                              CORS defines a schema for a filter that responds to the
+                              cross-origin request based on HTTP response header.
+
+                              Support: Extended
+                            properties:
+                              allowCredentials:
+                                description: |-
+                                  AllowCredentials indicates whether the actual cross-origin request allows
+                                  to include credentials.
+
+                                  The only valid value for the `Access-Control-Allow-Credentials` response
+                                  header is true (case-sensitive).
+
+                                  If the credentials are not allowed in cross-origin requests, the gateway
+                                  will omit the header `Access-Control-Allow-Credentials` entirely rather
+                                  than setting its value to false.
+
+                                  Support: Extended
+                                enum:
+                                - true
+                                type: boolean
+                              allowHeaders:
+                                description: |-
+                                  AllowHeaders indicates which HTTP request headers are supported for
+                                  accessing the requested resource.
+
+                                  Header names are not case sensitive.
+
+                                  Multiple header names in the value of the `Access-Control-Allow-Headers`
+                                  response header are separated by a comma (",").
+
+                                  When the `AllowHeaders` field is configured with one or more headers, the
+                                  gateway must return the `Access-Control-Allow-Headers` response header
+                                  which value is present in the `AllowHeaders` field.
+
+                                  If any header name in the `Access-Control-Request-Headers` request header
+                                  is not included in the list of header names specified by the response
+                                  header `Access-Control-Allow-Headers`, it will present an error on the
+                                  client side.
+
+                                  If any header name in the `Access-Control-Allow-Headers` response header
+                                  does not recognize by the client, it will also occur an error on the
+                                  client side.
+
+                                  A wildcard indicates that the requests with all HTTP headers are allowed.
+                                  The `Access-Control-Allow-Headers` response header can only use `*`
+                                  wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                  When the `AllowCredentials` field is specified and `AllowHeaders` field
+                                  specified with the `*` wildcard, the gateway must specify one or more
+                                  HTTP headers in the value of the `Access-Control-Allow-Headers` response
+                                  header. The value of the header `Access-Control-Allow-Headers` is same as
+                                  the `Access-Control-Request-Headers` header provided by the client. If
+                                  the header `Access-Control-Request-Headers` is not included in the
+                                  request, the gateway will omit the `Access-Control-Allow-Headers`
+                                  response header, instead of specifying the `*` wildcard. A Gateway
+                                  implementation may choose to add implementation-specific default headers.
+
+                                  Support: Extended
+                                items:
+                                  description: |-
+                                    HTTPHeaderName is the name of an HTTP header.
+
+                                    Valid values include:
+
+                                    * "Authorization"
+                                    * "Set-Cookie"
+
+                                    Invalid values include:
+
+                                      - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                        headers are not currently supported by this type.
+                                      - "/invalid" - "/ " is an invalid character
+                                  maxLength: 256
+                                  minLength: 1
+                                  pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                  type: string
+                                maxItems: 64
+                                type: array
+                                x-kubernetes-list-type: set
+                              allowMethods:
+                                description: |-
+                                  AllowMethods indicates which HTTP methods are supported for accessing the
+                                  requested resource.
+
+                                  Valid values are any method defined by RFC9110, along with the special
+                                  value `*`, which represents all HTTP methods are allowed.
+
+                                  Method names are case sensitive, so these values are also case-sensitive.
+                                  (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
+
+                                  Multiple method names in the value of the `Access-Control-Allow-Methods`
+                                  response header are separated by a comma (",").
+
+                                  A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
+                                  (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The
+                                  CORS-safelisted methods are always allowed, regardless of whether they
+                                  are specified in the `AllowMethods` field.
+
+                                  When the `AllowMethods` field is configured with one or more methods, the
+                                  gateway must return the `Access-Control-Allow-Methods` response header
+                                  which value is present in the `AllowMethods` field.
+
+                                  If the HTTP method of the `Access-Control-Request-Method` request header
+                                  is not included in the list of methods specified by the response header
+                                  `Access-Control-Allow-Methods`, it will present an error on the client
+                                  side.
+
+                                  The `Access-Control-Allow-Methods` response header can only use `*`
+                                  wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                  When the `AllowCredentials` field is specified and `AllowMethods` field
+                                  specified with the `*` wildcard, the gateway must specify one HTTP method
+                                  in the value of the Access-Control-Allow-Methods response header. The
+                                  value of the header `Access-Control-Allow-Methods` is same as the
+                                  `Access-Control-Request-Method` header provided by the client. If the
+                                  header `Access-Control-Request-Method` is not included in the request,
+                                  the gateway will omit the `Access-Control-Allow-Methods` response header,
+                                  instead of specifying the `*` wildcard. A Gateway implementation may
+                                  choose to add implementation-specific default methods.
+
+                                  Support: Extended
+                                items:
+                                  enum:
+                                  - GET
+                                  - HEAD
+                                  - POST
+                                  - PUT
+                                  - DELETE
+                                  - CONNECT
+                                  - OPTIONS
+                                  - TRACE
+                                  - PATCH
+                                  - '*'
+                                  type: string
+                                maxItems: 9
+                                type: array
+                                x-kubernetes-list-type: set
+                              allowOrigins:
+                                description: |-
+                                  AllowOrigins indicates whether the response can be shared with requested
+                                  resource from the given `Origin`.
+
+                                  The `Origin` consists of a scheme and a host, with an optional port, and
+                                  takes the form `<scheme>://<host>(:<port>)`.
+
+                                  Valid values for scheme are: `http` and `https`.
+
+                                  Valid values for port are any integer between 1 and 65535 (the list of
+                                  available TCP/UDP ports). Note that, if not included, port `80` is
+                                  assumed for `http` scheme origins, and port `443` is assumed for `https`
+                                  origins. This may affect origin matching.
+
+                                  The host part of the origin may contain the wildcard character `*`. These
+                                  wildcard characters behave as follows:
+
+                                  * `*` is a greedy match to the _left_, including any number of
+                                    DNS labels to the left of its position. This also means that
+                                    `*` will include any number of period `.` characters to the
+                                    left of its position.
+                                  * A wildcard by itself matches all hosts.
+
+                                  An origin value that includes _only_ the `*` character indicates requests
+                                  from all `Origin`s are allowed.
+
+                                  When the `AllowOrigins` field is configured with multiple origins, it
+                                  means the server supports clients from multiple origins. If the request
+                                  `Origin` matches the configured allowed origins, the gateway must return
+                                  the given `Origin` and sets value of the header
+                                  `Access-Control-Allow-Origin` same as the `Origin` header provided by the
+                                  client.
+
+                                  The status code of a successful response to a "preflight" request is
+                                  always an OK status (i.e., 204 or 200).
+
+                                  If the request `Origin` does not match the configured allowed origins,
+                                  the gateway returns 204/200 response but doesn't set the relevant
+                                  cross-origin response headers. Alternatively, the gateway responds with
+                                  403 status to the "preflight" request is denied, coupled with omitting
+                                  the CORS headers. The cross-origin request fails on the client side.
+                                  Therefore, the client doesn't attempt the actual cross-origin request.
+
+                                  The `Access-Control-Allow-Origin` response header can only use `*`
+                                  wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                  When the `AllowCredentials` field is specified and `AllowOrigins` field
+                                  specified with the `*` wildcard, the gateway must return a single origin
+                                  in the value of the `Access-Control-Allow-Origin` response header,
+                                  instead of specifying the `*` wildcard. The value of the header
+                                  `Access-Control-Allow-Origin` is same as the `Origin` header provided by
+                                  the client.
+
+                                  Support: Extended
+                                items:
+                                  description: |-
+                                    The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                    encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
+                                    scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
+                                    include an authority MUST include a fully qualified domain name or
+                                    IP address as the host.
+                                  maxLength: 253
+                                  minLength: 1
+                                  pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                  type: string
+                                maxItems: 64
+                                type: array
+                                x-kubernetes-list-type: set
+                              exposeHeaders:
+                                description: |-
+                                  ExposeHeaders indicates which HTTP response headers can be exposed
+                                  to client-side scripts in response to a cross-origin request.
+
+                                  A CORS-safelisted response header is an HTTP header in a CORS response
+                                  that it is considered safe to expose to the client scripts.
+                                  The CORS-safelisted response headers include the following headers:
+                                  `Cache-Control`
+                                  `Content-Language`
+                                  `Content-Length`
+                                  `Content-Type`
+                                  `Expires`
+                                  `Last-Modified`
+                                  `Pragma`
+                                  (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name)
+                                  The CORS-safelisted response headers are exposed to client by default.
+
+                                  When an HTTP header name is specified using the `ExposeHeaders` field,
+                                  this additional header will be exposed as part of the response to the
+                                  client.
+
+                                  Header names are not case sensitive.
+
+                                  Multiple header names in the value of the `Access-Control-Expose-Headers`
+                                  response header are separated by a comma (",").
+
+                                  A wildcard indicates that the responses with all HTTP headers are exposed
+                                  to clients. The `Access-Control-Expose-Headers` response header can only
+                                  use `*` wildcard as value when the `AllowCredentials` field is
+                                  unspecified.
+
+                                  Support: Extended
+                                items:
+                                  description: |-
+                                    HTTPHeaderName is the name of an HTTP header.
+
+                                    Valid values include:
+
+                                    * "Authorization"
+                                    * "Set-Cookie"
+
+                                    Invalid values include:
+
+                                      - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                        headers are not currently supported by this type.
+                                      - "/invalid" - "/ " is an invalid character
+                                  maxLength: 256
+                                  minLength: 1
+                                  pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                  type: string
+                                maxItems: 64
+                                type: array
+                                x-kubernetes-list-type: set
+                              maxAge:
+                                default: 5
+                                description: |-
+                                  MaxAge indicates the duration (in seconds) for the client to cache the
+                                  results of a "preflight" request.
+
+                                  The information provided by the `Access-Control-Allow-Methods` and
+                                  `Access-Control-Allow-Headers` response headers can be cached by the
+                                  client until the time specified by `Access-Control-Max-Age` elapses.
+
+                                  The default value of `Access-Control-Max-Age` response header is 5
+                                  (seconds).
+                                format: int32
+                                minimum: 1
+                                type: integer
+                            type: object
                           extensionRef:
                             description: |-
                               ExtensionRef is an optional, implementation-specific extension to the
@@ -1461,7 +2025,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1535,7 +2099,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1895,7 +2459,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1969,7 +2533,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -2037,6 +2601,7 @@ spec:
                             - RequestRedirect
                             - URLRewrite
                             - ExtensionRef
+                            - CORS
                             type: string
                           urlRewrite:
                             description: |-
@@ -2166,6 +2731,11 @@ spec:
                         - message: filter.extensionRef must be specified for ExtensionRef
                             filter.type
                           rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
+                        - message: filter.cors must be nil if the filter.type is not
+                            CORS
+                          rule: '!(has(self.cors) && self.type != ''CORS'')'
+                        - message: filter.cors must be specified for CORS filter.type
+                          rule: '!(!has(self.cors) && self.type == ''CORS'')'
                       maxItems: 16
                       type: array
                       x-kubernetes-validations:
@@ -2269,7 +2839,7 @@ spec:
                                 name:
                                   description: |-
                                     Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                    case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                    case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                     If multiple entries specify equivalent header names, only the first
                                     entry with an equivalent name MUST be considered for a match. Subsequent
@@ -2830,7 +3400,7 @@ spec:
                         There are a number of cases where the "Accepted" condition may not be set
                         due to lack of controller visibility, that includes when:
 
-                        * The Route refers to a non-existent parent.
+                        * The Route refers to a nonexistent parent.
                         * The Route is of a type that the controller does not support.
                         * The Route is in a namespace the controller does not have access to.
                       items:
@@ -3504,6 +4074,285 @@ spec:
                                 authentication strategies, rate-limiting, and traffic shaping. API
                                 guarantee/conformance is defined based on the type of the filter.
                               properties:
+                                cors:
+                                  description: |-
+                                    CORS defines a schema for a filter that responds to the
+                                    cross-origin request based on HTTP response header.
+
+                                    Support: Extended
+                                  properties:
+                                    allowCredentials:
+                                      description: |-
+                                        AllowCredentials indicates whether the actual cross-origin request allows
+                                        to include credentials.
+
+                                        The only valid value for the `Access-Control-Allow-Credentials` response
+                                        header is true (case-sensitive).
+
+                                        If the credentials are not allowed in cross-origin requests, the gateway
+                                        will omit the header `Access-Control-Allow-Credentials` entirely rather
+                                        than setting its value to false.
+
+                                        Support: Extended
+                                      enum:
+                                      - true
+                                      type: boolean
+                                    allowHeaders:
+                                      description: |-
+                                        AllowHeaders indicates which HTTP request headers are supported for
+                                        accessing the requested resource.
+
+                                        Header names are not case sensitive.
+
+                                        Multiple header names in the value of the `Access-Control-Allow-Headers`
+                                        response header are separated by a comma (",").
+
+                                        When the `AllowHeaders` field is configured with one or more headers, the
+                                        gateway must return the `Access-Control-Allow-Headers` response header
+                                        which value is present in the `AllowHeaders` field.
+
+                                        If any header name in the `Access-Control-Request-Headers` request header
+                                        is not included in the list of header names specified by the response
+                                        header `Access-Control-Allow-Headers`, it will present an error on the
+                                        client side.
+
+                                        If any header name in the `Access-Control-Allow-Headers` response header
+                                        does not recognize by the client, it will also occur an error on the
+                                        client side.
+
+                                        A wildcard indicates that the requests with all HTTP headers are allowed.
+                                        The `Access-Control-Allow-Headers` response header can only use `*`
+                                        wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                        When the `AllowCredentials` field is specified and `AllowHeaders` field
+                                        specified with the `*` wildcard, the gateway must specify one or more
+                                        HTTP headers in the value of the `Access-Control-Allow-Headers` response
+                                        header. The value of the header `Access-Control-Allow-Headers` is same as
+                                        the `Access-Control-Request-Headers` header provided by the client. If
+                                        the header `Access-Control-Request-Headers` is not included in the
+                                        request, the gateway will omit the `Access-Control-Allow-Headers`
+                                        response header, instead of specifying the `*` wildcard. A Gateway
+                                        implementation may choose to add implementation-specific default headers.
+
+                                        Support: Extended
+                                      items:
+                                        description: |-
+                                          HTTPHeaderName is the name of an HTTP header.
+
+                                          Valid values include:
+
+                                          * "Authorization"
+                                          * "Set-Cookie"
+
+                                          Invalid values include:
+
+                                            - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                              headers are not currently supported by this type.
+                                            - "/invalid" - "/ " is an invalid character
+                                        maxLength: 256
+                                        minLength: 1
+                                        pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                        type: string
+                                      maxItems: 64
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    allowMethods:
+                                      description: |-
+                                        AllowMethods indicates which HTTP methods are supported for accessing the
+                                        requested resource.
+
+                                        Valid values are any method defined by RFC9110, along with the special
+                                        value `*`, which represents all HTTP methods are allowed.
+
+                                        Method names are case sensitive, so these values are also case-sensitive.
+                                        (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
+
+                                        Multiple method names in the value of the `Access-Control-Allow-Methods`
+                                        response header are separated by a comma (",").
+
+                                        A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
+                                        (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The
+                                        CORS-safelisted methods are always allowed, regardless of whether they
+                                        are specified in the `AllowMethods` field.
+
+                                        When the `AllowMethods` field is configured with one or more methods, the
+                                        gateway must return the `Access-Control-Allow-Methods` response header
+                                        which value is present in the `AllowMethods` field.
+
+                                        If the HTTP method of the `Access-Control-Request-Method` request header
+                                        is not included in the list of methods specified by the response header
+                                        `Access-Control-Allow-Methods`, it will present an error on the client
+                                        side.
+
+                                        The `Access-Control-Allow-Methods` response header can only use `*`
+                                        wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                        When the `AllowCredentials` field is specified and `AllowMethods` field
+                                        specified with the `*` wildcard, the gateway must specify one HTTP method
+                                        in the value of the Access-Control-Allow-Methods response header. The
+                                        value of the header `Access-Control-Allow-Methods` is same as the
+                                        `Access-Control-Request-Method` header provided by the client. If the
+                                        header `Access-Control-Request-Method` is not included in the request,
+                                        the gateway will omit the `Access-Control-Allow-Methods` response header,
+                                        instead of specifying the `*` wildcard. A Gateway implementation may
+                                        choose to add implementation-specific default methods.
+
+                                        Support: Extended
+                                      items:
+                                        enum:
+                                        - GET
+                                        - HEAD
+                                        - POST
+                                        - PUT
+                                        - DELETE
+                                        - CONNECT
+                                        - OPTIONS
+                                        - TRACE
+                                        - PATCH
+                                        - '*'
+                                        type: string
+                                      maxItems: 9
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    allowOrigins:
+                                      description: |-
+                                        AllowOrigins indicates whether the response can be shared with requested
+                                        resource from the given `Origin`.
+
+                                        The `Origin` consists of a scheme and a host, with an optional port, and
+                                        takes the form `<scheme>://<host>(:<port>)`.
+
+                                        Valid values for scheme are: `http` and `https`.
+
+                                        Valid values for port are any integer between 1 and 65535 (the list of
+                                        available TCP/UDP ports). Note that, if not included, port `80` is
+                                        assumed for `http` scheme origins, and port `443` is assumed for `https`
+                                        origins. This may affect origin matching.
+
+                                        The host part of the origin may contain the wildcard character `*`. These
+                                        wildcard characters behave as follows:
+
+                                        * `*` is a greedy match to the _left_, including any number of
+                                          DNS labels to the left of its position. This also means that
+                                          `*` will include any number of period `.` characters to the
+                                          left of its position.
+                                        * A wildcard by itself matches all hosts.
+
+                                        An origin value that includes _only_ the `*` character indicates requests
+                                        from all `Origin`s are allowed.
+
+                                        When the `AllowOrigins` field is configured with multiple origins, it
+                                        means the server supports clients from multiple origins. If the request
+                                        `Origin` matches the configured allowed origins, the gateway must return
+                                        the given `Origin` and sets value of the header
+                                        `Access-Control-Allow-Origin` same as the `Origin` header provided by the
+                                        client.
+
+                                        The status code of a successful response to a "preflight" request is
+                                        always an OK status (i.e., 204 or 200).
+
+                                        If the request `Origin` does not match the configured allowed origins,
+                                        the gateway returns 204/200 response but doesn't set the relevant
+                                        cross-origin response headers. Alternatively, the gateway responds with
+                                        403 status to the "preflight" request is denied, coupled with omitting
+                                        the CORS headers. The cross-origin request fails on the client side.
+                                        Therefore, the client doesn't attempt the actual cross-origin request.
+
+                                        The `Access-Control-Allow-Origin` response header can only use `*`
+                                        wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                        When the `AllowCredentials` field is specified and `AllowOrigins` field
+                                        specified with the `*` wildcard, the gateway must return a single origin
+                                        in the value of the `Access-Control-Allow-Origin` response header,
+                                        instead of specifying the `*` wildcard. The value of the header
+                                        `Access-Control-Allow-Origin` is same as the `Origin` header provided by
+                                        the client.
+
+                                        Support: Extended
+                                      items:
+                                        description: |-
+                                          The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                          encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
+                                          scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
+                                          include an authority MUST include a fully qualified domain name or
+                                          IP address as the host.
+                                        maxLength: 253
+                                        minLength: 1
+                                        pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                        type: string
+                                      maxItems: 64
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    exposeHeaders:
+                                      description: |-
+                                        ExposeHeaders indicates which HTTP response headers can be exposed
+                                        to client-side scripts in response to a cross-origin request.
+
+                                        A CORS-safelisted response header is an HTTP header in a CORS response
+                                        that it is considered safe to expose to the client scripts.
+                                        The CORS-safelisted response headers include the following headers:
+                                        `Cache-Control`
+                                        `Content-Language`
+                                        `Content-Length`
+                                        `Content-Type`
+                                        `Expires`
+                                        `Last-Modified`
+                                        `Pragma`
+                                        (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name)
+                                        The CORS-safelisted response headers are exposed to client by default.
+
+                                        When an HTTP header name is specified using the `ExposeHeaders` field,
+                                        this additional header will be exposed as part of the response to the
+                                        client.
+
+                                        Header names are not case sensitive.
+
+                                        Multiple header names in the value of the `Access-Control-Expose-Headers`
+                                        response header are separated by a comma (",").
+
+                                        A wildcard indicates that the responses with all HTTP headers are exposed
+                                        to clients. The `Access-Control-Expose-Headers` response header can only
+                                        use `*` wildcard as value when the `AllowCredentials` field is
+                                        unspecified.
+
+                                        Support: Extended
+                                      items:
+                                        description: |-
+                                          HTTPHeaderName is the name of an HTTP header.
+
+                                          Valid values include:
+
+                                          * "Authorization"
+                                          * "Set-Cookie"
+
+                                          Invalid values include:
+
+                                            - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                              headers are not currently supported by this type.
+                                            - "/invalid" - "/ " is an invalid character
+                                        maxLength: 256
+                                        minLength: 1
+                                        pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                        type: string
+                                      maxItems: 64
+                                      type: array
+                                      x-kubernetes-list-type: set
+                                    maxAge:
+                                      default: 5
+                                      description: |-
+                                        MaxAge indicates the duration (in seconds) for the client to cache the
+                                        results of a "preflight" request.
+
+                                        The information provided by the `Access-Control-Allow-Methods` and
+                                        `Access-Control-Allow-Headers` response headers can be cached by the
+                                        client until the time specified by `Access-Control-Max-Age` elapses.
+
+                                        The default value of `Access-Control-Max-Age` response header is 5
+                                        (seconds).
+                                      format: int32
+                                      minimum: 1
+                                      type: integer
+                                  type: object
                                 extensionRef:
                                   description: |-
                                     ExtensionRef is an optional, implementation-specific extension to the
@@ -3572,7 +4421,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -3647,7 +4496,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -4008,7 +4857,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -4083,7 +4932,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -4151,6 +5000,7 @@ spec:
                                   - RequestRedirect
                                   - URLRewrite
                                   - ExtensionRef
+                                  - CORS
                                   type: string
                                 urlRewrite:
                                   description: |-
@@ -4283,6 +5133,11 @@ spec:
                               - message: filter.extensionRef must be specified for
                                   ExtensionRef filter.type
                                 rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
+                              - message: filter.cors must be nil if the filter.type
+                                  is not CORS
+                                rule: '!(has(self.cors) && self.type != ''CORS'')'
+                              - message: filter.cors must be specified for CORS filter.type
+                                rule: '!(!has(self.cors) && self.type == ''CORS'')'
                             maxItems: 16
                             type: array
                             x-kubernetes-validations:
@@ -4404,7 +5259,7 @@ spec:
                         they are specified.
 
                         Implementations MAY choose to implement this ordering strictly, rejecting
-                        any combination or order of filters that can not be supported. If implementations
+                        any combination or order of filters that cannot be supported. If implementations
                         choose a strict interpretation of filter ordering, they MUST clearly document
                         that behavior.
 
@@ -4426,7 +5281,7 @@ spec:
 
                         All filters are expected to be compatible with each other except for the
                         URLRewrite and RequestRedirect filters, which may not be combined. If an
-                        implementation can not support other combinations of filters, they must clearly
+                        implementation cannot support other combinations of filters, they must clearly
                         document that limitation. In cases where incompatible or unsupported
                         filters are specified and cause the `Accepted` condition to be set to status
                         `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -4442,6 +5297,285 @@ spec:
                           authentication strategies, rate-limiting, and traffic shaping. API
                           guarantee/conformance is defined based on the type of the filter.
                         properties:
+                          cors:
+                            description: |-
+                              CORS defines a schema for a filter that responds to the
+                              cross-origin request based on HTTP response header.
+
+                              Support: Extended
+                            properties:
+                              allowCredentials:
+                                description: |-
+                                  AllowCredentials indicates whether the actual cross-origin request allows
+                                  to include credentials.
+
+                                  The only valid value for the `Access-Control-Allow-Credentials` response
+                                  header is true (case-sensitive).
+
+                                  If the credentials are not allowed in cross-origin requests, the gateway
+                                  will omit the header `Access-Control-Allow-Credentials` entirely rather
+                                  than setting its value to false.
+
+                                  Support: Extended
+                                enum:
+                                - true
+                                type: boolean
+                              allowHeaders:
+                                description: |-
+                                  AllowHeaders indicates which HTTP request headers are supported for
+                                  accessing the requested resource.
+
+                                  Header names are not case sensitive.
+
+                                  Multiple header names in the value of the `Access-Control-Allow-Headers`
+                                  response header are separated by a comma (",").
+
+                                  When the `AllowHeaders` field is configured with one or more headers, the
+                                  gateway must return the `Access-Control-Allow-Headers` response header
+                                  which value is present in the `AllowHeaders` field.
+
+                                  If any header name in the `Access-Control-Request-Headers` request header
+                                  is not included in the list of header names specified by the response
+                                  header `Access-Control-Allow-Headers`, it will present an error on the
+                                  client side.
+
+                                  If any header name in the `Access-Control-Allow-Headers` response header
+                                  does not recognize by the client, it will also occur an error on the
+                                  client side.
+
+                                  A wildcard indicates that the requests with all HTTP headers are allowed.
+                                  The `Access-Control-Allow-Headers` response header can only use `*`
+                                  wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                  When the `AllowCredentials` field is specified and `AllowHeaders` field
+                                  specified with the `*` wildcard, the gateway must specify one or more
+                                  HTTP headers in the value of the `Access-Control-Allow-Headers` response
+                                  header. The value of the header `Access-Control-Allow-Headers` is same as
+                                  the `Access-Control-Request-Headers` header provided by the client. If
+                                  the header `Access-Control-Request-Headers` is not included in the
+                                  request, the gateway will omit the `Access-Control-Allow-Headers`
+                                  response header, instead of specifying the `*` wildcard. A Gateway
+                                  implementation may choose to add implementation-specific default headers.
+
+                                  Support: Extended
+                                items:
+                                  description: |-
+                                    HTTPHeaderName is the name of an HTTP header.
+
+                                    Valid values include:
+
+                                    * "Authorization"
+                                    * "Set-Cookie"
+
+                                    Invalid values include:
+
+                                      - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                        headers are not currently supported by this type.
+                                      - "/invalid" - "/ " is an invalid character
+                                  maxLength: 256
+                                  minLength: 1
+                                  pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                  type: string
+                                maxItems: 64
+                                type: array
+                                x-kubernetes-list-type: set
+                              allowMethods:
+                                description: |-
+                                  AllowMethods indicates which HTTP methods are supported for accessing the
+                                  requested resource.
+
+                                  Valid values are any method defined by RFC9110, along with the special
+                                  value `*`, which represents all HTTP methods are allowed.
+
+                                  Method names are case sensitive, so these values are also case-sensitive.
+                                  (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
+
+                                  Multiple method names in the value of the `Access-Control-Allow-Methods`
+                                  response header are separated by a comma (",").
+
+                                  A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
+                                  (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The
+                                  CORS-safelisted methods are always allowed, regardless of whether they
+                                  are specified in the `AllowMethods` field.
+
+                                  When the `AllowMethods` field is configured with one or more methods, the
+                                  gateway must return the `Access-Control-Allow-Methods` response header
+                                  which value is present in the `AllowMethods` field.
+
+                                  If the HTTP method of the `Access-Control-Request-Method` request header
+                                  is not included in the list of methods specified by the response header
+                                  `Access-Control-Allow-Methods`, it will present an error on the client
+                                  side.
+
+                                  The `Access-Control-Allow-Methods` response header can only use `*`
+                                  wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                  When the `AllowCredentials` field is specified and `AllowMethods` field
+                                  specified with the `*` wildcard, the gateway must specify one HTTP method
+                                  in the value of the Access-Control-Allow-Methods response header. The
+                                  value of the header `Access-Control-Allow-Methods` is same as the
+                                  `Access-Control-Request-Method` header provided by the client. If the
+                                  header `Access-Control-Request-Method` is not included in the request,
+                                  the gateway will omit the `Access-Control-Allow-Methods` response header,
+                                  instead of specifying the `*` wildcard. A Gateway implementation may
+                                  choose to add implementation-specific default methods.
+
+                                  Support: Extended
+                                items:
+                                  enum:
+                                  - GET
+                                  - HEAD
+                                  - POST
+                                  - PUT
+                                  - DELETE
+                                  - CONNECT
+                                  - OPTIONS
+                                  - TRACE
+                                  - PATCH
+                                  - '*'
+                                  type: string
+                                maxItems: 9
+                                type: array
+                                x-kubernetes-list-type: set
+                              allowOrigins:
+                                description: |-
+                                  AllowOrigins indicates whether the response can be shared with requested
+                                  resource from the given `Origin`.
+
+                                  The `Origin` consists of a scheme and a host, with an optional port, and
+                                  takes the form `<scheme>://<host>(:<port>)`.
+
+                                  Valid values for scheme are: `http` and `https`.
+
+                                  Valid values for port are any integer between 1 and 65535 (the list of
+                                  available TCP/UDP ports). Note that, if not included, port `80` is
+                                  assumed for `http` scheme origins, and port `443` is assumed for `https`
+                                  origins. This may affect origin matching.
+
+                                  The host part of the origin may contain the wildcard character `*`. These
+                                  wildcard characters behave as follows:
+
+                                  * `*` is a greedy match to the _left_, including any number of
+                                    DNS labels to the left of its position. This also means that
+                                    `*` will include any number of period `.` characters to the
+                                    left of its position.
+                                  * A wildcard by itself matches all hosts.
+
+                                  An origin value that includes _only_ the `*` character indicates requests
+                                  from all `Origin`s are allowed.
+
+                                  When the `AllowOrigins` field is configured with multiple origins, it
+                                  means the server supports clients from multiple origins. If the request
+                                  `Origin` matches the configured allowed origins, the gateway must return
+                                  the given `Origin` and sets value of the header
+                                  `Access-Control-Allow-Origin` same as the `Origin` header provided by the
+                                  client.
+
+                                  The status code of a successful response to a "preflight" request is
+                                  always an OK status (i.e., 204 or 200).
+
+                                  If the request `Origin` does not match the configured allowed origins,
+                                  the gateway returns 204/200 response but doesn't set the relevant
+                                  cross-origin response headers. Alternatively, the gateway responds with
+                                  403 status to the "preflight" request is denied, coupled with omitting
+                                  the CORS headers. The cross-origin request fails on the client side.
+                                  Therefore, the client doesn't attempt the actual cross-origin request.
+
+                                  The `Access-Control-Allow-Origin` response header can only use `*`
+                                  wildcard as value when the `AllowCredentials` field is unspecified.
+
+                                  When the `AllowCredentials` field is specified and `AllowOrigins` field
+                                  specified with the `*` wildcard, the gateway must return a single origin
+                                  in the value of the `Access-Control-Allow-Origin` response header,
+                                  instead of specifying the `*` wildcard. The value of the header
+                                  `Access-Control-Allow-Origin` is same as the `Origin` header provided by
+                                  the client.
+
+                                  Support: Extended
+                                items:
+                                  description: |-
+                                    The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                    encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
+                                    scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
+                                    include an authority MUST include a fully qualified domain name or
+                                    IP address as the host.
+                                  maxLength: 253
+                                  minLength: 1
+                                  pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                  type: string
+                                maxItems: 64
+                                type: array
+                                x-kubernetes-list-type: set
+                              exposeHeaders:
+                                description: |-
+                                  ExposeHeaders indicates which HTTP response headers can be exposed
+                                  to client-side scripts in response to a cross-origin request.
+
+                                  A CORS-safelisted response header is an HTTP header in a CORS response
+                                  that it is considered safe to expose to the client scripts.
+                                  The CORS-safelisted response headers include the following headers:
+                                  `Cache-Control`
+                                  `Content-Language`
+                                  `Content-Length`
+                                  `Content-Type`
+                                  `Expires`
+                                  `Last-Modified`
+                                  `Pragma`
+                                  (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name)
+                                  The CORS-safelisted response headers are exposed to client by default.
+
+                                  When an HTTP header name is specified using the `ExposeHeaders` field,
+                                  this additional header will be exposed as part of the response to the
+                                  client.
+
+                                  Header names are not case sensitive.
+
+                                  Multiple header names in the value of the `Access-Control-Expose-Headers`
+                                  response header are separated by a comma (",").
+
+                                  A wildcard indicates that the responses with all HTTP headers are exposed
+                                  to clients. The `Access-Control-Expose-Headers` response header can only
+                                  use `*` wildcard as value when the `AllowCredentials` field is
+                                  unspecified.
+
+                                  Support: Extended
+                                items:
+                                  description: |-
+                                    HTTPHeaderName is the name of an HTTP header.
+
+                                    Valid values include:
+
+                                    * "Authorization"
+                                    * "Set-Cookie"
+
+                                    Invalid values include:
+
+                                      - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
+                                        headers are not currently supported by this type.
+                                      - "/invalid" - "/ " is an invalid character
+                                  maxLength: 256
+                                  minLength: 1
+                                  pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
+                                  type: string
+                                maxItems: 64
+                                type: array
+                                x-kubernetes-list-type: set
+                              maxAge:
+                                default: 5
+                                description: |-
+                                  MaxAge indicates the duration (in seconds) for the client to cache the
+                                  results of a "preflight" request.
+
+                                  The information provided by the `Access-Control-Allow-Methods` and
+                                  `Access-Control-Allow-Headers` response headers can be cached by the
+                                  client until the time specified by `Access-Control-Max-Age` elapses.
+
+                                  The default value of `Access-Control-Max-Age` response header is 5
+                                  (seconds).
+                                format: int32
+                                minimum: 1
+                                type: integer
+                            type: object
                           extensionRef:
                             description: |-
                               ExtensionRef is an optional, implementation-specific extension to the
@@ -4509,7 +5643,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -4583,7 +5717,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -4943,7 +6077,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -5017,7 +6151,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -5085,6 +6219,7 @@ spec:
                             - RequestRedirect
                             - URLRewrite
                             - ExtensionRef
+                            - CORS
                             type: string
                           urlRewrite:
                             description: |-
@@ -5214,6 +6349,11 @@ spec:
                         - message: filter.extensionRef must be specified for ExtensionRef
                             filter.type
                           rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
+                        - message: filter.cors must be nil if the filter.type is not
+                            CORS
+                          rule: '!(has(self.cors) && self.type != ''CORS'')'
+                        - message: filter.cors must be specified for CORS filter.type
+                          rule: '!(!has(self.cors) && self.type == ''CORS'')'
                       maxItems: 16
                       type: array
                       x-kubernetes-validations:
@@ -5317,7 +6457,7 @@ spec:
                                 name:
                                   description: |-
                                     Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                    case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                    case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                     If multiple entries specify equivalent header names, only the first
                                     entry with an equivalent name MUST be considered for a match. Subsequent
@@ -5878,7 +7018,7 @@ spec:
                         There are a number of cases where the "Accepted" condition may not be set
                         due to lack of controller visibility, that includes when:
 
-                        * The Route refers to a non-existent parent.
+                        * The Route refers to a nonexistent parent.
                         * The Route is of a type that the controller does not support.
                         * The Route is in a namespace the controller does not have access to.
                       items:
diff --git a/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
index cdbeeb8c..5d711194 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
@@ -293,7 +293,7 @@ spec:
                     backendRefs:
                       description: |-
                         BackendRefs defines the backend(s) where matching requests should be
-                        sent. If unspecified or invalid (refers to a non-existent resource or a
+                        sent. If unspecified or invalid (refers to a nonexistent resource or a
                         Service with no endpoints), the underlying implementation MUST actively
                         reject connection attempts to this backend. Connection rejections must
                         respect weight; if an invalid backend is requested to have 80% of
@@ -488,7 +488,7 @@ spec:
                         There are a number of cases where the "Accepted" condition may not be set
                         due to lack of controller visibility, that includes when:
 
-                        * The Route refers to a non-existent parent.
+                        * The Route refers to a nonexistent parent.
                         * The Route is of a type that the controller does not support.
                         * The Route is in a namespace the controller does not have access to.
                       items:
diff --git a/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
index 3c5413f9..f3e63f56 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
@@ -353,7 +353,7 @@ spec:
                     backendRefs:
                       description: |-
                         BackendRefs defines the backend(s) where matching requests should be
-                        sent. If unspecified or invalid (refers to a non-existent resource or
+                        sent. If unspecified or invalid (refers to a nonexistent resource or
                         a Service with no endpoints), the rule performs no forwarding; if no
                         filters are specified that would result in a response being sent, the
                         underlying implementation must actively reject request attempts to this
@@ -551,7 +551,7 @@ spec:
                         There are a number of cases where the "Accepted" condition may not be set
                         due to lack of controller visibility, that includes when:
 
-                        * The Route refers to a non-existent parent.
+                        * The Route refers to a nonexistent parent.
                         * The Route is of a type that the controller does not support.
                         * The Route is in a namespace the controller does not have access to.
                       items:
diff --git a/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
index 5aec6abf..2bfcb7aa 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
@@ -293,7 +293,7 @@ spec:
                     backendRefs:
                       description: |-
                         BackendRefs defines the backend(s) where matching requests should be
-                        sent. If unspecified or invalid (refers to a non-existent resource or a
+                        sent. If unspecified or invalid (refers to a nonexistent resource or a
                         Service with no endpoints), the underlying implementation MUST actively
                         reject connection attempts to this backend. Packet drops must
                         respect weight; if an invalid backend is requested to have 80% of
@@ -488,7 +488,7 @@ spec:
                         There are a number of cases where the "Accepted" condition may not be set
                         due to lack of controller visibility, that includes when:
 
-                        * The Route refers to a non-existent parent.
+                        * The Route refers to a nonexistent parent.
                         * The Route is of a type that the controller does not support.
                         * The Route is in a namespace the controller does not have access to.
                       items:
diff --git a/config/crd/experimental/gateway.networking.x-k8s.io_backendtrafficpolicies.yaml b/config/crd/experimental/gateway.networking.x-k8s.io_backendtrafficpolicies.yaml
new file mode 100644
index 00000000..f1bc4245
--- /dev/null
+++ b/config/crd/experimental/gateway.networking.x-k8s.io_backendtrafficpolicies.yaml
@@ -0,0 +1,598 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/channel: experimental
+  creationTimestamp: null
+  labels:
+    gateway.networking.k8s.io/policy: Direct
+  name: backendtrafficpolicies.gateway.networking.x-k8s.io
+spec:
+  group: gateway.networking.x-k8s.io
+  names:
+    categories:
+    - gateway-api
+    kind: BackendTrafficPolicy
+    listKind: BackendTrafficPolicyList
+    plural: backendtrafficpolicies
+    shortNames:
+    - btrafficpolicy
+    singular: backendtrafficpolicy
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          BackendTrafficPolicy defines the configuration for how traffic to a
+          target backend should be handled.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of BackendTrafficPolicy.
+            properties:
+              retryConstraint:
+                description: |-
+                  RetryConstraint defines the configuration for when to allow or prevent
+                  further retries to a target backend, by dynamically calculating a 'retry
+                  budget'. This budget is calculated based on the percentage of incoming
+                  traffic composed of retries over a given time interval. Once the budget
+                  is exceeded, additional retries will be rejected.
+
+                  For example, if the retry budget interval is 10 seconds, there have been
+                  1000 active requests in the past 10 seconds, and the allowed percentage
+                  of requests that can be retried is 20% (the default), then 200 of those
+                  requests may be composed of retries. Active requests will only be
+                  considered for the duration of the interval when calculating the retry
+                  budget. Retrying the same original request multiple times within the
+                  retry budget interval will lead to each retry being counted towards
+                  calculating the budget.
+
+                  Configuring a RetryConstraint in BackendTrafficPolicy is compatible with
+                  HTTPRoute Retry settings for each HTTPRouteRule that targets the same
+                  backend. While the HTTPRouteRule Retry stanza can specify whether a
+                  request will be retried, and the number of retry attempts each client
+                  may perform, RetryConstraint helps prevent cascading failures such as
+                  retry storms during periods of consistent failures.
+
+                  After the retry budget has been exceeded, additional retries to the
+                  backend MUST return a 503 response to the client.
+
+                  Additional configurations for defining a constraint on retries MAY be
+                  defined in the future.
+
+                  Support: Extended
+                properties:
+                  budgetInterval:
+                    default: 10s
+                    description: |-
+                      BudgetInterval defines the duration in which requests will be considered
+                      for calculating the budget for retries.
+
+                      Support: Extended
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
+                    x-kubernetes-validations:
+                    - message: budgetInterval can not be greater than one hour or
+                        less than one second
+                      rule: '!(duration(self) < duration(''1s'') || duration(self)
+                        > duration(''1h''))'
+                  budgetPercent:
+                    default: 20
+                    description: |-
+                      BudgetPercent defines the maximum percentage of active requests that may
+                      be made up of retries.
+
+                      Support: Extended
+                    maximum: 100
+                    minimum: 0
+                    type: integer
+                  minRetryRate:
+                    default:
+                      count: 10
+                      interval: 1s
+                    description: |-
+                      MinRetryRate defines the minimum rate of retries that will be allowable
+                      over a specified duration of time.
+
+                      The effective overall minimum rate of retries targeting the backend
+                      service may be much higher, as there can be any number of clients which
+                      are applying this setting locally.
+
+                      This ensures that requests can still be retried during periods of low
+                      traffic, where the budget for retries may be calculated as a very low
+                      value.
+
+                      Support: Extended
+                    properties:
+                      count:
+                        description: |-
+                          Count specifies the number of requests per time interval.
+
+                          Support: Extended
+                        maximum: 1000000
+                        minimum: 1
+                        type: integer
+                      interval:
+                        description: |-
+                          Interval specifies the divisor of the rate of requests, the amount of
+                          time during which the given count of requests occur.
+
+                          Support: Extended
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                        type: string
+                        x-kubernetes-validations:
+                        - message: interval can not be greater than one hour
+                          rule: '!(duration(self) == duration(''0s'') || duration(self)
+                            > duration(''1h''))'
+                    type: object
+                type: object
+              sessionPersistence:
+                description: |-
+                  SessionPersistence defines and configures session persistence
+                  for the backend.
+
+                  Support: Extended
+                properties:
+                  absoluteTimeout:
+                    description: |-
+                      AbsoluteTimeout defines the absolute timeout of the persistent
+                      session. Once the AbsoluteTimeout duration has elapsed, the
+                      session becomes invalid.
+
+                      Support: Extended
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
+                  cookieConfig:
+                    description: |-
+                      CookieConfig provides configuration settings that are specific
+                      to cookie-based session persistence.
+
+                      Support: Core
+                    properties:
+                      lifetimeType:
+                        default: Session
+                        description: |-
+                          LifetimeType specifies whether the cookie has a permanent or
+                          session-based lifetime. A permanent cookie persists until its
+                          specified expiry time, defined by the Expires or Max-Age cookie
+                          attributes, while a session cookie is deleted when the current
+                          session ends.
+
+                          When set to "Permanent", AbsoluteTimeout indicates the
+                          cookie's lifetime via the Expires or Max-Age cookie attributes
+                          and is required.
+
+                          When set to "Session", AbsoluteTimeout indicates the
+                          absolute lifetime of the cookie tracked by the gateway and
+                          is optional.
+
+                          Defaults to "Session".
+
+                          Support: Core for "Session" type
+
+                          Support: Extended for "Permanent" type
+                        enum:
+                        - Permanent
+                        - Session
+                        type: string
+                    type: object
+                  idleTimeout:
+                    description: |-
+                      IdleTimeout defines the idle timeout of the persistent session.
+                      Once the session has been idle for more than the specified
+                      IdleTimeout duration, the session becomes invalid.
+
+                      Support: Extended
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                    type: string
+                  sessionName:
+                    description: |-
+                      SessionName defines the name of the persistent session token
+                      which may be reflected in the cookie or the header. Users
+                      should avoid reusing session names to prevent unintended
+                      consequences, such as rejection or unpredictable behavior.
+
+                      Support: Implementation-specific
+                    maxLength: 128
+                    type: string
+                  type:
+                    default: Cookie
+                    description: |-
+                      Type defines the type of session persistence such as through
+                      the use a header or cookie. Defaults to cookie based session
+                      persistence.
+
+                      Support: Core for "Cookie" type
+
+                      Support: Extended for "Header" type
+                    enum:
+                    - Cookie
+                    - Header
+                    type: string
+                type: object
+                x-kubernetes-validations:
+                - message: AbsoluteTimeout must be specified when cookie lifetimeType
+                    is Permanent
+                  rule: '!has(self.cookieConfig) || !has(self.cookieConfig.lifetimeType)
+                    || self.cookieConfig.lifetimeType != ''Permanent'' || has(self.absoluteTimeout)'
+              targetRefs:
+                description: |-
+                  TargetRefs identifies API object(s) to apply this policy to.
+                  Currently, Backends (A grouping of like endpoints such as Service,
+                  ServiceImport, or any implementation-specific backendRef) are the only
+                  valid API target references.
+
+                  Currently, a TargetRef can not be scoped to a specific port on a
+                  Service.
+                items:
+                  description: |-
+                    LocalPolicyTargetReference identifies an API object to apply a direct or
+                    inherited policy to. This should be used as part of Policy resources
+                    that can target Gateway API resources. For more information on how this
+                    policy attachment model works, and a sample Policy resource, refer to
+                    the policy attachment documentation for Gateway API.
+                  properties:
+                    group:
+                      description: Group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    kind:
+                      description: Kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                      type: string
+                    name:
+                      description: Name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                  required:
+                  - group
+                  - kind
+                  - name
+                  type: object
+                maxItems: 16
+                minItems: 1
+                type: array
+                x-kubernetes-list-map-keys:
+                - group
+                - kind
+                - name
+                x-kubernetes-list-type: map
+            required:
+            - targetRefs
+            type: object
+          status:
+            description: Status defines the current state of BackendTrafficPolicy.
+            properties:
+              ancestors:
+                description: |-
+                  Ancestors is a list of ancestor resources (usually Gateways) that are
+                  associated with the policy, and the status of the policy with respect to
+                  each ancestor. When this policy attaches to a parent, the controller that
+                  manages the parent and the ancestors MUST add an entry to this list when
+                  the controller first sees the policy and SHOULD update the entry as
+                  appropriate when the relevant ancestor is modified.
+
+                  Note that choosing the relevant ancestor is left to the Policy designers;
+                  an important part of Policy design is designing the right object level at
+                  which to namespace this status.
+
+                  Note also that implementations MUST ONLY populate ancestor status for
+                  the Ancestor resources they are responsible for. Implementations MUST
+                  use the ControllerName field to uniquely identify the entries in this list
+                  that they are responsible for.
+
+                  Note that to achieve this, the list of PolicyAncestorStatus structs
+                  MUST be treated as a map with a composite key, made up of the AncestorRef
+                  and ControllerName fields combined.
+
+                  A maximum of 16 ancestors will be represented in this list. An empty list
+                  means the Policy is not relevant for any ancestors.
+
+                  If this slice is full, implementations MUST NOT add further entries.
+                  Instead they MUST consider the policy unimplementable and signal that
+                  on any related resources such as the ancestor that would be referenced
+                  here. For example, if this list was full on BackendTLSPolicy, no
+                  additional Gateways would be able to reference the Service targeted by
+                  the BackendTLSPolicy.
+                items:
+                  description: |-
+                    PolicyAncestorStatus describes the status of a route with respect to an
+                    associated Ancestor.
+
+                    Ancestors refer to objects that are either the Target of a policy or above it
+                    in terms of object hierarchy. For example, if a policy targets a Service, the
+                    Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
+                    the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
+                    useful object to place Policy status on, so we recommend that implementations
+                    SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
+                    have a _very_ good reason otherwise.
+
+                    In the context of policy attachment, the Ancestor is used to distinguish which
+                    resource results in a distinct application of this policy. For example, if a policy
+                    targets a Service, it may have a distinct result per attached Gateway.
+
+                    Policies targeting the same resource may have different effects depending on the
+                    ancestors of those resources. For example, different Gateways targeting the same
+                    Service may have different capabilities, especially if they have different underlying
+                    implementations.
+
+                    For example, in BackendTLSPolicy, the Policy attaches to a Service that is
+                    used as a backend in a HTTPRoute that is itself attached to a Gateway.
+                    In this case, the relevant object for status is the Gateway, and that is the
+                    ancestor object referred to in this status.
+
+                    Note that a parent is also an ancestor, so for objects where the parent is the
+                    relevant object for status, this struct SHOULD still be used.
+
+                    This struct is intended to be used in a slice that's effectively a map,
+                    with a composite key made up of the AncestorRef and the ControllerName.
+                  properties:
+                    ancestorRef:
+                      description: |-
+                        AncestorRef corresponds with a ParentRef in the spec that this
+                        PolicyAncestorStatus struct describes the status of.
+                      properties:
+                        group:
+                          default: gateway.networking.k8s.io
+                          description: |-
+                            Group is the group of the referent.
+                            When unspecified, "gateway.networking.k8s.io" is inferred.
+                            To set the core API group (such as for a "Service" kind referent),
+                            Group must be explicitly set to "" (empty string).
+
+                            Support: Core
+                          maxLength: 253
+                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        kind:
+                          default: Gateway
+                          description: |-
+                            Kind is kind of the referent.
+
+                            There are two kinds of parent resources with "Core" support:
+
+                            * Gateway (Gateway conformance profile)
+                            * Service (Mesh conformance profile, ClusterIP Services only)
+
+                            Support for other resources is Implementation-Specific.
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                          type: string
+                        name:
+                          description: |-
+                            Name is the name of the referent.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: |-
+                            Namespace is the namespace of the referent. When unspecified, this refers
+                            to the local namespace of the Route.
+
+                            Note that there are specific rules for ParentRefs which cross namespace
+                            boundaries. Cross-namespace references are only valid if they are explicitly
+                            allowed by something in the namespace they are referring to. For example:
+                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                            generic way to enable any other kind of cross-namespace reference.
+
+
+                            ParentRefs from a Route to a Service in the same namespace are "producer"
+                            routes, which apply default routing rules to inbound connections from
+                            any namespace to the Service.
+
+                            ParentRefs from a Route to a Service in a different namespace are
+                            "consumer" routes, and these routing rules are only applied to outbound
+                            connections originating from the same namespace as the Route, for which
+                            the intended destination of the connections are a Service targeted as a
+                            ParentRef of the Route.
+
+
+                            Support: Core
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                          type: string
+                        port:
+                          description: |-
+                            Port is the network port this Route targets. It can be interpreted
+                            differently based on the type of parent resource.
+
+                            When the parent resource is a Gateway, this targets all listeners
+                            listening on the specified port that also support this kind of Route(and
+                            select this Route). It's not recommended to set `Port` unless the
+                            networking behaviors specified in a Route must apply to a specific port
+                            as opposed to a listener(s) whose port(s) may be changed. When both Port
+                            and SectionName are specified, the name and port of the selected listener
+                            must match both specified values.
+
+
+                            When the parent resource is a Service, this targets a specific port in the
+                            Service spec. When both Port (experimental) and SectionName are specified,
+                            the name and port of the selected port must match both specified values.
+
+
+                            Implementations MAY choose to support other parent resources.
+                            Implementations supporting other types of parent resources MUST clearly
+                            document how/if Port is interpreted.
+
+                            For the purpose of status, an attachment is considered successful as
+                            long as the parent resource accepts it partially. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                            from the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route,
+                            the Route MUST be considered detached from the Gateway.
+
+                            Support: Extended
+                          format: int32
+                          maximum: 65535
+                          minimum: 1
+                          type: integer
+                        sectionName:
+                          description: |-
+                            SectionName is the name of a section within the target resource. In the
+                            following resources, SectionName is interpreted as the following:
+
+                            * Gateway: Listener name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+                            * Service: Port name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+
+                            Implementations MAY choose to support attaching Routes to other resources.
+                            If that is the case, they MUST clearly document how SectionName is
+                            interpreted.
+
+                            When unspecified (empty string), this will reference the entire resource.
+                            For the purpose of status, an attachment is considered successful if at
+                            least one section in the parent resource accepts it. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                            the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route, the
+                            Route MUST be considered detached from the Gateway.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    conditions:
+                      description: Conditions describes the status of the Policy with
+                        respect to the given Ancestor.
+                      items:
+                        description: Condition contains details for one aspect of
+                          the current state of this API Resource.
+                        properties:
+                          lastTransitionTime:
+                            description: |-
+                              lastTransitionTime is the last time the condition transitioned from one status to another.
+                              This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                            format: date-time
+                            type: string
+                          message:
+                            description: |-
+                              message is a human readable message indicating details about the transition.
+                              This may be an empty string.
+                            maxLength: 32768
+                            type: string
+                          observedGeneration:
+                            description: |-
+                              observedGeneration represents the .metadata.generation that the condition was set based upon.
+                              For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                              with respect to the current state of the instance.
+                            format: int64
+                            minimum: 0
+                            type: integer
+                          reason:
+                            description: |-
+                              reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected values and meanings for this field,
+                              and whether the values are considered a guaranteed API.
+                              The value should be a CamelCase string.
+                              This field may not be empty.
+                            maxLength: 1024
+                            minLength: 1
+                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                            type: string
+                          status:
+                            description: status of the condition, one of True, False,
+                              Unknown.
+                            enum:
+                            - "True"
+                            - "False"
+                            - Unknown
+                            type: string
+                          type:
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                            maxLength: 316
+                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                            type: string
+                        required:
+                        - lastTransitionTime
+                        - message
+                        - reason
+                        - status
+                        - type
+                        type: object
+                      maxItems: 8
+                      minItems: 1
+                      type: array
+                      x-kubernetes-list-map-keys:
+                      - type
+                      x-kubernetes-list-type: map
+                    controllerName:
+                      description: |-
+                        ControllerName is a domain/path string that indicates the name of the
+                        controller that wrote this status. This corresponds with the
+                        controllerName field on GatewayClass.
+
+                        Example: "example.net/gateway-controller".
+
+                        The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                        valid Kubernetes names
+                        (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+
+                        Controllers MUST populate this field when writing status. Controllers should ensure that
+                        entries to status populated with their ControllerName are cleaned up when they are no
+                        longer necessary.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                      type: string
+                  required:
+                  - ancestorRef
+                  - controllerName
+                  type: object
+                maxItems: 16
+                type: array
+            required:
+            - ancestors
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/config/crd/experimental/gateway.networking.x-k8s.io_listenersets.yaml b/config/crd/experimental/gateway.networking.x-k8s.io_listenersets.yaml
new file mode 100644
index 00000000..e1eaff23
--- /dev/null
+++ b/config/crd/experimental/gateway.networking.x-k8s.io_listenersets.yaml
@@ -0,0 +1,842 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.2.1
+    gateway.networking.k8s.io/channel: experimental
+  creationTimestamp: null
+  name: listenersets.gateway.networking.x-k8s.io
+spec:
+  group: gateway.networking.x-k8s.io
+  names:
+    categories:
+    - gateway-api
+    kind: ListenerSet
+    listKind: ListenerSetList
+    plural: listenersets
+    shortNames:
+    - lset
+    singular: listenerset
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=="Accepted")].status
+      name: Accepted
+      type: string
+    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
+      name: Programmed
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          ListenerSet defines a set of additional listeners
+          to attach to an existing Gateway.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of ListenerSet.
+            properties:
+              listeners:
+                description: |-
+                  Listeners associated with this ListenerSet. Listeners define
+                  logical endpoints that are bound on this referenced parent Gateway's addresses.
+
+                  Listeners in a `Gateway` and their attached `ListenerSets` are concatenated
+                  as a list when programming the underlying infrastructure. Each listener
+                  name does not need to be unique across the Gateway and ListenerSets.
+                  See ListenerEntry.Name for more details.
+
+                  Implementations MUST treat the parent Gateway as having the merged
+                  list of all listeners from itself and attached ListenerSets using
+                  the following precedence:
+
+                  1. "parent" Gateway
+                  2. ListenerSet ordered by creation time (oldest first)
+                  3. ListenerSet ordered alphabetically by “{namespace}/{name}”.
+
+                  An implementation MAY reject listeners by setting the ListenerEntryStatus
+                  `Accepted`` condition to False with the Reason `TooManyListeners`
+
+                  If a listener has a conflict, this will be reported in the
+                  Status.ListenerEntryStatus setting the `Conflicted` condition to True.
+
+                  Implementations SHOULD be cautious about what information from the
+                  parent or siblings are reported to avoid accidentally leaking
+                  sensitive information that the child would not otherwise have access
+                  to. This can include contents of secrets etc.
+                items:
+                  properties:
+                    allowedRoutes:
+                      default:
+                        namespaces:
+                          from: Same
+                      description: |-
+                        AllowedRoutes defines the types of routes that MAY be attached to a
+                        Listener and the trusted namespaces where those Route resources MAY be
+                        present.
+
+                        Although a client request may match multiple route rules, only one rule
+                        may ultimately receive the request. Matching precedence MUST be
+                        determined in order of the following criteria:
+
+                        * The most specific match as defined by the Route type.
+                        * The oldest Route based on creation timestamp. For example, a Route with
+                          a creation timestamp of "2020-09-08 01:02:03" is given precedence over
+                          a Route with a creation timestamp of "2020-09-08 01:02:04".
+                        * If everything else is equivalent, the Route appearing first in
+                          alphabetical order (namespace/name) should be given precedence. For
+                          example, foo/bar is given precedence over foo/baz.
+
+                        All valid rules within a Route attached to this Listener should be
+                        implemented. Invalid Route rules can be ignored (sometimes that will mean
+                        the full Route). If a Route rule transitions from valid to invalid,
+                        support for that Route rule should be dropped to ensure consistency. For
+                        example, even if a filter specified by a Route rule is invalid, the rest
+                        of the rules within that Route should still be supported.
+                      properties:
+                        kinds:
+                          description: |-
+                            Kinds specifies the groups and kinds of Routes that are allowed to bind
+                            to this Gateway Listener. When unspecified or empty, the kinds of Routes
+                            selected are determined using the Listener protocol.
+
+                            A RouteGroupKind MUST correspond to kinds of Routes that are compatible
+                            with the application protocol specified in the Listener's Protocol field.
+                            If an implementation does not support or recognize this resource type, it
+                            MUST set the "ResolvedRefs" condition to False for this Listener with the
+                            "InvalidRouteKinds" reason.
+
+                            Support: Core
+                          items:
+                            description: RouteGroupKind indicates the group and kind
+                              of a Route resource.
+                            properties:
+                              group:
+                                default: gateway.networking.k8s.io
+                                description: Group is the group of the Route.
+                                maxLength: 253
+                                pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                type: string
+                              kind:
+                                description: Kind is the kind of the Route.
+                                maxLength: 63
+                                minLength: 1
+                                pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                type: string
+                            required:
+                            - kind
+                            type: object
+                          maxItems: 8
+                          type: array
+                        namespaces:
+                          default:
+                            from: Same
+                          description: |-
+                            Namespaces indicates namespaces from which Routes may be attached to this
+                            Listener. This is restricted to the namespace of this Gateway by default.
+
+                            Support: Core
+                          properties:
+                            from:
+                              default: Same
+                              description: |-
+                                From indicates where Routes will be selected for this Gateway. Possible
+                                values are:
+
+                                * All: Routes in all namespaces may be used by this Gateway.
+                                * Selector: Routes in namespaces selected by the selector may be used by
+                                  this Gateway.
+                                * Same: Only Routes in the same namespace may be used by this Gateway.
+
+                                Support: Core
+                              enum:
+                              - All
+                              - Selector
+                              - Same
+                              - None
+                              type: string
+                            selector:
+                              description: |-
+                                Selector must be specified when From is set to "Selector". In that case,
+                                only Routes in Namespaces matching this Selector will be selected by this
+                                Gateway. This field is ignored for other values of "From".
+
+                                Support: Core
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                          type: object
+                      type: object
+                    hostname:
+                      description: |-
+                        Hostname specifies the virtual hostname to match for protocol types that
+                        define this concept. When unspecified, all hostnames are matched. This
+                        field is ignored for protocols that don't require hostname based
+                        matching.
+
+                        Implementations MUST apply Hostname matching appropriately for each of
+                        the following protocols:
+
+                        * TLS: The Listener Hostname MUST match the SNI.
+                        * HTTP: The Listener Hostname MUST match the Host header of the request.
+                        * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
+                          protocol layers as described above. If an implementation does not
+                          ensure that both the SNI and Host header match the Listener hostname,
+                          it MUST clearly document that.
+
+                        For HTTPRoute and TLSRoute resources, there is an interaction with the
+                        `spec.hostnames` array. When both listener and route specify hostnames,
+                        there MUST be an intersection between the values for a Route to be
+                        accepted. For more information, refer to the Route specific Hostnames
+                        documentation.
+
+                        Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
+                        as a suffix match. That means that a match for `*.example.com` would match
+                        both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    name:
+                      description: |-
+                        Name is the name of the Listener. This name MUST be unique within a
+                        ListenerSet.
+
+                        Name is not required to be unique across a Gateway and ListenerSets.
+                        Routes can attach to a Listener by having a ListenerSet as a parentRef
+                        and setting the SectionName
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    port:
+                      description: |-
+                        Port is the network port. Multiple listeners may use the
+                        same port, subject to the Listener compatibility rules.
+                      format: int32
+                      maximum: 65535
+                      minimum: 1
+                      type: integer
+                    protocol:
+                      description: Protocol specifies the network protocol this listener
+                        expects to receive.
+                      maxLength: 255
+                      minLength: 1
+                      pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$
+                      type: string
+                    tls:
+                      description: |-
+                        TLS is the TLS configuration for the Listener. This field is required if
+                        the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
+                        if the Protocol field is "HTTP", "TCP", or "UDP".
+
+                        The association of SNIs to Certificate defined in GatewayTLSConfig is
+                        defined based on the Hostname field for this listener.
+
+                        The GatewayClass MUST use the longest matching SNI out of all
+                        available certificates for any TLS handshake.
+                      properties:
+                        certificateRefs:
+                          description: |-
+                            CertificateRefs contains a series of references to Kubernetes objects that
+                            contains TLS certificates and private keys. These certificates are used to
+                            establish a TLS handshake for requests that match the hostname of the
+                            associated listener.
+
+                            A single CertificateRef to a Kubernetes Secret has "Core" support.
+                            Implementations MAY choose to support attaching multiple certificates to
+                            a Listener, but this behavior is implementation-specific.
+
+                            References to a resource in different namespace are invalid UNLESS there
+                            is a ReferenceGrant in the target namespace that allows the certificate
+                            to be attached. If a ReferenceGrant does not allow this reference, the
+                            "ResolvedRefs" condition MUST be set to False for this listener with the
+                            "RefNotPermitted" reason.
+
+                            This field is required to have at least one element when the mode is set
+                            to "Terminate" (default) and is optional otherwise.
+
+                            CertificateRefs can reference to standard Kubernetes resources, i.e.
+                            Secret, or implementation-specific custom resources.
+
+                            Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls
+
+                            Support: Implementation-specific (More than one reference or other resource types)
+                          items:
+                            description: |-
+                              SecretObjectReference identifies an API object including its namespace,
+                              defaulting to Secret.
+
+                              The API object must be valid in the cluster; the Group and Kind must
+                              be registered in the cluster for this reference to be valid.
+
+                              References to objects with invalid Group and Kind are not valid, and must
+                              be rejected by the implementation, with appropriate Conditions set
+                              on the containing object.
+                            properties:
+                              group:
+                                default: ""
+                                description: |-
+                                  Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                  When unspecified or empty string, core API group is inferred.
+                                maxLength: 253
+                                pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                type: string
+                              kind:
+                                default: Secret
+                                description: Kind is kind of the referent. For example
+                                  "Secret".
+                                maxLength: 63
+                                minLength: 1
+                                pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                type: string
+                              name:
+                                description: Name is the name of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              namespace:
+                                description: |-
+                                  Namespace is the namespace of the referenced object. When unspecified, the local
+                                  namespace is inferred.
+
+                                  Note that when a namespace different than the local namespace is specified,
+                                  a ReferenceGrant object is required in the referent namespace to allow that
+                                  namespace's owner to accept the reference. See the ReferenceGrant
+                                  documentation for details.
+
+                                  Support: Core
+                                maxLength: 63
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                type: string
+                            required:
+                            - name
+                            type: object
+                          maxItems: 64
+                          type: array
+                        frontendValidation:
+                          description: |-
+                            FrontendValidation holds configuration information for validating the frontend (client).
+                            Setting this field will require clients to send a client certificate
+                            required for validation during the TLS handshake. In browsers this may result in a dialog appearing
+                            that requests a user to specify the client certificate.
+                            The maximum depth of a certificate chain accepted in verification is Implementation specific.
+
+                            Support: Extended
+                          properties:
+                            caCertificateRefs:
+                              description: |-
+                                CACertificateRefs contains one or more references to
+                                Kubernetes objects that contain TLS certificates of
+                                the Certificate Authorities that can be used
+                                as a trust anchor to validate the certificates presented by the client.
+
+                                A single CA certificate reference to a Kubernetes ConfigMap
+                                has "Core" support.
+                                Implementations MAY choose to support attaching multiple CA certificates to
+                                a Listener, but this behavior is implementation-specific.
+
+                                Support: Core - A single reference to a Kubernetes ConfigMap
+                                with the CA certificate in a key named `ca.crt`.
+
+                                Support: Implementation-specific (More than one reference, or other kinds
+                                of resources).
+
+                                References to a resource in a different namespace are invalid UNLESS there
+                                is a ReferenceGrant in the target namespace that allows the certificate
+                                to be attached. If a ReferenceGrant does not allow this reference, the
+                                "ResolvedRefs" condition MUST be set to False for this listener with the
+                                "RefNotPermitted" reason.
+                              items:
+                                description: |-
+                                  ObjectReference identifies an API object including its namespace.
+
+                                  The API object must be valid in the cluster; the Group and Kind must
+                                  be registered in the cluster for this reference to be valid.
+
+                                  References to objects with invalid Group and Kind are not valid, and must
+                                  be rejected by the implementation, with appropriate Conditions set
+                                  on the containing object.
+                                properties:
+                                  group:
+                                    description: |-
+                                      Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                      When set to the empty string, core API group is inferred.
+                                    maxLength: 253
+                                    pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                    type: string
+                                  kind:
+                                    description: Kind is kind of the referent. For
+                                      example "ConfigMap" or "Service".
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                    type: string
+                                  name:
+                                    description: Name is the name of the referent.
+                                    maxLength: 253
+                                    minLength: 1
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace of the referenced object. When unspecified, the local
+                                      namespace is inferred.
+
+                                      Note that when a namespace different than the local namespace is specified,
+                                      a ReferenceGrant object is required in the referent namespace to allow that
+                                      namespace's owner to accept the reference. See the ReferenceGrant
+                                      documentation for details.
+
+                                      Support: Core
+                                    maxLength: 63
+                                    minLength: 1
+                                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                    type: string
+                                required:
+                                - group
+                                - kind
+                                - name
+                                type: object
+                              maxItems: 8
+                              minItems: 1
+                              type: array
+                          type: object
+                        mode:
+                          default: Terminate
+                          description: |-
+                            Mode defines the TLS behavior for the TLS session initiated by the client.
+                            There are two possible modes:
+
+                            - Terminate: The TLS session between the downstream client and the
+                              Gateway is terminated at the Gateway. This mode requires certificates
+                              to be specified in some way, such as populating the certificateRefs
+                              field.
+                            - Passthrough: The TLS session is NOT terminated by the Gateway. This
+                              implies that the Gateway can't decipher the TLS stream except for
+                              the ClientHello message of the TLS protocol. The certificateRefs field
+                              is ignored in this mode.
+
+                            Support: Core
+                          enum:
+                          - Terminate
+                          - Passthrough
+                          type: string
+                        options:
+                          additionalProperties:
+                            description: |-
+                              AnnotationValue is the value of an annotation in Gateway API. This is used
+                              for validation of maps such as TLS options. This roughly matches Kubernetes
+                              annotation validation, although the length validation in that case is based
+                              on the entire size of the annotations struct.
+                            maxLength: 4096
+                            minLength: 0
+                            type: string
+                          description: |-
+                            Options are a list of key/value pairs to enable extended TLS
+                            configuration for each implementation. For example, configuring the
+                            minimum TLS version or supported cipher suites.
+
+                            A set of common keys MAY be defined by the API in the future. To avoid
+                            any ambiguity, implementation-specific definitions MUST use
+                            domain-prefixed names, such as `example.com/my-custom-option`.
+                            Un-prefixed names are reserved for key names defined by Gateway API.
+
+                            Support: Implementation-specific
+                          maxProperties: 16
+                          type: object
+                      type: object
+                      x-kubernetes-validations:
+                      - message: certificateRefs or options must be specified when
+                          mode is Terminate
+                        rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs)
+                          > 0 || size(self.options) > 0 : true'
+                  required:
+                  - name
+                  - protocol
+                  type: object
+                maxItems: 64
+                minItems: 1
+                type: array
+                x-kubernetes-list-map-keys:
+                - name
+                x-kubernetes-list-type: map
+                x-kubernetes-validations:
+                - message: tls must not be specified for protocols ['HTTP', 'TCP',
+                    'UDP']
+                  rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ?
+                    !has(l.tls) : true)'
+                - message: tls mode must be Terminate for protocol HTTPS
+                  rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode
+                    == '''' || l.tls.mode == ''Terminate'') : true)'
+                - message: hostname must not be specified for protocols ['TCP', 'UDP']
+                  rule: 'self.all(l, l.protocol in [''TCP'', ''UDP'']  ? (!has(l.hostname)
+                    || l.hostname == '''') : true)'
+                - message: Listener name must be unique within the Gateway
+                  rule: self.all(l1, self.exists_one(l2, l1.name == l2.name))
+                - message: Combination of port, protocol and hostname must be unique
+                    for each listener
+                  rule: 'self.all(l1, !has(l1.port) || self.exists_one(l2, has(l2.port)
+                    && l1.port == l2.port && l1.protocol == l2.protocol && (has(l1.hostname)
+                    && has(l2.hostname) ? l1.hostname == l2.hostname : !has(l1.hostname)
+                    && !has(l2.hostname))))'
+              parentRef:
+                description: ParentRef references the Gateway that the listeners are
+                  attached to.
+                properties:
+                  group:
+                    default: gateway.networking.k8s.io
+                    description: Group is the group of the referent.
+                    maxLength: 253
+                    pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                    type: string
+                  kind:
+                    default: Gateway
+                    description: Kind is kind of the referent. For example "Gateway".
+                    maxLength: 63
+                    minLength: 1
+                    pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                    type: string
+                  name:
+                    description: Name is the name of the referent.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: |-
+                      Namespace is the namespace of the referent.  If not present,
+                      the namespace of the referent is assumed to be the same as
+                      the namespace of the referring object.
+                    maxLength: 63
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                    type: string
+                required:
+                - name
+                type: object
+            required:
+            - listeners
+            - parentRef
+            type: object
+          status:
+            default:
+              conditions:
+              - lastTransitionTime: "1970-01-01T00:00:00Z"
+                message: Waiting for controller
+                reason: Pending
+                status: Unknown
+                type: Accepted
+              - lastTransitionTime: "1970-01-01T00:00:00Z"
+                message: Waiting for controller
+                reason: Pending
+                status: Unknown
+                type: Programmed
+            description: Status defines the current state of ListenerSet.
+            properties:
+              conditions:
+                default:
+                - lastTransitionTime: "1970-01-01T00:00:00Z"
+                  message: Waiting for controller
+                  reason: Pending
+                  status: Unknown
+                  type: Accepted
+                - lastTransitionTime: "1970-01-01T00:00:00Z"
+                  message: Waiting for controller
+                  reason: Pending
+                  status: Unknown
+                  type: Programmed
+                description: |-
+                  Conditions describe the current conditions of the ListenerSet.
+
+                  Implementations MUST express ListenerSet conditions using the
+                  `ListenerSetConditionType` and `ListenerSetConditionReason`
+                  constants so that operators and tools can converge on a common
+                  vocabulary to describe ListenerSet state.
+
+                  Known condition types are:
+
+                  * "Accepted"
+                  * "Programmed"
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                maxItems: 8
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              listeners:
+                description: Listeners provide status for each unique listener port
+                  defined in the Spec.
+                items:
+                  description: ListenerStatus is the status associated with a Listener.
+                  properties:
+                    attachedRoutes:
+                      description: |-
+                        AttachedRoutes represents the total number of Routes that have been
+                        successfully attached to this Listener.
+
+                        Successful attachment of a Route to a Listener is based solely on the
+                        combination of the AllowedRoutes field on the corresponding Listener
+                        and the Route's ParentRefs field. A Route is successfully attached to
+                        a Listener when it is selected by the Listener's AllowedRoutes field
+                        AND the Route has a valid ParentRef selecting the whole Gateway
+                        resource or a specific Listener as a parent resource (more detail on
+                        attachment semantics can be found in the documentation on the various
+                        Route kinds ParentRefs fields). Listener or Route status does not impact
+                        successful attachment, i.e. the AttachedRoutes field count MUST be set
+                        for Listeners with condition Accepted: false and MUST count successfully
+                        attached Routes that may themselves have Accepted: false conditions.
+
+                        Uses for this field include troubleshooting Route attachment and
+                        measuring blast radius/impact of changes to a Listener.
+                      format: int32
+                      type: integer
+                    conditions:
+                      description: Conditions describe the current condition of this
+                        listener.
+                      items:
+                        description: Condition contains details for one aspect of
+                          the current state of this API Resource.
+                        properties:
+                          lastTransitionTime:
+                            description: |-
+                              lastTransitionTime is the last time the condition transitioned from one status to another.
+                              This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                            format: date-time
+                            type: string
+                          message:
+                            description: |-
+                              message is a human readable message indicating details about the transition.
+                              This may be an empty string.
+                            maxLength: 32768
+                            type: string
+                          observedGeneration:
+                            description: |-
+                              observedGeneration represents the .metadata.generation that the condition was set based upon.
+                              For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                              with respect to the current state of the instance.
+                            format: int64
+                            minimum: 0
+                            type: integer
+                          reason:
+                            description: |-
+                              reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected values and meanings for this field,
+                              and whether the values are considered a guaranteed API.
+                              The value should be a CamelCase string.
+                              This field may not be empty.
+                            maxLength: 1024
+                            minLength: 1
+                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                            type: string
+                          status:
+                            description: status of the condition, one of True, False,
+                              Unknown.
+                            enum:
+                            - "True"
+                            - "False"
+                            - Unknown
+                            type: string
+                          type:
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                            maxLength: 316
+                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                            type: string
+                        required:
+                        - lastTransitionTime
+                        - message
+                        - reason
+                        - status
+                        - type
+                        type: object
+                      maxItems: 8
+                      type: array
+                      x-kubernetes-list-map-keys:
+                      - type
+                      x-kubernetes-list-type: map
+                    name:
+                      description: Name is the name of the Listener that this status
+                        corresponds to.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    port:
+                      description: Port is the network port the listener is configured
+                        to listen on.
+                      format: int32
+                      maximum: 65535
+                      minimum: 1
+                      type: integer
+                    supportedKinds:
+                      description: |-
+                        SupportedKinds is the list indicating the Kinds supported by this
+                        listener. This MUST represent the kinds an implementation supports for
+                        that Listener configuration.
+
+                        If kinds are specified in Spec that are not supported, they MUST NOT
+                        appear in this list and an implementation MUST set the "ResolvedRefs"
+                        condition to "False" with the "InvalidRouteKinds" reason. If both valid
+                        and invalid Route kinds are specified, the implementation MUST
+                        reference the valid Route kinds that have been specified.
+                      items:
+                        description: RouteGroupKind indicates the group and kind of
+                          a Route resource.
+                        properties:
+                          group:
+                            default: gateway.networking.k8s.io
+                            description: Group is the group of the Route.
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            description: Kind is the kind of the Route.
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                        required:
+                        - kind
+                        type: object
+                      maxItems: 8
+                      type: array
+                  required:
+                  - attachedRoutes
+                  - conditions
+                  - name
+                  - port
+                  - supportedKinds
+                  type: object
+                maxItems: 64
+                type: array
+                x-kubernetes-list-map-keys:
+                - name
+                x-kubernetes-list-type: map
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/config/crd/standard/gateway.networking.k8s.io_gateways.yaml b/config/crd/standard/gateway.networking.k8s.io_gateways.yaml
index 36a4504c..15cbc96b 100644
--- a/config/crd/standard/gateway.networking.k8s.io_gateways.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_gateways.yaml
@@ -416,6 +416,8 @@ spec:
                   Implementations MAY merge separate Gateways onto a single set of
                   Addresses if all Listeners across all Gateways are compatible.
 
+                  In a future release the MinItems=1 requirement MAY be dropped.
+
                   Support: Core
                 items:
                   description: |-
@@ -511,6 +513,7 @@ spec:
                               - All
                               - Selector
                               - Same
+                              - None
                               type: string
                             selector:
                               description: |-
@@ -577,10 +580,31 @@ spec:
 
                         * TLS: The Listener Hostname MUST match the SNI.
                         * HTTP: The Listener Hostname MUST match the Host header of the request.
-                        * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
-                          protocol layers as described above. If an implementation does not
-                          ensure that both the SNI and Host header match the Listener hostname,
-                          it MUST clearly document that.
+                        * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.
+                          Note that this does not require the SNI and Host header to be the same.
+                          The semantics of this are described in more detail below.
+
+                        To ensure security, Section 11.1 of RFC-6066 emphasizes that server
+                        implementations that rely on SNI hostname matching MUST also verify
+                        hostnames within the application protocol.
+
+                        Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the
+                        reuse of a connection by responding with the HTTP 421 Misdirected Request
+                        status code. This indicates that the origin server has rejected the
+                        request because it appears to have been misdirected.
+
+                        To detect misdirected requests, Gateways SHOULD match the authority of
+                        the requests with all the SNI hostname(s) configured across all the
+                        Gateway Listeners on the same port and protocol:
+
+                        * If another Listener has an exact match or more specific wildcard entry,
+                          the Gateway SHOULD return a 421.
+                        * If the current Listener (selected by SNI matching during ClientHello)
+                          does not match the Host:
+                            * If another Listener does match the Host the Gateway SHOULD return a
+                              421.
+                            * If no other Listener matches the Host, the Gateway MUST return a
+                              404.
 
                         For HTTPRoute and TLSRoute resources, there is an interaction with the
                         `spec.hostnames` array. When both listener and route specify hostnames,
@@ -1499,6 +1523,8 @@ spec:
                   Implementations MAY merge separate Gateways onto a single set of
                   Addresses if all Listeners across all Gateways are compatible.
 
+                  In a future release the MinItems=1 requirement MAY be dropped.
+
                   Support: Core
                 items:
                   description: |-
@@ -1594,6 +1620,7 @@ spec:
                               - All
                               - Selector
                               - Same
+                              - None
                               type: string
                             selector:
                               description: |-
@@ -1660,10 +1687,31 @@ spec:
 
                         * TLS: The Listener Hostname MUST match the SNI.
                         * HTTP: The Listener Hostname MUST match the Host header of the request.
-                        * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
-                          protocol layers as described above. If an implementation does not
-                          ensure that both the SNI and Host header match the Listener hostname,
-                          it MUST clearly document that.
+                        * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.
+                          Note that this does not require the SNI and Host header to be the same.
+                          The semantics of this are described in more detail below.
+
+                        To ensure security, Section 11.1 of RFC-6066 emphasizes that server
+                        implementations that rely on SNI hostname matching MUST also verify
+                        hostnames within the application protocol.
+
+                        Section 9.1.2 of RFC-7540 provides a mechanism for servers to reject the
+                        reuse of a connection by responding with the HTTP 421 Misdirected Request
+                        status code. This indicates that the origin server has rejected the
+                        request because it appears to have been misdirected.
+
+                        To detect misdirected requests, Gateways SHOULD match the authority of
+                        the requests with all the SNI hostname(s) configured across all the
+                        Gateway Listeners on the same port and protocol:
+
+                        * If another Listener has an exact match or more specific wildcard entry,
+                          the Gateway SHOULD return a 421.
+                        * If the current Listener (selected by SNI matching during ClientHello)
+                          does not match the Host:
+                            * If another Listener does match the Host the Gateway SHOULD return a
+                              421.
+                            * If no other Listener matches the Host, the Gateway MUST return a
+                              404.
 
                         For HTTPRoute and TLSRoute resources, there is an interaction with the
                         `spec.hostnames` array. When both listener and route specify hostnames,
diff --git a/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml b/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
index 1cd8c79b..d13ff9aa 100644
--- a/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
@@ -485,7 +485,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -560,7 +560,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -692,9 +692,49 @@ spec:
                                       - message: Must have port for Service reference
                                         rule: '(size(self.group) == 0 && self.kind
                                           == ''Service'') ? has(self.port) : true'
+                                    fraction:
+                                      description: |-
+                                        Fraction represents the fraction of requests that should be
+                                        mirrored to BackendRef.
+
+                                        Only one of Fraction or Percent may be specified. If neither field
+                                        is specified, 100% of requests will be mirrored.
+                                      properties:
+                                        denominator:
+                                          default: 100
+                                          format: int32
+                                          minimum: 1
+                                          type: integer
+                                        numerator:
+                                          format: int32
+                                          minimum: 0
+                                          type: integer
+                                      required:
+                                      - numerator
+                                      type: object
+                                      x-kubernetes-validations:
+                                      - message: numerator must be less than or equal
+                                          to denominator
+                                        rule: self.numerator <= self.denominator
+                                    percent:
+                                      description: |-
+                                        Percent represents the percentage of requests that should be
+                                        mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
+                                        requests) and its maximum value is 100 (indicating 100% of requests).
+
+                                        Only one of Fraction or Percent may be specified. If neither field
+                                        is specified, 100% of requests will be mirrored.
+                                      format: int32
+                                      maximum: 100
+                                      minimum: 0
+                                      type: integer
                                   required:
                                   - backendRef
                                   type: object
+                                  x-kubernetes-validations:
+                                  - message: Only one of percent or fraction may be
+                                      specified in HTTPRequestMirrorFilter
+                                    rule: '!(has(self.percent) && has(self.fraction))'
                                 responseHeaderModifier:
                                   description: |-
                                     ResponseHeaderModifier defines a schema for a filter that modifies response
@@ -728,7 +768,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -803,7 +843,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -1012,7 +1052,7 @@ spec:
                         Specifying the same filter multiple times is not supported unless explicitly
                         indicated in the filter.
 
-                        If an implementation can not support a combination of filters, it must clearly
+                        If an implementation cannot support a combination of filters, it must clearly
                         document that limitation. In cases where incompatible or unsupported
                         filters are specified and cause the `Accepted` condition to be set to status
                         `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -1095,7 +1135,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1169,7 +1209,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1301,9 +1341,49 @@ spec:
                                 - message: Must have port for Service reference
                                   rule: '(size(self.group) == 0 && self.kind == ''Service'')
                                     ? has(self.port) : true'
+                              fraction:
+                                description: |-
+                                  Fraction represents the fraction of requests that should be
+                                  mirrored to BackendRef.
+
+                                  Only one of Fraction or Percent may be specified. If neither field
+                                  is specified, 100% of requests will be mirrored.
+                                properties:
+                                  denominator:
+                                    default: 100
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  numerator:
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                required:
+                                - numerator
+                                type: object
+                                x-kubernetes-validations:
+                                - message: numerator must be less than or equal to
+                                    denominator
+                                  rule: self.numerator <= self.denominator
+                              percent:
+                                description: |-
+                                  Percent represents the percentage of requests that should be
+                                  mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
+                                  requests) and its maximum value is 100 (indicating 100% of requests).
+
+                                  Only one of Fraction or Percent may be specified. If neither field
+                                  is specified, 100% of requests will be mirrored.
+                                format: int32
+                                maximum: 100
+                                minimum: 0
+                                type: integer
                             required:
                             - backendRef
                             type: object
+                            x-kubernetes-validations:
+                            - message: Only one of percent or fraction may be specified
+                                in HTTPRequestMirrorFilter
+                              rule: '!(has(self.percent) && has(self.fraction))'
                           responseHeaderModifier:
                             description: |-
                               ResponseHeaderModifier defines a schema for a filter that modifies response
@@ -1336,7 +1416,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1410,7 +1490,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1678,7 +1758,7 @@ spec:
                                 has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""):
                                 true'
                         type: object
-                      maxItems: 8
+                      maxItems: 64
                       type: array
                   type: object
                 maxItems: 16
@@ -1747,7 +1827,7 @@ spec:
                         There are a number of cases where the "Accepted" condition may not be set
                         due to lack of controller visibility, that includes when:
 
-                        * The Route refers to a non-existent parent.
+                        * The Route refers to a nonexistent parent.
                         * The Route is of a type that the controller does not support.
                         * The Route is in a namespace the controller does not have access to.
                       items:
diff --git a/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml b/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
index fc68fd8e..c430d127 100644
--- a/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
@@ -477,7 +477,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -552,7 +552,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -684,9 +684,49 @@ spec:
                                       - message: Must have port for Service reference
                                         rule: '(size(self.group) == 0 && self.kind
                                           == ''Service'') ? has(self.port) : true'
+                                    fraction:
+                                      description: |-
+                                        Fraction represents the fraction of requests that should be
+                                        mirrored to BackendRef.
+
+                                        Only one of Fraction or Percent may be specified. If neither field
+                                        is specified, 100% of requests will be mirrored.
+                                      properties:
+                                        denominator:
+                                          default: 100
+                                          format: int32
+                                          minimum: 1
+                                          type: integer
+                                        numerator:
+                                          format: int32
+                                          minimum: 0
+                                          type: integer
+                                      required:
+                                      - numerator
+                                      type: object
+                                      x-kubernetes-validations:
+                                      - message: numerator must be less than or equal
+                                          to denominator
+                                        rule: self.numerator <= self.denominator
+                                    percent:
+                                      description: |-
+                                        Percent represents the percentage of requests that should be
+                                        mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
+                                        requests) and its maximum value is 100 (indicating 100% of requests).
+
+                                        Only one of Fraction or Percent may be specified. If neither field
+                                        is specified, 100% of requests will be mirrored.
+                                      format: int32
+                                      maximum: 100
+                                      minimum: 0
+                                      type: integer
                                   required:
                                   - backendRef
                                   type: object
+                                  x-kubernetes-validations:
+                                  - message: Only one of percent or fraction may be
+                                      specified in HTTPRequestMirrorFilter
+                                    rule: '!(has(self.percent) && has(self.fraction))'
                                 requestRedirect:
                                   description: |-
                                     RequestRedirect defines a schema for a filter that responds to the
@@ -873,7 +913,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -948,7 +988,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -1269,7 +1309,7 @@ spec:
                         they are specified.
 
                         Implementations MAY choose to implement this ordering strictly, rejecting
-                        any combination or order of filters that can not be supported. If implementations
+                        any combination or order of filters that cannot be supported. If implementations
                         choose a strict interpretation of filter ordering, they MUST clearly document
                         that behavior.
 
@@ -1291,7 +1331,7 @@ spec:
 
                         All filters are expected to be compatible with each other except for the
                         URLRewrite and RequestRedirect filters, which may not be combined. If an
-                        implementation can not support other combinations of filters, they must clearly
+                        implementation cannot support other combinations of filters, they must clearly
                         document that limitation. In cases where incompatible or unsupported
                         filters are specified and cause the `Accepted` condition to be set to status
                         `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -1374,7 +1414,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1448,7 +1488,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1580,9 +1620,49 @@ spec:
                                 - message: Must have port for Service reference
                                   rule: '(size(self.group) == 0 && self.kind == ''Service'')
                                     ? has(self.port) : true'
+                              fraction:
+                                description: |-
+                                  Fraction represents the fraction of requests that should be
+                                  mirrored to BackendRef.
+
+                                  Only one of Fraction or Percent may be specified. If neither field
+                                  is specified, 100% of requests will be mirrored.
+                                properties:
+                                  denominator:
+                                    default: 100
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  numerator:
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                required:
+                                - numerator
+                                type: object
+                                x-kubernetes-validations:
+                                - message: numerator must be less than or equal to
+                                    denominator
+                                  rule: self.numerator <= self.denominator
+                              percent:
+                                description: |-
+                                  Percent represents the percentage of requests that should be
+                                  mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
+                                  requests) and its maximum value is 100 (indicating 100% of requests).
+
+                                  Only one of Fraction or Percent may be specified. If neither field
+                                  is specified, 100% of requests will be mirrored.
+                                format: int32
+                                maximum: 100
+                                minimum: 0
+                                type: integer
                             required:
                             - backendRef
                             type: object
+                            x-kubernetes-validations:
+                            - message: Only one of percent or fraction may be specified
+                                in HTTPRequestMirrorFilter
+                              rule: '!(has(self.percent) && has(self.fraction))'
                           requestRedirect:
                             description: |-
                               RequestRedirect defines a schema for a filter that responds to the
@@ -1768,7 +1848,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -1842,7 +1922,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -2142,7 +2222,7 @@ spec:
                                 name:
                                   description: |-
                                     Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                    case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                    case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                     If multiple entries specify equivalent header names, only the first
                                     entry with an equivalent name MUST be considered for a match. Subsequent
@@ -2515,7 +2595,7 @@ spec:
                         There are a number of cases where the "Accepted" condition may not be set
                         due to lack of controller visibility, that includes when:
 
-                        * The Route refers to a non-existent parent.
+                        * The Route refers to a nonexistent parent.
                         * The Route is of a type that the controller does not support.
                         * The Route is in a namespace the controller does not have access to.
                       items:
@@ -3192,7 +3272,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -3267,7 +3347,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -3399,9 +3479,49 @@ spec:
                                       - message: Must have port for Service reference
                                         rule: '(size(self.group) == 0 && self.kind
                                           == ''Service'') ? has(self.port) : true'
+                                    fraction:
+                                      description: |-
+                                        Fraction represents the fraction of requests that should be
+                                        mirrored to BackendRef.
+
+                                        Only one of Fraction or Percent may be specified. If neither field
+                                        is specified, 100% of requests will be mirrored.
+                                      properties:
+                                        denominator:
+                                          default: 100
+                                          format: int32
+                                          minimum: 1
+                                          type: integer
+                                        numerator:
+                                          format: int32
+                                          minimum: 0
+                                          type: integer
+                                      required:
+                                      - numerator
+                                      type: object
+                                      x-kubernetes-validations:
+                                      - message: numerator must be less than or equal
+                                          to denominator
+                                        rule: self.numerator <= self.denominator
+                                    percent:
+                                      description: |-
+                                        Percent represents the percentage of requests that should be
+                                        mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
+                                        requests) and its maximum value is 100 (indicating 100% of requests).
+
+                                        Only one of Fraction or Percent may be specified. If neither field
+                                        is specified, 100% of requests will be mirrored.
+                                      format: int32
+                                      maximum: 100
+                                      minimum: 0
+                                      type: integer
                                   required:
                                   - backendRef
                                   type: object
+                                  x-kubernetes-validations:
+                                  - message: Only one of percent or fraction may be
+                                      specified in HTTPRequestMirrorFilter
+                                    rule: '!(has(self.percent) && has(self.fraction))'
                                 requestRedirect:
                                   description: |-
                                     RequestRedirect defines a schema for a filter that responds to the
@@ -3588,7 +3708,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -3663,7 +3783,7 @@ spec:
                                           name:
                                             description: |-
                                               Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                              case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                              case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                               If multiple entries specify equivalent header names, the first entry with
                                               an equivalent name MUST be considered for a match. Subsequent entries
@@ -3984,7 +4104,7 @@ spec:
                         they are specified.
 
                         Implementations MAY choose to implement this ordering strictly, rejecting
-                        any combination or order of filters that can not be supported. If implementations
+                        any combination or order of filters that cannot be supported. If implementations
                         choose a strict interpretation of filter ordering, they MUST clearly document
                         that behavior.
 
@@ -4006,7 +4126,7 @@ spec:
 
                         All filters are expected to be compatible with each other except for the
                         URLRewrite and RequestRedirect filters, which may not be combined. If an
-                        implementation can not support other combinations of filters, they must clearly
+                        implementation cannot support other combinations of filters, they must clearly
                         document that limitation. In cases where incompatible or unsupported
                         filters are specified and cause the `Accepted` condition to be set to status
                         `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -4089,7 +4209,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -4163,7 +4283,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -4295,9 +4415,49 @@ spec:
                                 - message: Must have port for Service reference
                                   rule: '(size(self.group) == 0 && self.kind == ''Service'')
                                     ? has(self.port) : true'
+                              fraction:
+                                description: |-
+                                  Fraction represents the fraction of requests that should be
+                                  mirrored to BackendRef.
+
+                                  Only one of Fraction or Percent may be specified. If neither field
+                                  is specified, 100% of requests will be mirrored.
+                                properties:
+                                  denominator:
+                                    default: 100
+                                    format: int32
+                                    minimum: 1
+                                    type: integer
+                                  numerator:
+                                    format: int32
+                                    minimum: 0
+                                    type: integer
+                                required:
+                                - numerator
+                                type: object
+                                x-kubernetes-validations:
+                                - message: numerator must be less than or equal to
+                                    denominator
+                                  rule: self.numerator <= self.denominator
+                              percent:
+                                description: |-
+                                  Percent represents the percentage of requests that should be
+                                  mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
+                                  requests) and its maximum value is 100 (indicating 100% of requests).
+
+                                  Only one of Fraction or Percent may be specified. If neither field
+                                  is specified, 100% of requests will be mirrored.
+                                format: int32
+                                maximum: 100
+                                minimum: 0
+                                type: integer
                             required:
                             - backendRef
                             type: object
+                            x-kubernetes-validations:
+                            - message: Only one of percent or fraction may be specified
+                                in HTTPRequestMirrorFilter
+                              rule: '!(has(self.percent) && has(self.fraction))'
                           requestRedirect:
                             description: |-
                               RequestRedirect defines a schema for a filter that responds to the
@@ -4483,7 +4643,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -4557,7 +4717,7 @@ spec:
                                     name:
                                       description: |-
                                         Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                        case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                        case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                         If multiple entries specify equivalent header names, the first entry with
                                         an equivalent name MUST be considered for a match. Subsequent entries
@@ -4857,7 +5017,7 @@ spec:
                                 name:
                                   description: |-
                                     Name is the name of the HTTP Header to be matched. Name matching MUST be
-                                    case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
+                                    case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
 
                                     If multiple entries specify equivalent header names, only the first
                                     entry with an equivalent name MUST be considered for a match. Subsequent
@@ -5230,7 +5390,7 @@ spec:
                         There are a number of cases where the "Accepted" condition may not be set
                         due to lack of controller visibility, that includes when:
 
-                        * The Route refers to a non-existent parent.
+                        * The Route refers to a nonexistent parent.
                         * The Route is of a type that the controller does not support.
                         * The Route is in a namespace the controller does not have access to.
                       items:
diff --git a/conformance/apis/v1/conformancereport.go b/conformance/apis/v1/conformancereport.go
index 94e5e8e0..7f4f4d53 100644
--- a/conformance/apis/v1/conformancereport.go
+++ b/conformance/apis/v1/conformancereport.go
@@ -76,10 +76,10 @@ type Implementation struct {
 
 	// Contact is contact information for the maintainers so that Gateway API
 	// maintainers can get ahold of them as needed. Ideally this should be
-	// Github usernames (in the form of `@<username>`) or team names (in the
+	// GitHub usernames (in the form of `@<username>`) or team names (in the
 	// form of `@<team>/<name>`), but when that's not possible it can be email
 	// addresses.
-	// Rather than Github usernames or email addresses you can provide a URL to the relevant
+	// Rather than GitHub usernames or email addresses you can provide a URL to the relevant
 	// support pages for the project. Ideally this would be something like the issue creation page
 	// on a repository, but for projects without a publicly exposed repository a general support
 	// page URL can be provided.
@@ -90,19 +90,19 @@ type Implementation struct {
 func (i *Implementation) Validate() error {
 	// TODO: add data validation https://github.com/kubernetes-sigs/gateway-api/issues/2178
 	if i.Organization == "" {
-		return errors.New("implementation's organization can not be empty")
+		return errors.New("implementation's organization cannot be empty")
 	}
 	if i.Project == "" {
-		return errors.New("implementation's project can not be empty")
+		return errors.New("implementation's project cannot be empty")
 	}
 	if i.URL == "" {
-		return errors.New("implementation's url can not be empty")
+		return errors.New("implementation's url cannot be empty")
 	}
 	if i.Version == "" {
-		return errors.New("implementation's version can not be empty")
+		return errors.New("implementation's version cannot be empty")
 	}
 	if len(i.Contact) == 0 {
-		return errors.New("implementation's contact can not be empty")
+		return errors.New("implementation's contact cannot be empty")
 	}
 	return nil
 }
diff --git a/conformance/apis/v1/result.go b/conformance/apis/v1/result.go
index f3a826c4..0fbaec65 100644
--- a/conformance/apis/v1/result.go
+++ b/conformance/apis/v1/result.go
@@ -29,7 +29,7 @@ var (
 	// tests passing without any failures, but some were skipped.
 	Partial Result = "partial"
 
-	// Failure indicates that the test run concluded in one ore more tests
+	// Failure indicates that the test run concluded in one or more tests
 	// failing to complete successfully.
 	Failure Result = "failure"
 )
diff --git a/conformance/echo-basic/grpc/grpc.go b/conformance/echo-basic/grpc/grpc.go
index ffb55189..e2f1b88a 100644
--- a/conformance/echo-basic/grpc/grpc.go
+++ b/conformance/echo-basic/grpc/grpc.go
@@ -55,7 +55,7 @@ type serverConfig struct {
 	// Controlled by TLS_SERVER_PRIVKEY env var
 	TLSServerPrivKey string
 
-	// Controlled by HTPPS_PORT env var
+	// Controlled by HTTPS_PORT env var
 	HTTPSPort int
 }
 
diff --git a/conformance/echo-basic/grpcecho.proto b/conformance/echo-basic/grpcecho.proto
index 86c3fe6a..df744e5b 100644
--- a/conformance/echo-basic/grpcecho.proto
+++ b/conformance/echo-basic/grpcecho.proto
@@ -46,13 +46,13 @@ message TLSAssertions {
 	// The TLS version used by the connection, e.g. "TLSv1.3"
 	string version = 1;
 
-	// The negotatiated protocol.
+	// The negotiated protocol.
 	string negotiated_protocol = 2;
 
 	// The server name indication extension sent by the client.
 	string server_name = 3;
 
-	// The cipher suite negotatiated for the connection, e.g. "TLS_EDCHE_ECDSA_WITH_AES_128_GCM_SHA256"
+	// The cipher suite negotiated for the connection, e.g. "TLS_EDCHE_ECDSA_WITH_AES_128_GCM_SHA256"
 	string cipher_suite = 4;
 
 	// The parsed certificates sent by the peer, in the order in which they were sent.
diff --git a/conformance/echo-basic/grpcechoserver/grpcecho.pb.go b/conformance/echo-basic/grpcechoserver/grpcecho.pb.go
index 9585b776..88207f3f 100644
--- a/conformance/echo-basic/grpcechoserver/grpcecho.pb.go
+++ b/conformance/echo-basic/grpcechoserver/grpcecho.pb.go
@@ -177,11 +177,11 @@ type TLSAssertions struct {
 
 	// The TLS version used by the connection, e.g. "TLSv1.3"
 	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
-	// The negotatiated protocol.
+	// The negotiated protocol.
 	NegotiatedProtocol string `protobuf:"bytes,2,opt,name=negotiated_protocol,json=negotiatedProtocol,proto3" json:"negotiated_protocol,omitempty"`
 	// The server name indication extension sent by the client.
 	ServerName string `protobuf:"bytes,3,opt,name=server_name,json=serverName,proto3" json:"server_name,omitempty"`
-	// The cipher suite negotatiated for the connection, e.g. "TLS_EDCHE_ECDSA_WITH_AES_128_GCM_SHA256"
+	// The cipher suite negotiated for the connection, e.g. "TLS_EDCHE_ECDSA_WITH_AES_128_GCM_SHA256"
 	CipherSuite string `protobuf:"bytes,4,opt,name=cipher_suite,json=cipherSuite,proto3" json:"cipher_suite,omitempty"`
 	// The parsed certificates sent by the peer, in the order in which they were sent.
 	PeerCertificates []string `protobuf:"bytes,5,rep,name=peer_certificates,json=peerCertificates,proto3" json:"peer_certificates,omitempty"`
diff --git a/conformance/reports/README.md b/conformance/reports/README.md
index 98e8ffc3..02df5184 100644
--- a/conformance/reports/README.md
+++ b/conformance/reports/README.md
@@ -62,7 +62,7 @@ is structured as follows:
   needs to add information in the "reproduce" section (see below) on how to configure
   such a mode.
 - **Report**: the link to the related report. It MUST be in the form of
-  `[link](./report.yaml)`. The reports must be named according to the following
+  `[_version_ report](./report.yaml)`. The reports must be named according to the following
   pattern: `<API Channel>-<Implementation version>-<mode>-report.yaml`.
 
 ### Reproduce
@@ -110,7 +110,7 @@ comply with the following rules:
   - `contact`: it indicates the GitHub usernames of those who are responsible for
     maintaining this file, so they can be easily contacted when needed (e.g. for
     relevant release announcements regarding conformance, etc.). Optionally, it
-    can be an email address or a support URL (e.g. Github new issue page).
+    can be an email address or a support URL (e.g. GitHub new issue page).
   - `url`: it must be a valid url for a GitHub repository, or any other website with
     information related to the project.
   - `version`: it must be a snapshot of the project, which means it can be a commit,
diff --git a/conformance/reports/v0.7.1/cilium/README.md b/conformance/reports/v0.7.1/cilium/README.md
index 58e4a486..6e663bc4 100644
--- a/conformance/reports/v0.7.1/cilium/README.md
+++ b/conformance/reports/v0.7.1/cilium/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v1.14.0](https://github.com/cilium/cilium/releases/tag/v1.14.0)|x|[link](./v1.14.0-report.yaml)|
+|x|[v1.14.0](https://github.com/cilium/cilium/releases/tag/v1.14.0)|x|[v1.14.0 report](./v1.14.0-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.7.1/istio-istio/README.md b/conformance/reports/v0.7.1/istio-istio/README.md
index 1dc5b2c6..4cb7b550 100644
--- a/conformance/reports/v0.7.1/istio-istio/README.md
+++ b/conformance/reports/v0.7.1/istio-istio/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[pull-46148](https://github.com/istio/istio/pull/46148)|x|[link](./pull-46148-report.yaml)|
+|x|[pull-46148](https://github.com/istio/istio/pull/46148)|x|[PR #46148 report](./pull-46148-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.7.1/kong-kubernetes-ingress-controller/README.md b/conformance/reports/v0.7.1/kong-kubernetes-ingress-controller/README.md
index 7080ebf5..1013b28e 100644
--- a/conformance/reports/v0.7.1/kong-kubernetes-ingress-controller/README.md
+++ b/conformance/reports/v0.7.1/kong-kubernetes-ingress-controller/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[2.10.3](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v2.10.3)|x|[link](./2.10.3-report.yaml)|
+|x|[2.10.3](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v2.10.3)|x|[v2.10.3 report](./2.10.3-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.7.1/kumahq-kuma/README.md b/conformance/reports/v0.7.1/kumahq-kuma/README.md
index a297bf9e..9654b0f4 100644
--- a/conformance/reports/v0.7.1/kumahq-kuma/README.md
+++ b/conformance/reports/v0.7.1/kumahq-kuma/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|0.0.0-preview.vcf063c043|x|[link](./0.0.0-preview.vcf063c043-report.yaml)|
+|x|0.0.0-preview.vcf063c043|x|[v0.0.0-preview.vcf063c043 report](./0.0.0-preview.vcf063c043-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.7.1/nginx-nginx-gateway-fabric/README.md b/conformance/reports/v0.7.1/nginx-nginx-gateway-fabric/README.md
index 9e576363..afd22bf7 100644
--- a/conformance/reports/v0.7.1/nginx-nginx-gateway-fabric/README.md
+++ b/conformance/reports/v0.7.1/nginx-nginx-gateway-fabric/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v0.5.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v0.5.0)|x|[link](./v1.1.0-report.yaml)|
+|x|[v0.5.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v0.5.0)|x|[v0.5.0 report](./v0.5.0-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.7.1/projectcontour-contour/README.md b/conformance/reports/v0.7.1/projectcontour-contour/README.md
index c69a9bc7..d5a40a5d 100644
--- a/conformance/reports/v0.7.1/projectcontour-contour/README.md
+++ b/conformance/reports/v0.7.1/projectcontour-contour/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[f6c112e](https://github.com/projectcontour/contour/commit/f6c112e60a40ceb9d448354473a8fe7d1a726790)|x|[link](./f6c112e60a40ceb9d448354473a8fe7d1a726790-report.yaml)|
+|x|[f6c112e](https://github.com/projectcontour/contour/commit/f6c112e60a40ceb9d448354473a8fe7d1a726790)|x|[f6c112e report](./f6c112e60a40ceb9d448354473a8fe7d1a726790-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.8.0/envoy-gateway/README.md b/conformance/reports/v0.8.0/envoy-gateway/README.md
index c5049034..6f0693d9 100644
--- a/conformance/reports/v0.8.0/envoy-gateway/README.md
+++ b/conformance/reports/v0.8.0/envoy-gateway/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|latest|x|[link](./latest-report.yaml)|
+|x|latest|x|[latest report](./latest-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.8.0/kumahq-kuma/README.md b/conformance/reports/v0.8.0/kumahq-kuma/README.md
index 292ee2d7..d2d00236 100644
--- a/conformance/reports/v0.8.0/kumahq-kuma/README.md
+++ b/conformance/reports/v0.8.0/kumahq-kuma/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[2.4.1](https://github.com/kumahq/kuma/releases/tag/2.4.1)|x|[link](./2.4.1-report.yaml)|
+|x|[2.4.1](https://github.com/kumahq/kuma/releases/tag/2.4.1)|x|[v2.4.1 report](./2.4.1-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.8.0/nginx-nginx-gateway-fabric/README.md b/conformance/reports/v0.8.0/nginx-nginx-gateway-fabric/README.md
index a59427f8..499cb7a3 100644
--- a/conformance/reports/v0.8.0/nginx-nginx-gateway-fabric/README.md
+++ b/conformance/reports/v0.8.0/nginx-nginx-gateway-fabric/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v0.6.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v0.6.0)|x|[link](./v0.6.0-report.yaml)|
+|x|[v0.6.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v0.6.0)|x|[v0.6.0 report](./v0.6.0-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.8.0/projectcontour-contour/README.md b/conformance/reports/v0.8.0/projectcontour-contour/README.md
index 84543c52..7f5a1791 100644
--- a/conformance/reports/v0.8.0/projectcontour-contour/README.md
+++ b/conformance/reports/v0.8.0/projectcontour-contour/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v1.26.0](https://github.com/projectcontour/contour/releases/tag/v1.26.0)|x|[link](./v1.26.0-report.yaml)|
+|x|[v1.26.0](https://github.com/projectcontour/contour/releases/tag/v1.26.0)|x|[v1.26.0 report](./v1.26.0-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.8.1/cilium/README.md b/conformance/reports/v0.8.1/cilium/README.md
index 5d9aa10d..230164fa 100644
--- a/conformance/reports/v0.8.1/cilium/README.md
+++ b/conformance/reports/v0.8.1/cilium/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v1.15.0-pre.1](https://github.com/cilium/cilium/releases/tag/v1.15.0-pre.1)|x|[link](./v1.15.0-pre.1-report.yaml)|
+|x|[v1.15.0-pre.1](https://github.com/cilium/cilium/releases/tag/v1.15.0-pre.1)|x|[v1.15.0-pre.1 report](./v1.15.0-pre.1-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.8.1/kong-kubernetes-ingress-controller/README.md b/conformance/reports/v0.8.1/kong-kubernetes-ingress-controller/README.md
index 5100b0e5..8666b507 100644
--- a/conformance/reports/v0.8.1/kong-kubernetes-ingress-controller/README.md
+++ b/conformance/reports/v0.8.1/kong-kubernetes-ingress-controller/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v2.12.0](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v2.12.0)|x|[link](./v2.12.0-report.yaml)|
+|x|[v2.12.0](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v2.12.0)|x|[v2.12.0 report](./v2.12.0-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.8.1/nginx-nginx-gateway-fabric/README.md b/conformance/reports/v0.8.1/nginx-nginx-gateway-fabric/README.md
index 81eced0b..6767fe67 100644
--- a/conformance/reports/v0.8.1/nginx-nginx-gateway-fabric/README.md
+++ b/conformance/reports/v0.8.1/nginx-nginx-gateway-fabric/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v1.0.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.0.0)|x|[link](./v1.0.0-report.yaml)|
+|x|[v1.0.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.0.0)|x|[v1.0.0 report](./v1.0.0-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v0.8.1/projectcontour-contour/README.md b/conformance/reports/v0.8.1/projectcontour-contour/README.md
index 8effc1dc..b8b0005b 100644
--- a/conformance/reports/v0.8.1/projectcontour-contour/README.md
+++ b/conformance/reports/v0.8.1/projectcontour-contour/README.md
@@ -4,11 +4,11 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|experimental|[v1.27.0](https://github.com/projectcontour/contour/releases/tag/v1.27.0)|x|[link](./v1.27.0-report.yaml)|
-|experimental|[v1.27.1](https://github.com/projectcontour/contour/releases/tag/v1.27.1)|x|[link](./v1.27.1-report.yaml)|
-|experimental|[v1.27.2](https://github.com/projectcontour/contour/releases/tag/v1.27.2)|x|[link](./v1.27.2-report.yaml)|
-|experimental|[v1.27.3](https://github.com/projectcontour/contour/releases/tag/v1.27.3)|x|[link](./v1.27.3-report.yaml)|
-|experimental|[v1.27.4](https://github.com/projectcontour/contour/releases/tag/v1.27.4)|x|[link](./experimental-v1.27.4-default-report.yaml)|
+|experimental|[v1.27.0](https://github.com/projectcontour/contour/releases/tag/v1.27.0)|x|[v1.27.0 report](./v1.27.0-report.yaml)|
+|experimental|[v1.27.1](https://github.com/projectcontour/contour/releases/tag/v1.27.1)|x|[v1.27.1 report](./v1.27.1-report.yaml)|
+|experimental|[v1.27.2](https://github.com/projectcontour/contour/releases/tag/v1.27.2)|x|[v1.27.2 report](./v1.27.2-report.yaml)|
+|experimental|[v1.27.3](https://github.com/projectcontour/contour/releases/tag/v1.27.3)|x|[v1.27.3 report](./v1.27.3-report.yaml)|
+|experimental|[v1.27.4](https://github.com/projectcontour/contour/releases/tag/v1.27.4)|x|[v1.27.4 report](./experimental-v1.27.4-default-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.0.0/cilium/README.md b/conformance/reports/v1.0.0/cilium/README.md
index 4c71b887..90a71641 100644
--- a/conformance/reports/v1.0.0/cilium/README.md
+++ b/conformance/reports/v1.0.0/cilium/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v1.15.0-pre.3](https://github.com/cilium/cilium/releases/tag/v1.15.0-pre.3)|x|[link](./v1.15.0-pre.3-report.yaml)|
+|x|[v1.15.0-pre.3](https://github.com/cilium/cilium/releases/tag/v1.15.0-pre.3)|x|[v1.15.0-pre.3 report](./v1.15.0-pre.3-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v1.0.0/envoy-gateway/README.md b/conformance/reports/v1.0.0/envoy-gateway/README.md
index 6b62620e..338ae653 100644
--- a/conformance/reports/v1.0.0/envoy-gateway/README.md
+++ b/conformance/reports/v1.0.0/envoy-gateway/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v0.6.0](https://github.com/envoyproxy/gateway/releases/tag/v0.6.0)|x|[link](./v0.6.0-report.yaml)|
+|x|[v0.6.0](https://github.com/envoyproxy/gateway/releases/tag/v0.6.0)|x|[v0.6.0 report](./v0.6.0-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v1.0.0/gloo-gateway/README.md b/conformance/reports/v1.0.0/gloo-gateway/README.md
index 694697b6..329084bd 100644
--- a/conformance/reports/v1.0.0/gloo-gateway/README.md
+++ b/conformance/reports/v1.0.0/gloo-gateway/README.md
@@ -4,7 +4,7 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v1.17.4](https://github.com/solo-io/gloo/releases/tag/v1.17.4)|x|[link](./v1.17.4-report.yaml)|
+|x|[v1.17.4](https://github.com/solo-io/gloo/releases/tag/v1.17.4)|x|[v1.17.4 report](./v1.17.4-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.0.0/istio-istio/README.md b/conformance/reports/v1.0.0/istio-istio/README.md
index de96ceff..04016e9a 100644
--- a/conformance/reports/v1.0.0/istio-istio/README.md
+++ b/conformance/reports/v1.0.0/istio-istio/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[1.20](https://github.com/istio/istio/releases/tag/1.20.0)|x|[link](./1.20-report.yaml)|
+|x|[1.20](https://github.com/istio/istio/releases/tag/1.20.0)|x|[v1.20 report](./1.20-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v1.0.0/kong-kubernetes-ingress-controller/README.md b/conformance/reports/v1.0.0/kong-kubernetes-ingress-controller/README.md
index 89fb14db..8dd86de0 100644
--- a/conformance/reports/v1.0.0/kong-kubernetes-ingress-controller/README.md
+++ b/conformance/reports/v1.0.0/kong-kubernetes-ingress-controller/README.md
@@ -4,8 +4,8 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v3.0.2](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.0.2)|x|[link](./v3.0.2-report.yaml)|
-|x|[v3.1.1](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.1.1)|x|[link](./v3.1.1-report.yaml)|
+|x|[v3.0.2](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.0.2)|x|[v3.0.2 report](./v3.0.2-report.yaml)|
+|x|[v3.1.1](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.1.1)|x|[v3.1.1 report](./v3.1.1-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.0.0/kumahq-kuma/README.md b/conformance/reports/v1.0.0/kumahq-kuma/README.md
index a6a3e3c7..b138cf82 100644
--- a/conformance/reports/v1.0.0/kumahq-kuma/README.md
+++ b/conformance/reports/v1.0.0/kumahq-kuma/README.md
@@ -4,6 +4,6 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[2.6.0](https://github.com/kumahq/kuma/releases/tag/2.6.0)|x|[link](./2.6.0-report.yaml)|
+|x|[2.6.0](https://github.com/kumahq/kuma/releases/tag/2.6.0)|x|[v2.6.0 report](./2.6.0-report.yaml)|
 
 ## Reproduce
diff --git a/conformance/reports/v1.0.0/nginx-nginx-gateway-fabric/README.md b/conformance/reports/v1.0.0/nginx-nginx-gateway-fabric/README.md
index 86630cf7..8b04bb6e 100644
--- a/conformance/reports/v1.0.0/nginx-nginx-gateway-fabric/README.md
+++ b/conformance/reports/v1.0.0/nginx-nginx-gateway-fabric/README.md
@@ -4,8 +4,8 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v1.1.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.1.0)|x|[link](./v1.1.0-report.yaml)|
-|x|[v1.2.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.2.0)|x|[link](./v1.2.0-report.yaml)|
+|x|[v1.1.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.1.0)|x|[v1.1.0 report](./v1.1.0-report.yaml)|
+|x|[v1.2.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.2.0)|x|[v1.2.0 report](./v1.2.0-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.0.0/projectcontour-contour/README.md b/conformance/reports/v1.0.0/projectcontour-contour/README.md
index 1d8955fc..4cdce7d9 100644
--- a/conformance/reports/v1.0.0/projectcontour-contour/README.md
+++ b/conformance/reports/v1.0.0/projectcontour-contour/README.md
@@ -4,15 +4,15 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|experimental|[v1.28.1](https://github.com/projectcontour/contour/releases/tag/v1.28.1)|x|[link](./v1.28.1-report.yaml)|
-|experimental|[v1.28.2](https://github.com/projectcontour/contour/releases/tag/v1.28.2)|x|[link](./v1.28.2-report.yaml)|
-|experimental|[v1.28.3](https://github.com/projectcontour/contour/releases/tag/v1.28.3)|x|[link](./v1.28.3-report.yaml)|
-|experimental|[v1.28.4](https://github.com/projectcontour/contour/releases/tag/v1.28.4)|x|[link](./v1.28.4-report.yaml)|
-|experimental|[v1.28.5](https://github.com/projectcontour/contour/releases/tag/v1.28.5)|x|[link](./experimental-v1.28.5-default-report.yaml)|
-|experimental|[v1.28.6](https://github.com/projectcontour/contour/releases/tag/v1.28.6)|x|[link](./experimental-v1.28.6-default-report.yaml)|
-|experimental|[v1.29.0](https://github.com/projectcontour/contour/releases/tag/v1.29.0)|x|[link](./v1.29.0-report.yaml)|
-|experimental|[v1.29.1](https://github.com/projectcontour/contour/releases/tag/v1.29.1)|x|[link](./experimental-v1.29.1-default-report.yaml)|
-|experimental|[v1.29.2](https://github.com/projectcontour/contour/releases/tag/v1.29.2)|x|[link](./experimental-v1.29.2-default-report.yaml)|
+|experimental|[v1.28.1](https://github.com/projectcontour/contour/releases/tag/v1.28.1)|x|[v1.28.1 report](./v1.28.1-report.yaml)|
+|experimental|[v1.28.2](https://github.com/projectcontour/contour/releases/tag/v1.28.2)|x|[v1.28.2 report](./v1.28.2-report.yaml)|
+|experimental|[v1.28.3](https://github.com/projectcontour/contour/releases/tag/v1.28.3)|x|[v1.28.3 report](./v1.28.3-report.yaml)|
+|experimental|[v1.28.4](https://github.com/projectcontour/contour/releases/tag/v1.28.4)|x|[v1.28.4 report](./v1.28.4-report.yaml)|
+|experimental|[v1.28.5](https://github.com/projectcontour/contour/releases/tag/v1.28.5)|x|[v1.28.5 report](./experimental-v1.28.5-default-report.yaml)|
+|experimental|[v1.28.6](https://github.com/projectcontour/contour/releases/tag/v1.28.6)|x|[v1.28.6 report](./experimental-v1.28.6-default-report.yaml)|
+|experimental|[v1.29.0](https://github.com/projectcontour/contour/releases/tag/v1.29.0)|x|[v1.29.0 report](./v1.29.0-report.yaml)|
+|experimental|[v1.29.1](https://github.com/projectcontour/contour/releases/tag/v1.29.1)|x|[v1.29.1 report](./experimental-v1.29.1-default-report.yaml)|
+|experimental|[v1.29.2](https://github.com/projectcontour/contour/releases/tag/v1.29.2)|x|[v1.29.2 report](./experimental-v1.29.2-default-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.1.0/airlock-microgateway/README.md b/conformance/reports/v1.1.0/airlock-microgateway/README.md
index 6758cfc8..c7464092 100644
--- a/conformance/reports/v1.1.0/airlock-microgateway/README.md
+++ b/conformance/reports/v1.1.0/airlock-microgateway/README.md
@@ -4,7 +4,9 @@
 
 | API channel  | Implementation version                                               | Mode    | Report                                           |
 |--------------|----------------------------------------------------------------------|---------|--------------------------------------------------|
-| experimental | [v4.4.0](https://github.com/airlock/microgateway/releases/tag/4.4.0) | default | [link](./experimental-4.4.0-default-report.yaml) |
+| experimental | [v4.4.0](https://github.com/airlock/microgateway/releases/tag/4.4.0) | default | [v4.4.0 report](./experimental-4.4.0-default-report.yaml) |
+| standard     | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [v4.5.0 report](./standard-4.5.0-default-report.yaml)     |
+
 
 ## Reproduce
 
@@ -14,3 +16,7 @@ The Airlock Microgateway conformance report can be reproduced by following the s
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
 > Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
+> 
+> The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
diff --git a/conformance/reports/v1.1.0/airlock-microgateway/standard-4.5.0-default-report.yaml b/conformance/reports/v1.1.0/airlock-microgateway/standard-4.5.0-default-report.yaml
new file mode 100644
index 00000000..1c261b3a
--- /dev/null
+++ b/conformance/reports/v1.1.0/airlock-microgateway/standard-4.5.0-default-report.yaml
@@ -0,0 +1,47 @@
+apiVersion: gateway.networking.k8s.io/v1alpha1
+date: "2025-02-03T15:50:39Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.1.0
+implementation:
+  contact:
+    - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.5.0
+kind: ConformanceReport
+mode: default
+profiles:
+  - core:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 33
+        Skipped: 0
+    extended:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 10
+        Skipped: 0
+      supportedFeatures:
+        - GatewayPort8080
+        - HTTPRouteHostRewrite
+        - HTTPRouteMethodMatching
+        - HTTPRouteParentRefPort
+        - HTTPRoutePathRewrite
+        - HTTPRoutePortRedirect
+        - HTTPRouteQueryParamMatching
+        - HTTPRouteSchemeRedirect
+      unsupportedFeatures:
+        - GatewayHTTPListenerIsolation
+        - GatewayStaticAddresses
+        - HTTPRouteBackendRequestHeaderModification
+        - HTTPRouteBackendTimeout
+        - HTTPRoutePathRedirect
+        - HTTPRouteRequestMirror
+        - HTTPRouteRequestMultipleMirrors
+        - HTTPRouteRequestTimeout
+        - HTTPRouteResponseHeaderModification
+    name: GATEWAY-HTTP
+    summary: Core tests succeeded. Extended tests succeeded.
diff --git a/conformance/reports/v1.1.0/azure-application-gateway-for-containers/README.md b/conformance/reports/v1.1.0/azure-application-gateway-for-containers/README.md
index 33eeb6c9..bbb637d0 100644
--- a/conformance/reports/v1.1.0/azure-application-gateway-for-containers/README.md
+++ b/conformance/reports/v1.1.0/azure-application-gateway-for-containers/README.md
@@ -6,7 +6,7 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[v1.1.0](https://learn.microsoft.com/azure/application-gateway/for-containers/alb-controller-release-notes#latest-release-recommended)|x|[link](./standard-v1.1.0-default-report.yaml)|
+|x|[v1.1.0](https://learn.microsoft.com/azure/application-gateway/for-containers/alb-controller-release-notes#latest-release-recommended)|x|[v1.1.0 report](./standard-v1.1.0-default-report.yaml)|
 
 
 [azure-application-gateway-for-containers]:https://aka.ms/appgwcontainers/docs
diff --git a/conformance/reports/v1.1.0/cilium-cilium/README.md b/conformance/reports/v1.1.0/cilium-cilium/README.md
index 64ac1499..fa5e07a8 100644
--- a/conformance/reports/v1.1.0/cilium-cilium/README.md
+++ b/conformance/reports/v1.1.0/cilium-cilium/README.md
@@ -4,7 +4,7 @@
 
 | API channel  | Implementation version                                       | Mode    | Report                                          |
 |--------------|--------------------------------------------------------------|---------|-------------------------------------------------|
-| experimental | [1.16](https://github.com/cilium/cilium/releases/tag/1.16.0) | default | [link](./experimental-1.16-default-report.yaml) |
+| experimental | [1.16](https://github.com/cilium/cilium/releases/tag/1.16.0) | default | [v1.16 report](./experimental-1.16-default-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.1.0/envoy-gateway/README.md b/conformance/reports/v1.1.0/envoy-gateway/README.md
index fee6280b..36eb9b29 100644
--- a/conformance/reports/v1.1.0/envoy-gateway/README.md
+++ b/conformance/reports/v1.1.0/envoy-gateway/README.md
@@ -4,7 +4,7 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-| experimental |[v1.1.0](https://github.com/envoyproxy/gateway/releases/tag/v1.1.0)| default |[link](./experimental-v1.1.0-default-report.yaml)|
+| experimental |[v1.1.0](https://github.com/envoyproxy/gateway/releases/tag/v1.1.0)| default |[v1.1.0 report](./experimental-v1.1.0-default-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.1.0/gke-gateway/README.md b/conformance/reports/v1.1.0/gke-gateway/README.md
index ece122dc..54a41bda 100644
--- a/conformance/reports/v1.1.0/gke-gateway/README.md
+++ b/conformance/reports/v1.1.0/gke-gateway/README.md
@@ -4,9 +4,9 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|standard|1.30.3-gke.1211000|gke-l7-global-external-managed|[link](./standard-1.30.3-gxlb-report.yaml)|
-|standard|1.30.3-gke.1211000|gke-l7-regional-external-managed|[link](./standard-1.30.3-rxlb-report.yaml)|
-|standard|1.30.3-gke.1211000|gke-l7-rilb|[link](./standard-1.30.3-rilb-report.yaml)|
+|standard|1.30.3-gke.1211000|gke-l7-global-external-managed|[v1.30.3 gxlb report](./standard-1.30.3-gxlb-report.yaml)|
+|standard|1.30.3-gke.1211000|gke-l7-regional-external-managed|[v1.30.3 rxlb report](./standard-1.30.3-rxlb-report.yaml)|
+|standard|1.30.3-gke.1211000|gke-l7-rilb|[v1.30.3 rilb report](./standard-1.30.3-rilb-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.1.0/istio-istio/README.md b/conformance/reports/v1.1.0/istio-istio/README.md
index 564b301f..5555578b 100644
--- a/conformance/reports/v1.1.0/istio-istio/README.md
+++ b/conformance/reports/v1.1.0/istio-istio/README.md
@@ -4,7 +4,7 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[1.22](https://github.com/istio/istio/releases/tag/1.22.0)|x|[link](./experimental-1.22-default-report.yaml)|
+|x|[1.22](https://github.com/istio/istio/releases/tag/1.22.0)|x|[v1.22 report](./experimental-1.22-default-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.1.0/kong-kubernetes-ingress-controller/README.md b/conformance/reports/v1.1.0/kong-kubernetes-ingress-controller/README.md
index 273c653c..5e2d60bb 100644
--- a/conformance/reports/v1.1.0/kong-kubernetes-ingress-controller/README.md
+++ b/conformance/reports/v1.1.0/kong-kubernetes-ingress-controller/README.md
@@ -4,8 +4,8 @@
 
 | API channel  | Implementation version                                                              | Mode        | Report                                                |
 |--------------|-------------------------------------------------------------------------------------|-------------|-------------------------------------------------------|
-| experimental | [v3.3.1](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.3.1) | expressions | [link](./experimental-v3.3.1-expressions-report.yaml) |
-| experimental | [v3.2.0](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.2.0) | expressions | [link](./experimental-v3.2.0-expressions-report.yaml) |
+| experimental | [v3.3.1](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.3.1) | expressions | [v3.3.1 expressions report](./experimental-v3.3.1-expressions-report.yaml) |
+| experimental | [v3.2.0](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.2.0) | expressions | [v3.2.0 expressions report](./experimental-v3.2.0-expressions-report.yaml) |
 ## Reproduce
 
 ### Prerequisites
diff --git a/conformance/reports/v1.1.0/nginx-nginx-gateway-fabric/README.md b/conformance/reports/v1.1.0/nginx-nginx-gateway-fabric/README.md
index 58910d0d..efe32eed 100644
--- a/conformance/reports/v1.1.0/nginx-nginx-gateway-fabric/README.md
+++ b/conformance/reports/v1.1.0/nginx-nginx-gateway-fabric/README.md
@@ -4,7 +4,7 @@
 
 | API channel | Implementation version                                                      | Mode    | Report                                       |
 |-------------|-----------------------------------------------------------------------------|---------|----------------------------------------------|
-| experimental    | [v1.4.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.4.0) | default | [link](./experimental-1.4.0-default-report.yaml) |
+| experimental    | [v1.4.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.4.0) | default | [v1.4.0 report](./experimental-1.4.0-default-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.1.0/projectcontour-contour/README.md b/conformance/reports/v1.1.0/projectcontour-contour/README.md
index cc4eed9f..70281472 100644
--- a/conformance/reports/v1.1.0/projectcontour-contour/README.md
+++ b/conformance/reports/v1.1.0/projectcontour-contour/README.md
@@ -4,7 +4,7 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|experimental|[v1.30.0](https://github.com/projectcontour/contour/releases/tag/v1.30.0)|x|[link](./experimental-v1.30.0-default-report.yaml)|
+|experimental|[v1.30.0](https://github.com/projectcontour/contour/releases/tag/v1.30.0)|x|[v1.30.0 report](./experimental-v1.30.0-default-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.1.0/traefik-traefik/README.md b/conformance/reports/v1.1.0/traefik-traefik/README.md
index 29bfd03d..8d3e38a6 100644
--- a/conformance/reports/v1.1.0/traefik-traefik/README.md
+++ b/conformance/reports/v1.1.0/traefik-traefik/README.md
@@ -4,7 +4,7 @@
 
 | API channel  | Implementation version                                             | Mode    | Report                                            |
 |--------------|--------------------------------------------------------------------|---------|---------------------------------------------------|
-| experimental | [v3.1](https://github.com/traefik/traefik/releases/tag/v3.1.0-rc2) | default | [link](./experimental-v3.1.0-default-report.yaml) |
+| experimental | [v3.1](https://github.com/traefik/traefik/releases/tag/v3.1.0-rc2) | default | [v3.1 report](./experimental-v3.1.0-default-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.1.1/airlock-microgateway/README.md b/conformance/reports/v1.1.1/airlock-microgateway/README.md
new file mode 100644
index 00000000..27868c3f
--- /dev/null
+++ b/conformance/reports/v1.1.1/airlock-microgateway/README.md
@@ -0,0 +1,20 @@
+# Airlock Microgateway
+
+## Table of contents
+
+| API channel | Implementation version                                               | Mode    | Report                                       |
+|-------------|----------------------------------------------------------------------|---------|----------------------------------------------|
+| standard    | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./standard-4.5.0-default-report.yaml) |
+
+## Reproduce
+
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+
+> [!NOTE]
+> The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
+> 
+> The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
diff --git a/conformance/reports/v1.1.1/airlock-microgateway/standard-4.5.0-default-report.yaml b/conformance/reports/v1.1.1/airlock-microgateway/standard-4.5.0-default-report.yaml
new file mode 100644
index 00000000..a64ac3e4
--- /dev/null
+++ b/conformance/reports/v1.1.1/airlock-microgateway/standard-4.5.0-default-report.yaml
@@ -0,0 +1,47 @@
+apiVersion: gateway.networking.k8s.io/v1alpha1
+date: "2025-02-03T15:50:18Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.1.1
+implementation:
+  contact:
+    - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.5.0
+kind: ConformanceReport
+mode: default
+profiles:
+  - core:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 33
+        Skipped: 0
+    extended:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 10
+        Skipped: 0
+      supportedFeatures:
+        - GatewayPort8080
+        - HTTPRouteHostRewrite
+        - HTTPRouteMethodMatching
+        - HTTPRouteParentRefPort
+        - HTTPRoutePathRewrite
+        - HTTPRoutePortRedirect
+        - HTTPRouteQueryParamMatching
+        - HTTPRouteSchemeRedirect
+      unsupportedFeatures:
+        - GatewayHTTPListenerIsolation
+        - GatewayStaticAddresses
+        - HTTPRouteBackendRequestHeaderModification
+        - HTTPRouteBackendTimeout
+        - HTTPRoutePathRedirect
+        - HTTPRouteRequestMirror
+        - HTTPRouteRequestMultipleMirrors
+        - HTTPRouteRequestTimeout
+        - HTTPRouteResponseHeaderModification
+    name: GATEWAY-HTTP
+    summary: Core tests succeeded. Extended tests succeeded.
diff --git a/conformance/reports/v1.2.0/airlock-microgateway/README.md b/conformance/reports/v1.2.0/airlock-microgateway/README.md
new file mode 100644
index 00000000..27868c3f
--- /dev/null
+++ b/conformance/reports/v1.2.0/airlock-microgateway/README.md
@@ -0,0 +1,20 @@
+# Airlock Microgateway
+
+## Table of contents
+
+| API channel | Implementation version                                               | Mode    | Report                                       |
+|-------------|----------------------------------------------------------------------|---------|----------------------------------------------|
+| standard    | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./standard-4.5.0-default-report.yaml) |
+
+## Reproduce
+
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+
+> [!NOTE]
+> The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
+> 
+> The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
diff --git a/conformance/reports/v1.2.0/airlock-microgateway/standard-4.5.0-default-report.yaml b/conformance/reports/v1.2.0/airlock-microgateway/standard-4.5.0-default-report.yaml
new file mode 100644
index 00000000..b6c03671
--- /dev/null
+++ b/conformance/reports/v1.2.0/airlock-microgateway/standard-4.5.0-default-report.yaml
@@ -0,0 +1,53 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-02-03T15:51:50Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.2.0
+implementation:
+  contact:
+    - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.5.0
+kind: ConformanceReport
+mode: default
+profiles:
+  - core:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 33
+        Skipped: 0
+    extended:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 16
+        Skipped: 0
+      supportedFeatures:
+        - GatewayInfrastructurePropagation
+        - GatewayPort8080
+        - HTTPRouteBackendProtocolH2C
+        - HTTPRouteBackendProtocolWebSocket
+        - HTTPRouteBackendTimeout
+        - HTTPRouteDestinationPortMatching
+        - HTTPRouteHostRewrite
+        - HTTPRouteMethodMatching
+        - HTTPRouteParentRefPort
+        - HTTPRoutePathRewrite
+        - HTTPRoutePortRedirect
+        - HTTPRouteQueryParamMatching
+        - HTTPRouteRequestTimeout
+        - HTTPRouteSchemeRedirect
+      unsupportedFeatures:
+        - GatewayHTTPListenerIsolation
+        - GatewayStaticAddresses
+        - HTTPRouteBackendRequestHeaderModification
+        - HTTPRoutePathRedirect
+        - HTTPRouteRequestMirror
+        - HTTPRouteRequestMultipleMirrors
+        - HTTPRouteResponseHeaderModification
+    name: GATEWAY-HTTP
+    summary: Core tests succeeded. Extended tests succeeded.
+succeededProvisionalTests:
+  - GatewayInfrastructure
diff --git a/conformance/reports/v1.2.0/cilium-cilium/README.md b/conformance/reports/v1.2.0/cilium-cilium/README.md
index 8eb14a5c..473e5f88 100644
--- a/conformance/reports/v1.2.0/cilium-cilium/README.md
+++ b/conformance/reports/v1.2.0/cilium-cilium/README.md
@@ -4,7 +4,7 @@
 
 | API channel  | Implementation version                                                      | Mode    | Report                                          |
 |--------------|-----------------------------------------------------------------------------|---------|-------------------------------------------------|
-| experimental | [1.17.0-pre.1](https://github.com/cilium/cilium/releases/tag/v1.17.0-pre.1) | default | [link](./experimental-1.17-default-report.yaml) |
+| experimental | [1.17.0-pre.1](https://github.com/cilium/cilium/releases/tag/v1.17.0-pre.1) | default | [v1.17 report](./experimental-1.17-default-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.0/envoy-gateway/README.md b/conformance/reports/v1.2.0/envoy-gateway/README.md
index 68729b5f..183ac5a2 100644
--- a/conformance/reports/v1.2.0/envoy-gateway/README.md
+++ b/conformance/reports/v1.2.0/envoy-gateway/README.md
@@ -4,7 +4,7 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-| experimental |[v1.2.0-rc.1](https://github.com/envoyproxy/gateway/releases/tag/v1.2.0-rc.1)| default |[link](./experimental-v1.2.0-default-report.yaml)|
+| experimental |[v1.2.0-rc.1](https://github.com/envoyproxy/gateway/releases/tag/v1.2.0-rc.1)| default |[v1.2.0 report](./experimental-v1.2.0-default-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.0/istio-istio/README.md b/conformance/reports/v1.2.0/istio-istio/README.md
index 1516004d..51d1f61b 100644
--- a/conformance/reports/v1.2.0/istio-istio/README.md
+++ b/conformance/reports/v1.2.0/istio-istio/README.md
@@ -4,7 +4,7 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[1.24](https://github.com/istio/istio/releases/tag/1.24.0)|x|[link](./experimental-1.24-default-report.yaml)|
+|x|[1.24](https://github.com/istio/istio/releases/tag/1.24.0)|x|[v1.24 report](./experimental-1.24-default-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.0/kong-gateway-operator/README.md b/conformance/reports/v1.2.0/kong-gateway-operator/README.md
index a9f40ded..8bb79c2f 100644
--- a/conformance/reports/v1.2.0/kong-gateway-operator/README.md
+++ b/conformance/reports/v1.2.0/kong-gateway-operator/README.md
@@ -4,7 +4,7 @@
 
 | API channel  | Implementation version                                                              | Mode        | Report                                                |
 |--------------|-------------------------------------------------------------------------------------|-------------|-------------------------------------------------------|
-| standard | [v1.4.0](https://github.com/Kong/gateway-operator/releases/tag/v1.4.0) | expressions | [link](./standard-v1.4.0-expressions-report.yaml) |
+| standard | [v1.4.0](https://github.com/Kong/gateway-operator/releases/tag/v1.4.0) | expressions | [v1.4.0 expressions report](./standard-v1.4.0-expressions-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.0/kong-kubernetes-ingress-controller/README.md b/conformance/reports/v1.2.0/kong-kubernetes-ingress-controller/README.md
index 99fd9172..1f535d80 100644
--- a/conformance/reports/v1.2.0/kong-kubernetes-ingress-controller/README.md
+++ b/conformance/reports/v1.2.0/kong-kubernetes-ingress-controller/README.md
@@ -4,7 +4,7 @@
 
 | API channel  | Implementation version                                                              | Mode        | Report                                                |
 |--------------|-------------------------------------------------------------------------------------|-------------|-------------------------------------------------------|
-| experimental | [v3.2.0-244-gea4944bb0](https://github.com/Kong/kubernetes-ingress-controller/commit/b5c61d20e325055cd4665b4c29aeea5288c20d2a) | expressions | [link](./experimental-v3.2.0-244-gea4944bb0-expressions-report.yaml) |
+| experimental | [v3.2.0-244-gea4944bb0](https://github.com/Kong/kubernetes-ingress-controller/commit/b5c61d20e325055cd4665b4c29aeea5288c20d2a) | expressions | [v3.2.0-244-gea4944bb0 expressions report](./experimental-v3.2.0-244-gea4944bb0-expressions-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.0/nginx-nginx-gateway-fabric/README.md b/conformance/reports/v1.2.0/nginx-nginx-gateway-fabric/README.md
index 4d8c6e2d..ef0c33e6 100644
--- a/conformance/reports/v1.2.0/nginx-nginx-gateway-fabric/README.md
+++ b/conformance/reports/v1.2.0/nginx-nginx-gateway-fabric/README.md
@@ -4,7 +4,7 @@
 
 | API channel  | Implementation version                                                      | Mode    | Report                                           |
 |--------------|-----------------------------------------------------------------------------|---------|--------------------------------------------------|
-| experimental | [v1.5.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.5.0) | default | [link](./experimental-1.5.0-default-report.yaml) |
+| experimental | [v1.5.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.5.0) | default | [v1.5.0 report](./experimental-1.5.0-default-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.0/traefik-traefik/README.md b/conformance/reports/v1.2.0/traefik-traefik/README.md
index 442861b8..3628e418 100644
--- a/conformance/reports/v1.2.0/traefik-traefik/README.md
+++ b/conformance/reports/v1.2.0/traefik-traefik/README.md
@@ -4,7 +4,7 @@
 
 | API channel  | Implementation version                                             | Mode    | Report                                            |
 |--------------|--------------------------------------------------------------------|---------|---------------------------------------------------|
-| experimental | [v3.2](https://github.com/traefik/traefik/releases/tag/v3.2.0-rc2) | default | [link](./experimental-v3.2.0-default-report.yaml) |
+| experimental | [v3.2](https://github.com/traefik/traefik/releases/tag/v3.2.0-rc2) | default | [v3.2.0 report](./experimental-v3.2.0-default-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.1/airlock-microgateway/README.md b/conformance/reports/v1.2.1/airlock-microgateway/README.md
new file mode 100644
index 00000000..6e691ffb
--- /dev/null
+++ b/conformance/reports/v1.2.1/airlock-microgateway/README.md
@@ -0,0 +1,20 @@
+# Airlock Microgateway
+
+## Table of contents
+
+| API channel  | Implementation version                                               | Mode    | Report                                           |
+|--------------|----------------------------------------------------------------------|---------|--------------------------------------------------|
+| experimental | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./experimental-4.5.0-default-report.yaml) |
+
+## Reproduce
+
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+
+> [!NOTE]
+> The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
+> 
+> The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
diff --git a/conformance/reports/v1.2.1/airlock-microgateway/experimental-4.5.0-default-report.yaml b/conformance/reports/v1.2.1/airlock-microgateway/experimental-4.5.0-default-report.yaml
new file mode 100644
index 00000000..5831e341
--- /dev/null
+++ b/conformance/reports/v1.2.1/airlock-microgateway/experimental-4.5.0-default-report.yaml
@@ -0,0 +1,53 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-02-03T15:48:50Z"
+gatewayAPIChannel: experimental
+gatewayAPIVersion: v1.2.1
+implementation:
+  contact:
+    - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.5.0
+kind: ConformanceReport
+mode: default
+profiles:
+  - core:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 33
+        Skipped: 0
+    extended:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 16
+        Skipped: 0
+      supportedFeatures:
+        - GatewayInfrastructurePropagation
+        - GatewayPort8080
+        - HTTPRouteBackendProtocolH2C
+        - HTTPRouteBackendProtocolWebSocket
+        - HTTPRouteBackendTimeout
+        - HTTPRouteDestinationPortMatching
+        - HTTPRouteHostRewrite
+        - HTTPRouteMethodMatching
+        - HTTPRouteParentRefPort
+        - HTTPRoutePathRewrite
+        - HTTPRoutePortRedirect
+        - HTTPRouteQueryParamMatching
+        - HTTPRouteRequestTimeout
+        - HTTPRouteSchemeRedirect
+      unsupportedFeatures:
+        - GatewayHTTPListenerIsolation
+        - GatewayStaticAddresses
+        - HTTPRouteBackendRequestHeaderModification
+        - HTTPRoutePathRedirect
+        - HTTPRouteRequestMirror
+        - HTTPRouteRequestMultipleMirrors
+        - HTTPRouteResponseHeaderModification
+    name: GATEWAY-HTTP
+    summary: Core tests succeeded. Extended tests succeeded.
+succeededProvisionalTests:
+  - GatewayInfrastructure
diff --git a/conformance/reports/v1.2.1/cilium-cilium/README.md b/conformance/reports/v1.2.1/cilium-cilium/README.md
new file mode 100644
index 00000000..c772fbd6
--- /dev/null
+++ b/conformance/reports/v1.2.1/cilium-cilium/README.md
@@ -0,0 +1,12 @@
+# Cilium
+
+## Table of Contents
+
+| API channel  | Implementation version                                          | Mode    | Report                                          |
+|--------------|-----------------------------------------------------------------|---------|-------------------------------------------------|
+| experimental | [1.17.0](https://github.com/cilium/cilium/releases/tag/v1.17.0) | default | [v1.17 report](./experimental-1.17-default-report.yaml) |
+
+## Reproduce
+
+Cilium conformance tests can be reproduced by follow the steps in CI `.github/workflows/conformance-gateway-api.yaml` 
+from within the [Cilium repo](https://github.com/cilium/cilium).
diff --git a/conformance/reports/v1.2.1/cilium-cilium/experimental-1.17-default-report.yaml b/conformance/reports/v1.2.1/cilium-cilium/experimental-1.17-default-report.yaml
new file mode 100644
index 00000000..83a1a664
--- /dev/null
+++ b/conformance/reports/v1.2.1/cilium-cilium/experimental-1.17-default-report.yaml
@@ -0,0 +1,134 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-02-17T10:07:02Z"
+gatewayAPIChannel: experimental
+gatewayAPIVersion: v1.2.1
+implementation:
+  contact:
+  - https://github.com/cilium/community/blob/main/roles/Maintainers.md
+  organization: cilium
+  project: cilium
+  url: github.com/cilium/cilium
+  version: v1.17
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 11
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 2
+      Skipped: 0
+    supportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayInfrastructurePropagation
+    - GatewayPort8080
+    - GatewayStaticAddresses
+  name: GATEWAY-TLS
+  summary: Core tests succeeded. Extended tests succeeded.
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 1
+      Skipped: 0
+  name: MESH-GRPC
+  summary: Core tests succeeded.
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 2
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 2
+      Skipped: 0
+    supportedFeatures:
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestTimeout
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    - MeshClusterIPMatching
+    unsupportedFeatures:
+    - HTTPRouteParentRefPort
+    - MeshConsumerRoute
+  name: MESH-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 12
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 2
+      Skipped: 0
+    supportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayInfrastructurePropagation
+    - GatewayPort8080
+    - GatewayStaticAddresses
+  name: GATEWAY-GRPC
+  summary: Core tests succeeded. Extended tests succeeded.
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 21
+      Skipped: 0
+    supportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayInfrastructurePropagation
+    - GatewayPort8080
+    - GatewayStaticAddresses
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestTimeout
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - HTTPRouteParentRefPort
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
+succeededProvisionalTests:
+- GatewayInfrastructure
diff --git a/conformance/reports/v1.2.1/envoy-gateway/README.md b/conformance/reports/v1.2.1/envoy-gateway/README.md
new file mode 100644
index 00000000..89dbb8cb
--- /dev/null
+++ b/conformance/reports/v1.2.1/envoy-gateway/README.md
@@ -0,0 +1,34 @@
+# Envoy Gateway
+
+## Table of Contents
+
+|API channel|Implementation version|Mode|Report|
+|-----------|----------------------|----|------|
+| experimental |[v1.3.1](https://github.com/envoyproxy/gateway/releases/tag/v1.3.1)| default |[link](./experimental-v1.2.1-default-report.yaml)|
+
+## Reproduce
+
+1. Clone the Envoy Gateway GitHub repository
+
+   ```bash
+   git clone https://github.com/envoyproxy/gateway.git && cd gateway
+   ```
+
+2. Check out the desired version
+
+   ```bash
+   export VERSION=v<x.y.z>
+   git checkout $VERSION
+   ```
+
+3. Run the conformance tests
+
+   ```bash
+   CONFORMANCE_REPORT_PATH=conformance-report-k8s.yaml make experimental-conformance
+   ```
+
+4. Check the produced report
+
+   ```bash
+   cat ./conformance-report-k8s.yaml
+   ```
diff --git a/conformance/reports/v1.2.1/envoy-gateway/experimental-v1.3.1-default-report.yaml b/conformance/reports/v1.2.1/envoy-gateway/experimental-v1.3.1-default-report.yaml
new file mode 100644
index 00000000..967c96f5
--- /dev/null
+++ b/conformance/reports/v1.2.1/envoy-gateway/experimental-v1.3.1-default-report.yaml
@@ -0,0 +1,67 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-03-05T13:37:19Z"
+gatewayAPIChannel: experimental
+gatewayAPIVersion: v1.2.1
+implementation:
+  contact:
+  - https://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md
+  organization: envoyproxy
+  project: envoy-gateway
+  url: https://github.com/envoyproxy/gateway
+  version: latest
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 11
+      Skipped: 0
+  name: GATEWAY-TLS
+  summary: Core tests succeeded.
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 12
+      Skipped: 0
+  name: GATEWAY-GRPC
+  summary: Core tests succeeded.
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 21
+      Skipped: 0
+    supportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayPort8080
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestTimeout
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayInfrastructurePropagation
+    - GatewayStaticAddresses
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
diff --git a/conformance/reports/v1.2.1/istio-istio/README.md b/conformance/reports/v1.2.1/istio-istio/README.md
index 14cdc3aa..fc1d1ea7 100644
--- a/conformance/reports/v1.2.1/istio-istio/README.md
+++ b/conformance/reports/v1.2.1/istio-istio/README.md
@@ -4,7 +4,7 @@
 
 |API channel|Implementation version|Mode|Report|
 |-----------|----------------------|----|------|
-|x|[1.24](https://github.com/istio/istio/releases/tag/1.24.2)|x|[link](./experimental-1.24-default-report.yaml)|
+|x|[1.24](https://github.com/istio/istio/releases/tag/1.24.2)|x|[v1.2.4 report](./experimental-1.24-default-report.yaml)|
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.1/kong-kubernetes-ingress-controller/README.md b/conformance/reports/v1.2.1/kong-kubernetes-ingress-controller/README.md
index 5aba5992..401f1636 100644
--- a/conformance/reports/v1.2.1/kong-kubernetes-ingress-controller/README.md
+++ b/conformance/reports/v1.2.1/kong-kubernetes-ingress-controller/README.md
@@ -4,8 +4,8 @@
 
 | API channel  | Implementation version                                                              | Mode        | Report                                                |
 |--------------|-------------------------------------------------------------------------------------|-------------|-------------------------------------------------------|
-| experimental | [v3.4.0](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.4.0) | expressions | [link](./experimental-v3.4.0-expressions-report.yaml) |
-| experimental | [v3.4.0](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.4.0) | traditional_compatible | [link](./experimental-v3.4.0-traditional_compatible-report.yaml) |
+| experimental | [v3.4.0](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.4.0) | expressions | [v3.4.0 expressions report](./experimental-v3.4.0-expressions-report.yaml) |
+| experimental | [v3.4.0](https://github.com/Kong/kubernetes-ingress-controller/releases/tag/v3.4.0) | traditional_compatible | [v3.4.0 traditional compatible report](./experimental-v3.4.0-traditional_compatible-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.1/nginx-nginx-gateway-fabric/README.md b/conformance/reports/v1.2.1/nginx-nginx-gateway-fabric/README.md
index d8bc5cfe..75cbb4c1 100644
--- a/conformance/reports/v1.2.1/nginx-nginx-gateway-fabric/README.md
+++ b/conformance/reports/v1.2.1/nginx-nginx-gateway-fabric/README.md
@@ -4,7 +4,7 @@
 
 | API channel  | Implementation version                                                      | Mode    | Report                                           |
 |--------------|-----------------------------------------------------------------------------|---------|--------------------------------------------------|
-| experimental | [v1.6.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.6.0) | default | [link](./experimental-1.6.0-default-report.yaml) |
+| experimental | [v1.6.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.6.0) | default | [v1.6.0 report](./experimental-1.6.0-default-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/reports/v1.2.1/traefik-traefik/README.md b/conformance/reports/v1.2.1/traefik-traefik/README.md
index 5489bd4f..4c750448 100644
--- a/conformance/reports/v1.2.1/traefik-traefik/README.md
+++ b/conformance/reports/v1.2.1/traefik-traefik/README.md
@@ -4,7 +4,7 @@
 
 | API channel  | Implementation version                                           | Mode    | Report                                            |
 |--------------|------------------------------------------------------------------|---------|---------------------------------------------------|
-| experimental | [v3.2.2](https://github.com/traefik/traefik/releases/tag/v3.2.2) | default | [link](./experimental-v3.2.2-default-report.yaml) |
+| experimental | [v3.2.2](https://github.com/traefik/traefik/releases/tag/v3.2.2) | default | [v3.2.2 report](./experimental-v3.2.2-default-report.yaml) |
 
 ## Reproduce
 
diff --git a/conformance/utils/kubernetes/certificate.go b/conformance/utils/kubernetes/certificate.go
index f7b3b5b9..a0f70ddd 100644
--- a/conformance/utils/kubernetes/certificate.go
+++ b/conformance/utils/kubernetes/certificate.go
@@ -65,7 +65,7 @@ func MustCreateSelfSignedCertSecret(t *testing.T, namespace, secretName string,
 	return newSecret
 }
 
-// generateRSACert generates a basic self signed certificate valid for a year
+// generateRSACert generates a basic self-signed certificate valid for a year
 func generateRSACert(hosts []string, keyOut, certOut io.Writer) error {
 	priv, err := rsa.GenerateKey(rand.Reader, rsaBits)
 	if err != nil {
diff --git a/conformance/utils/kubernetes/helpers.go b/conformance/utils/kubernetes/helpers.go
index 9134a2c4..2b43828c 100644
--- a/conformance/utils/kubernetes/helpers.go
+++ b/conformance/utils/kubernetes/helpers.go
@@ -204,6 +204,7 @@ func NamespacesMustBeReady(t *testing.T, c client.Client, timeoutConfig config.T
 			err := c.List(ctx, gwList, client.InNamespace(ns))
 			if err != nil {
 				tlog.Errorf(t, "Error listing Gateways: %v", err)
+				return false, nil
 			}
 			for _, gw := range gwList.Items {
 				if val, ok := gw.Annotations[GatewayExcludedFromReadinessChecks]; ok && val == "true" {
@@ -233,6 +234,7 @@ func NamespacesMustBeReady(t *testing.T, c client.Client, timeoutConfig config.T
 			err = c.List(ctx, podList, client.InNamespace(ns))
 			if err != nil {
 				tlog.Errorf(t, "Error listing Pods: %v", err)
+				return false, nil
 			}
 			for _, pod := range podList.Items {
 				if !findPodConditionInList(t, pod.Status.Conditions, "Ready", "True") &&
diff --git a/geps/gep-1016/index.md b/geps/gep-1016/index.md
index afd96ef5..e232d2aa 100644
--- a/geps/gep-1016/index.md
+++ b/geps/gep-1016/index.md
@@ -7,7 +7,7 @@
 > our GEP overview as it existed before those rules did, and so it has been
 > explicitly grandfathered in.
 
-[expprob]:https://gateway-api.sigs.k8s.io/geps/overview/#probationary-period
+[expprob]:../overview.md#probationary-period
 
 ## Goal
 
@@ -50,7 +50,7 @@ lower layer protocol already exists. We propose the following criteria for such
 an addition.
 
 - Users of the encapsulated protocol would miss out on significant conventional features from their ecosystem if forced to route at a lower layer.
-- Users of the enapsulated protocol would experience a degraded user experience if forced to route at a lower layer.
+- Users of the encapsulated protocol would experience a degraded user experience if forced to route at a lower layer.
 - The encapsulated protocol has a significant user base, particularly in the Kubernetes community.
 
 gRPC meets _all_ of these criteria and is therefore, we contend, a strong
@@ -424,7 +424,7 @@ type GRPCRouteRule struct {
 	// BackendRefs defines the backend(s) where matching requests should be
 	// sent.
 
-	// If unspecified or invalid (refers to a non-existent resource or a Service
+	// If unspecified or invalid (refers to a nonexistent resource or a Service
 	// with no endpoints), the rule performs no forwarding. If there are also no
 	// filters specified that would result in a response being sent, a gRPC `UNAVAILABLE`
 	// status is returned. `UNAVAILABLE` responses must be sent so that the overall
diff --git a/geps/gep-1282/index.md b/geps/gep-1282/index.md
index c8a54f74..f85c3330 100644
--- a/geps/gep-1282/index.md
+++ b/geps/gep-1282/index.md
@@ -52,8 +52,8 @@ We've got the following feature requests and discussions in the Gateway API repo
 - [#1244](https://github.com/kubernetes-sigs/gateway-api/discussions/1244) : Unclear how to specify upstream (webserver) HTTP protocol. This issue describes the problems that Evan had in trying to be able to define if a backend behind a HTTPRoute supports HTTP2 over cleartext or websockets. The question of how to tell the Gateway implementation that the backend needs TLS details for a proxy-based implementation to be able to connect it also came up in the discussion.
 - [#1285](https://github.com/kubernetes-sigs/gateway-api/discussions/1285) has a more specific discussion about how different ingress implementations allow this to be configured today, whether that's with the Ingress resource or their own custom one. The great roundup that Candace did is reproduced in the next few bullet points.
   * Istio uses a [DestinationRule resource with ClientTLSSettings](https://istio.io/latest/docs/reference/config/networking/destination-rule/#ClientTLSSettings) to capture TLS details, and the DestinationRule resource also holds traffic policy information like load balancing algorithm, connection pool size, and so on.
-  * Openshift’s Route resource allows the [configuration of reencryption](https://docs.openshift.com/container-platform/4.10/networking/routes/secured-routes.html#nw-ingress-creating-a-reencrypt-route-with-a-custom-certificate_secured-routes) specifically, along with custom certificate details.
-  * Contour’s HTTPProxy captures TLS details using an Envoy client certificate, destination CA certificate, and optional SubjectName which sets what Envoy should expect to see from the backend service, all inside the HTTPProxy resource. It also requires either a Protocol field inside the HTTProxy, or an annotation on the Service that tells Contour that the service expects TLS. This is [all documented](https://projectcontour.io/docs/v1.21.1/config/upstream-tls/), but I should note that Contour’s docs use the Envoy convention where a backend in Gateway parlance is called an Upstream (which may be confusing if you’re not used to it).
+  * OpenShift’s Route resource allows the [configuration of reencryption](https://docs.openshift.com/container-platform/4.10/networking/routes/secured-routes.html#nw-ingress-creating-a-reencrypt-route-with-a-custom-certificate_secured-routes) specifically, along with custom certificate details.
+  * Contour’s HTTPProxy captures TLS details using an Envoy client certificate, destination CA certificate, and optional SubjectName which sets what Envoy should expect to see from the backend service, all inside the HTTPProxy resource. It also requires either a Protocol field inside the HTTPProxy, or an annotation on the Service that tells Contour that the service expects TLS. This is [all documented](https://projectcontour.io/docs/v1.21.1/config/upstream-tls/), but I should note that Contour’s docs use the Envoy convention where a backend in Gateway parlance is called an Upstream (which may be confusing if you’re not used to it).
   * Linkerd uses a [Server resource](https://linkerd.io/2.11/reference/authorization-policy/#server) (which is functionally pretty similar to Service in that it associates a name with a Pod selector, but also has other details like if the service supports Proxy protocol), along with a ServerAuthorization resource that specifies some constructs that sit more at the service mesh level, including identity and access control.
 
 In terms of other implementations existing use cases for features like this:
diff --git a/geps/gep-1294/index.md b/geps/gep-1294/index.md
index 206f891e..5fb1c0a3 100644
--- a/geps/gep-1294/index.md
+++ b/geps/gep-1294/index.md
@@ -11,7 +11,7 @@ This GEP is intended to establish an implementable, but experimental, baseline f
 
 ## Personas
 
-This GEP uses the [roles and personas](https://gateway-api.sigs.k8s.io/concepts/security-model/#roles-and-personas) defined in the Gateway API security model, and the service "producer" and "consumer" roles defined in [GEP-1324: Service Mesh in Gateway API](https://gateway-api.sigs.k8s.io/geps/gep-1324/#producer-and-consumer).
+This GEP uses the [roles and personas](../../concepts/security-model.md#roles-and-personas) defined in the Gateway API security model, and the service "producer" and "consumer" roles defined in [GEP-1324: Service Mesh in Gateway API](../gep-1324/index.md#producer-and-consumer).
 
 ## Goals
 
@@ -27,7 +27,7 @@ This GEP uses the [roles and personas](https://gateway-api.sigs.k8s.io/concepts/
     * Redirecting calls from arbitrary custom domains to an in-cluster service.
 * Defining how multiple `Services` or `EndpointSlices` representing instances of a single "logical" service should present an identity for AuthN/AuthZ or be associated with each other beyond routing rules.
 * Defining how AuthZ should be implemented to secure East/West traffic between services.
-* Defining how [Policy Attachment](https://gateway-api.sigs.k8s.io/reference/policy-attachment/) would bind to `xRoute`, services or a mesh.
+* Defining how [Policy Attachment](../../reference/policy-attachment.md) would bind to `xRoute`, services or a mesh.
 * Defining how `Routes` configured for East/West service mesh traffic management might integrate with North/South `Gateways`.
     * This is a bit tricky in that it's effectively a form of delegation as described in [GEP-1058: Route Inclusion and Delegation](https://github.com/kubernetes-sigs/gateway-api/pull/1085), and is planned to be explored in a future GEP.
 * Handling East/West traffic outside the cluster (VMs, etc).
@@ -43,7 +43,7 @@ This GEP uses the [roles and personas](https://gateway-api.sigs.k8s.io/concepts/
 
 It is proposed that an application owner should configure traffic rules for a mesh service by configuring an `xRoute` with a Kubernetes `Service` resource as a `parentRef`.
 
-This approach is dependent on both the "frontend" role of the Kubernetes `Service` resource as defined in [GEP-1324: Service Mesh in Gateway API](https://gateway-api.sigs.k8s.io/geps/gep-1324/#service) when used as a `parentRef` and the "backend" role of `Service` when used as a `backendRef`. The conformant implementation would use the Kubernetes `Service` name to match traffic for meshes, but the `backendRef` endpoints would ultimately be used for the canonical IP address(es) to which traffic should be redirected by rules defined in this `xRoute`. This approach leverages the existing points of extensibility within the Gateway API spec, and would not require introducing any API changes or new resources, only defining expected behavior.
+This approach is dependent on both the "frontend" role of the Kubernetes `Service` resource as defined in [GEP-1324: Service Mesh in Gateway API](../gep-1324/index.md#service) when used as a `parentRef` and the "backend" role of `Service` when used as a `backendRef`. The conformant implementation would use the Kubernetes `Service` name to match traffic for meshes, but the `backendRef` endpoints would ultimately be used for the canonical IP address(es) to which traffic should be redirected by rules defined in this `xRoute`. This approach leverages the existing points of extensibility within the Gateway API spec, and would not require introducing any API changes or new resources, only defining expected behavior.
 
 ### Why Service?
 
@@ -106,7 +106,7 @@ Currently (v0.7.0), this spec only considers the `Service` resource to be under
 
 #### Extended Conformance
 
-In addition to Service, there are other optional parentRef resources that, if used by implementations, MUST adhere to the spec’s prescriptions. At the time of writing (v0.7.0), there is one resource in extended conformance: `ServiceImport` (part of the [MCS API](https://github.com/kubernetes-sigs/mcs-api), currently in alpha). The semantics of `ServiceImport` `parentRef` binding can be found in [GEP-1748](https://gateway-api.sigs.k8s.io/geps/gep-1748/) (Note: Headless `ServiceImport` is out of scope and not currently a part of the spec).
+In addition to Service, there are other optional parentRef resources that, if used by implementations, MUST adhere to the spec’s prescriptions. At the time of writing (v0.7.0), there is one resource in extended conformance: `ServiceImport` (part of the [MCS API](https://github.com/kubernetes-sigs/mcs-api), currently in alpha). The semantics of `ServiceImport` `parentRef` binding can be found in [GEP-1748](../gep-1748/index.md) (Note: Headless `ServiceImport` is out of scope and not currently a part of the spec).
 
 ##### Why not `IPAddress`
 
@@ -183,7 +183,7 @@ If `port` is not set, the implementation MUST associate the route with all ports
 
 GAMMA implementations SHOULD NOT infer any functionality from the `hostnames` field on `xRoute`s (currently, `TLSRoute`, `HTTPRoute`, and `GRPCRoute` have this field) due to current under-specification and reserved potential for future usage or API changes.
 
-For the use case of filtering incoming traffic from selected HTTP hostnames, it is recommended to guide users toward configuring [`HTTPHeaderMatch`](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1beta1.HTTPHeaderMatch) rules for the [`Host`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Host) header. Functionality to be explored in future GEPs may include supporting concurrent usage of an `xRoute` traffic configuration for multiple North/South `Gateways` and East/West mesh use cases or redirection of egress traffic to an in-cluster `Service`.
+For the use case of filtering incoming traffic from selected HTTP hostnames, it is recommended to guide users toward configuring [`HTTPHeaderMatch`](../../reference/spec.md#gateway.networking.k8s.io%2fv1beta1.HTTPHeaderMatch) rules for the [`Host`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Host) header. Functionality to be explored in future GEPs may include supporting concurrent usage of an `xRoute` traffic configuration for multiple North/South `Gateways` and East/West mesh use cases or redirection of egress traffic to an in-cluster `Service`.
 
 ### Namespace boundaries
 
@@ -224,7 +224,7 @@ Note: a possible future extension is to allow `backendRefs` to explicitly target
 ### Drawbacks
 
 * The fact that this pattern is used for mesh configuration is implicit - this may benefit from some additional configuration to map the `HTTPRoute` to a particular mesh implementation rather than being picked up by any or all GAMMA meshes present in a cluster. Possible approaches include:
-* [GEP-1282: Describing Backend Properties](https://gateway-api.sigs.k8s.io/geps/gep-1282/) may be one path to associating a `Service` with a mesh, but likely wouldn't be able to handle the application of multiple `HTTPRoutes` for the same `Service`, but each intended for different mesh implementations
+* [GEP-1282: Describing Backend Properties](../gep-1282/index.md) may be one path to associating a `Service` with a mesh, but likely wouldn't be able to handle the application of multiple `HTTPRoutes` for the same `Service`, but each intended for different mesh implementations
     * It's currently unclear how relevant this constraint may be, but associating an `HTTPRoute` with a mesh by this method would additionally require an extra graph traversal step.
 * Expecting a `Mesh` `parentRef` or similar reference as proposed in [GEP-1291: Mesh Representation](https://docs.google.com/document/d/1oyA9uUH7pNNxxwy3WZGSWx-edHDBLrujcezr8q3el70/edit#) may be a preferred eventual path forward, but wouldn't be required initially, with the assumption that only one mesh should typically be present in a cluster.
 * No mechanism for egress redirection of traffic from arbitrary hostnames to a mesh service within this approach (but could still be implemented separately).
@@ -241,7 +241,7 @@ A controller could create a matching selector-less `Service` (i.e. no endpoints)
 
 Ownership/trust would remain based on naming pattern: `serviceName.namespace.svc.[USER_DOMAIN]`
 
-Separate `HttpService`, `TlsService` and `TcpService` resources could have the benefit of allowing us to define protocol specific elements to the spec along with an embedded `CommonServiceSpec`, similar to [`CommonRouteSpec`](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.CommonRouteSpec), and keep similar patterns as `Service`.
+Separate `HttpService`, `TlsService` and `TcpService` resources could have the benefit of allowing us to define protocol specific elements to the spec along with an embedded `CommonServiceSpec`, similar to [`CommonRouteSpec`](../../reference/spec.md#gateway.networking.k8s.io/v1.CommonRouteSpec), and keep similar patterns as `Service`.
 
 ##### Drawbacks
 
@@ -250,7 +250,7 @@ Separate `HttpService`, `TlsService` and `TcpService` resources could have the b
 
 #### Manage DNS by binding to an existing `Service`
 
-A new `ServiceBinding` resource would directly reference an existing `Service` to determine which traffic should be intercepted and redirected following configured service mesh routing rules and facilitate "transparent proxy" functionality. This resource could possibly share similar responsibilities as the need identified in [GEP-1282: Describing Backend Properties](https://gateway-api.sigs.k8s.io/geps/gep-1282/).
+A new `ServiceBinding` resource would directly reference an existing `Service` to determine which traffic should be intercepted and redirected following configured service mesh routing rules and facilitate "transparent proxy" functionality. This resource could possibly share similar responsibilities as the need identified in [GEP-1282: Describing Backend Properties](../gep-1282/index.md).
 
 ```
 kind: ServiceBinding
@@ -299,7 +299,7 @@ spec:
     name: cool-mesh
 ```
 
-It is currently undefined how this approach may interact with either explicitly configured [`hostnames`](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteSpec) or implicit "transparent proxy" routing for Kubernetes `Services` to determine how traffic should be intercepted and redirected.
+It is currently undefined how this approach may interact with either explicitly configured [`hostnames`](../../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteSpec) or implicit "transparent proxy" routing for Kubernetes `Services` to determine how traffic should be intercepted and redirected.
 
 This approach is not entirely abandoned, as it could supplement the proposed approach if explicit attachment to a specific mesh is deemed necessary. Additionally, this approach may offer a future option for attaching an `HTTPRoute` to a mesh, but not a specific service (e.g. to implement mesh-wide egress functionality for all requests to a specific hostname).
 
@@ -320,7 +320,7 @@ spec:
 
 * Would require separate `HTTPRoute` resources to explicitly define _different_ traffic routing rules for the same service on different meshes.
 
-#### Nested `services` and `hostnames` fields in [`ParentReference`](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.ParentReference)
+#### Nested `services` and `hostnames` fields in [`ParentReference`](../../reference/spec.md#gateway.networking.k8s.io/v1.ParentReference)
 
 In core conformance, the `services` would only be valid for `Mesh` types, and `hostnames` field only for `Gateway`. Mesh implementations could still use a `Host` header match if they wanted limit rules to specific hostnames.
 
@@ -360,7 +360,7 @@ This is done by configuring the `parentRef`, to point to the `istio` `Mesh`. Thi
 
 ### New field on `HTTPRoute` for `Service` binding
 
-A new field `serviceBinding` would be added to `HTTPRoute` to attach to the `Service`. Alternatively, this could be a new field in [`HTTPRouteMatch`](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteMatch). As with the proposed implementation, this approach could be combined with a `Mesh` resource or similar as the `parentRef`, which would just define that the route would be applied to a mesh.
+A new field `serviceBinding` would be added to `HTTPRoute` to attach to the `Service`. Alternatively, this could be a new field in [`HTTPRouteMatch`](../../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteMatch). As with the proposed implementation, this approach could be combined with a `Mesh` resource or similar as the `parentRef`, which would just define that the route would be applied to a mesh.
 
 ```
 spec:
@@ -420,7 +420,7 @@ This solution could work well for both non-`cluster.local` names but also for eg
 This approach is similar to the above `ServiceBinding` proposal with a couple of major differences:
 
 * `ServiceProjection` encapsulates both "frontend" and "backend" roles of the `Service` resource
-* `ServiceProjection` could handle the full responsibilities described in [GEP-1282: Describing Backend Properties](https://gateway-api.sigs.k8s.io/geps/gep-1282/)
+* `ServiceProjection` could handle the full responsibilities described in [GEP-1282: Describing Backend Properties](../gep-1282/index.md)
 
 ```
 kind: ServiceProjection
@@ -461,7 +461,7 @@ spec:
       weight: 10
 ```
 
-For convenience, `ServiceProjection` could have a `meshRef` field that, when set instead of `serviceRef`, makes all configuration within the `ServiceProjection` apply to all services in the mesh (the mesh control plane would need to read the `Mesh` resource). Pursuant to the changes to status semantics in [GEP-1364: Status and Conditions Update](https://gateway-api.sigs.k8s.io/geps/gep-1364/), it is necessary for the route to attach to something; in this case, the route attaches to the specific role or profile of the `ServiceProjection` and the mesh control plane should update the route status to reflect that.
+For convenience, `ServiceProjection` could have a `meshRef` field that, when set instead of `serviceRef`, makes all configuration within the `ServiceProjection` apply to all services in the mesh (the mesh control plane would need to read the `Mesh` resource). Pursuant to the changes to status semantics in [GEP-1364: Status and Conditions Update](../gep-1364/index.md), it is necessary for the route to attach to something; in this case, the route attaches to the specific role or profile of the `ServiceProjection` and the mesh control plane should update the route status to reflect that.
 
 #### Drawbacks
 
diff --git a/geps/gep-1323/index.md b/geps/gep-1323/index.md
index 04c3726c..09459f3f 100644
--- a/geps/gep-1323/index.md
+++ b/geps/gep-1323/index.md
@@ -7,7 +7,7 @@
 > our GEP overview as it existed before those rules did, and so it has been
 > explicitly grandfathered in.
 
-[expprob]:https://gateway-api.sigs.k8s.io/geps/overview/#probationary-period
+[expprob]:../overview.md#probationary-period
 
 ## TLDR
 Similar to how we have `RequestHeaderModifier` in `HTTPRouteFilter`, which lets users modify request headers before the request is forwarded to a backend (or a group of backends), it’d be helpful to have a `ResponseHeaderModifier` field which would let users modify response headers before they are returned to the client.
@@ -60,7 +60,7 @@ type HTTPHeaderModifier struct {
 
 Given the fact that this functionality is offered by only a few projects that currently implement Gateway API when using their own traffic routing CRDs, it’s better to support `ResponseHeaderModifier` as an _Extended_ feature, unlike `RequestHeaderModifier` which is a _Core_ feature. This will also not increase the difficulty of implementing Gateway API for any future ingress or service mesh.
 
-This feature can be further extended via [Policy Attachment](../reference/policy-attachment.md). The mechanism and use cases of this may be explored in a future GEP.
+This feature can be further extended via [Policy Attachment](../../reference/policy-attachment.md). The mechanism and use cases of this may be explored in a future GEP.
 
 ## Usage
 Adding support for this unlocks a lot of real world use cases. Let’s review a couple of them:
diff --git a/geps/gep-1324/index.md b/geps/gep-1324/index.md
index 923dea66..a80d6c86 100644
--- a/geps/gep-1324/index.md
+++ b/geps/gep-1324/index.md
@@ -7,7 +7,7 @@
 > of our GEP overview as it existed before those rules did, and so it has been
 > explicitly grandfathered in.
 
-[expprob]:https://gateway-api.sigs.k8s.io/geps/overview/#probationary-period
+[expprob]:../overview.md#probationary-period
 
 ## Overview
 
@@ -33,7 +33,7 @@ Gateway API represents the next generation of traffic routing APIs in Kubernetes
 
 ## Versioning
 
-Features or other modifications to the Gateway API spec that fall under this GEP will be subject to the same [versioning guidelines](https://gateway-api.sigs.k8s.io/concepts/versioning/#graduation-criteria) as the rest of the Gateway API. For example, to move changes concerning a beta feature (e.g. HTTPRoute) from experimental to standard, all of the [beta criteria](https://gateway-api.sigs.k8s.io/concepts/versioning/#experimental-standard) must be met (e.g. implemented by several implementations).
+Features or other modifications to the Gateway API spec that fall under this GEP will be subject to the same [versioning guidelines](../../concepts/versioning.md#graduation-criteria) as the rest of the Gateway API. For example, to move changes concerning a beta feature (e.g. HTTPRoute) from experimental to standard, all of the [beta criteria](../../concepts/versioning.md#experimental-standard) must be met (e.g. implemented by several implementations).
 
 ## Use-Cases
 
@@ -81,7 +81,7 @@ For the purposes of this feature, targeted service mesh functionality is limited
 
 ### **Policy**
 
-Policy is a broad term for any resource that can attach to another resource to configure it. This is defined in the [Policy Attachment GEP](https://gateway-api.sigs.k8s.io/geps/gep-713). Examples of (hypothetical) policies could be resources like `TimeoutPolicy` or `AuthorizationPolicy`.
+Policy is a broad term for any resource that can attach to another resource to configure it. This is defined in the [Policy Attachment GEP](../gep-713/index.md). Examples of (hypothetical) policies could be resources like `TimeoutPolicy` or `AuthorizationPolicy`.
 
 ### **Routes**
 
diff --git a/geps/gep-1364/index.md b/geps/gep-1364/index.md
index b33fee38..681193f2 100644
--- a/geps/gep-1364/index.md
+++ b/geps/gep-1364/index.md
@@ -42,7 +42,7 @@ these changes.
 
 The constants that mark the deprecated types will be also marked as deprecated,
 and will no longer be tested as part of conformance. They'll still be present,
-and will work, but they won't be part of the spec any more. This should give
+and will work, but they won't be part of the spec anymore. This should give
 implementations and users a release to transition to the new design (in UX terms).
 This grace period should be one release (so, the constants will be removed in
 v0.7.0.)
@@ -323,13 +323,13 @@ Note that some classes of inter-resource reference failure do _not_ cause a reso
 to become unattached and stop being accepted (that is, to have the `Accepted`
 condition set to `status: false`).
 
-* Non-existent Service backends - if the backend does not exist on a HTTPRoute that
+* Nonexistent Service backends - if the backend does not exist on a HTTPRoute that
 is otherwise okay, then the data plane must generate 500s for traffic that matches
 that HTTPRoute. In this case, the `Accepted` Condition must be true, and the
 `ResolvedRefs` Condition must be false, with reasons and messages indicating that
 the backend services do not exist.
 * HTTPRoutes with *all* backends in other namespaces, but not permitted by ReferenceGrants.
-In this case, the "non-existent service backends" rules apply, and 500s must be
+In this case, the "nonexistent service backends" rules apply, and 500s must be
 generated. In this case, again, the `Accepted` condition is true, and the
 `ResolvedRefs` Condition is false, with reasons and messages indicating that the
 backend services are not reachable.
@@ -359,21 +359,21 @@ Examples of Conditions:
 
 * HTTPRoute with one match with one backend that is valid. `Accepted` is true,
 `ResolvedRefs` is true.
-* HTTPRoute with one match with one backend that is a non-existent Service backend.
+* HTTPRoute with one match with one backend that is a nonexistent Service backend.
 The `Accepted` Condition is true, the `ResolvedRefs` condition is false, with
 a reason of `BackendNotFound`. `Accepted` is true in this case because the data
 path must respond to requests that would be sent to that backend with a 500 response.
-* HTTPRoute with one match with two backends, one of which is a non-existent Service
+* HTTPRoute with one match with two backends, one of which is a nonexistent Service
 backend. The `Accepted` Condition is true, the `ResolvedRefs` condition is false.
 `Accepted` is true in this case because the data path must respond to a percentage
-of the requests matching the rule corresponding to the weighting of the non-existent
+of the requests matching the rule corresponding to the weighting of the nonexistent
 backend (which would be fifty percent unless weights are applied).
 * HTTPRoute with one match with one backend that is in a different namespace, and
 does _not_ have a ReferenceGrant permitting that access. The `Accepted` condition
 is true, and the `ResolvedRefs` Condition is false, with a reason of `RefNotPermitted`.
 As before, `Accepted` is true because in this case, the data path must be
 programmed with 500s for the match.
-* TCPRoute with one match with a backend that is a non-existent Service. `Accepted`
+* TCPRoute with one match with a backend that is a nonexistent Service. `Accepted`
 is false, and `ResolvedRefs` is false. `Accepted` is false in this case because
 there is not enough information to program any rules to handle the traffic in the
 underlying data plane - TCP doesn't have a way to say "this is a valid destination
@@ -418,7 +418,7 @@ For many implementations (certainly for Envoy-based ones), getting this informat
 correctly and avoiding races on applying it is surprisingly difficult. 
 
 For this reason, this GEP proposes that we exclude the `Ready` condition from Core
-conformance, and make it a feature that implementations may opt in to - making it
+conformance, and make it a feature that implementations may opt into - making it
 an Extended condition.
 
 It will have the following behavior:
@@ -456,4 +456,4 @@ needs updating.)
 [1362]: https://github.com/kubernetes-sigs/gateway-api/issues/1362
 
 [typstatus]: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
-[httpreqredirect]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1beta1.HTTPRequestRedirectFilter
\ No newline at end of file
+[httpreqredirect]: ../../reference/spec.md#gateway.networking.k8s.io%2fv1beta1.HTTPRequestRedirectFilter
diff --git a/geps/gep-1494/index.md b/geps/gep-1494/index.md
index e7192b09..5d599105 100644
--- a/geps/gep-1494/index.md
+++ b/geps/gep-1494/index.md
@@ -3,7 +3,7 @@
 * Issue: [#1494](https://github.com/kubernetes-sigs/gateway-api/issues/1494)
 * Status: Provisional
 
-(See status definitions [here](/geps/overview/#gep-states).)
+(See [status definitions](../overview.md#gep-states).)
 
 
 ## TLDR
@@ -13,7 +13,7 @@ Provide a method for configuring **Gateway API implementations** to add HTTP Aut
 
 ## Goals
 
-(Using the [Gateway API Personas](https://gateway-api.sigs.k8s.io/concepts/roles-and-personas/))
+(Using the [Gateway API Personas](../../concepts/roles-and-personas.md))
 
 * A way for Ana the Application Developer to configure a Gateway API implementation to perform Authentication (at least), with optional Authorization.
 
@@ -21,7 +21,7 @@ Provide a method for configuring **Gateway API implementations** to add HTTP Aut
 
 ## Stretch Goals
 
-* Optionally, a way for Ana to have the ability to disable Authentication and/or Authorization for specific routes when needed, allowing certain routes to not be protected. This would probably need to work something like a default enabling at Gateway level, that can be specifically set at lower levels, but further design is TBD. This goal comes from the relatively-common desire for Chihiro to be able to set reasonably-secure defaults, and for Ana or others to be able to _disable_ for specific paths for purposes of healthchecking. The fact that this is relatively undefined is why this goal is _optional_.
+* Optionally, a way for Ana to have the ability to disable Authentication and/or Authorization for specific routes when needed, allowing certain routes to not be protected. This would probably need to work something like a default enabling at Gateway level, that can be specifically set at lower levels, but further design is TBD. This goal comes from the relatively-common desire for Chihiro to be able to set reasonably-secure defaults, and for Ana or others to be able to _disable_ for specific paths for purposes of health checks. The fact that this is relatively undefined is why this goal is _optional_.
 
 
 ## Non-Goals
@@ -70,7 +70,7 @@ In this case, the server also authenticates the client, based on the certificate
 
 TLS v1.3 is defined in [RFC-8446](https://datatracker.ietf.org/doc/html/rfc8446), with v1.2 defined in [RFC-5246](https://datatracker.ietf.org/doc/html/rfc5246). Earlier versions of TLS (v1.1 and v1.0) were deprecated in [RFC-8996](https://datatracker.ietf.org/doc/html/rfc8996) and should no longer be used.
 
-Gateway API already has some work in progress to handle this for straightforward use cases, in [GEP-91](https://gateway-api.sigs.k8s.io/geps/gep-91/).
+Gateway API already has some work in progress to handle this for straightforward use cases, in [GEP-91](../gep-91/index.md).
 
 #### JWT
 
@@ -89,7 +89,7 @@ JWT is defined in [RFC-75199](https://datatracker.ietf.org/doc/html/rfc7519).
 
 Oauth2 is an _authorization framework_, which allows clients and servers to define ways to perform authentication and authorization in as secure a way as possible. It extensively uses TLS for encryption, and involves a third-party handling the authorization handshake with a client, which the third-party then provides to the server.
 
-Open ID Conect (OIDC) is a protocol based on the OAuth 2 framework, that allows Users to talk to Identity Providers (IDPs), on behalf of a Relying Party (RP), and have the IDP give the user an Identity Token (which the User's browser can then provide as Authentication to the Relying Party), and also allows the RP to request Claims about the User, which can be used for Authorization.
+Open ID Connect (OIDC) is a protocol based on the OAuth 2 framework, that allows Users to talk to Identity Providers (IDPs), on behalf of a Relying Party (RP), and have the IDP give the user an Identity Token (which the User's browser can then provide as Authentication to the Relying Party), and also allows the RP to request Claims about the User, which can be used for Authorization.
 
 Usually, the Identity Token is delivered using JWT, although that is not required.
 
@@ -147,7 +147,7 @@ Every feature should:
 
 ### Conformance tests 
 
-Conformance tests file names should try to follow the the `pascal-case-name.go` format.
+Conformance tests file names should try to follow the `pascal-case-name.go` format.
 For example for `HTTPRoutePortRedirect` - the test file would be `httproute-port-redirect.go`.
 Treat this guidance as "best effort" because we might have test files that check the combination of several features and can't follow the same format.
 In any case, the conformance tests file names should be meaningful and easy to understand.
diff --git a/geps/gep-1494/metadata.yaml b/geps/gep-1494/metadata.yaml
index b318f0cb..14161d8c 100644
--- a/geps/gep-1494/metadata.yaml
+++ b/geps/gep-1494/metadata.yaml
@@ -4,12 +4,12 @@ number: 1494
 name: HTTP Auth in Gateway API
 status: Provisional
 # Any authors who contribute to the GEP in any way should be listed here using
-# their Github handle.
+# their GitHub handle.
 authors:
   - youngnick
   - jgao1025
 # references is a list of hyperlinks to relevant external references.
-# It's intended to be used for storing Github discussions, Google docs, etc.
+# It's intended to be used for storing GitHub discussions, Google docs, etc.
 references: {}
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
diff --git a/geps/gep-1619/index.md b/geps/gep-1619/index.md
index 389d0a72..04451eb9 100644
--- a/geps/gep-1619/index.md
+++ b/geps/gep-1619/index.md
@@ -3,7 +3,7 @@
 * Issue: [#1619](https://github.com/kubernetes-sigs/gateway-api/issues/1619)
 * Status: Experimental
 
-(See status definitions [here](/geps/overview/#gep-states).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## Graduation Criteria
 
@@ -428,9 +428,9 @@ We will present two distinct patterns for configuring session persistence:
 
 ### BackendLBPolicy API
 
-In order to apply session persistence configuration to a backend, we will implement it as a [Policy Attachment](/reference/policy-attachment/).
+In order to apply session persistence configuration to a backend, we will implement it as a [Policy Attachment](../../reference/policy-attachment.md).
 The new metaresource is named `BackendLBPolicy` and is responsible for configuring load balancing-related configuration
-for traffic intended for a backend after routing has occurred. It is defined as a [Direct Policy Attachment](/geps/gep-713/#direct-policy-attachment)
+for traffic intended for a backend after routing has occurred. It is defined as a [Direct Policy Attachment](../gep-713/index.md#direct-policy-attachment)
 without defaults or overrides, applied to the targeted backend.
 
 Instead of utilizing a specific, session persistence-only policy object, we introduce a more generic API object named
@@ -656,12 +656,12 @@ the spec. In other words, opting for a higher-level API provides better interope
 
 However, this API spec does allow specifying specific forms or types of session persistence through the `Type` field in
 the `SessionPersistence` struct, including options for cookie-based or header-based session persistence. This API field
-accommodates implementations that offer multiple methods of session persistence, while also allowing users to specify 
+accommodates implementations that offer multiple methods of session persistence, while also allowing users to specify
 their preferred form of session persistence if desired.
 
 ### Target Persona
 
-Referring to the [Gateway API Security Model](/concepts/security-model/#roles-and-personas),
+Referring to the [Gateway API Security Model](../../concepts/security-model.md#roles-and-personas),
 the target kubernetes role/persona for session persistence are application developers, as mentioned in the [When does an application require session persistence?](#when-does-an-application-require-session-persistence)
 section. It is the responsibility of the application developers to adjust the persistence configuration to ensure the
 functionality of their applications.
@@ -677,10 +677,10 @@ route in any given implementation.
 ### API Attachment Points
 
 The new `BackendLBPolicy` metaresource only supports attaching to a backend. A backend can be a Service,
-ServiceImport (see [GEP-1748](/geps/gep-1748)), or any implementation-specific backends that are a valid
-[`BackendObjectReference`](/reference/spec/#gateway.networking.k8s.io%2fv1.BackendObjectReference). Enabling session
+ServiceImport (see [GEP-1748](../gep-1748/index.md)), or any implementation-specific backends that are a valid
+[`BackendObjectReference`](../../reference/spec.md#gateway.networking.k8s.io%2fv1.BackendObjectReference). Enabling session
 persistence for a backend enables subsequently enables it for any route directing traffic to this backend. To learn more
-about the process of attaching a policy to a backend, please refer to [GEP-713](/geps/gep-713).
+about the process of attaching a policy to a backend, please refer to [GEP-713](../gep-713/index.md).
 
 On the other hand, configuring the `sessionPersistence` field in the route rule enables session persistence exclusively
 for the traffic directed to the `backendRefs` in this route rule. This means applying session persistence configuration
@@ -689,8 +689,8 @@ route rule section rather than the route entirely, allows users to configure ses
 fashion. This approach avoids the need to decompose routes if the configuration is specific to a route path.
 
 Session persistence configuration specified in a route rule SHALL override equivalent configuration in `BackendLBPolicy`.
-In this situation, implementations MAY want to indicate a warning via a log or status. Refer to [GEP-713](/geps/gep-713)
-and/or [GEP-2648](/geps/gep-2648) for more specific details on how to handle override scenarios.
+In this situation, implementations MAY want to indicate a warning via a log or status. Refer to [GEP-713](../gep-713/index.md)
+and/or [GEP-2648](../gep-2648/index.md) for more specific details on how to handle override scenarios.
 
 Edge cases will arise when implementing session persistence support for both backends and route rules through
 `BackendLBPolicy` and the route rule's `sessionPersistence` field. For guidance on addressing conflicting
@@ -811,9 +811,9 @@ might not function as expected. In such cases, it's acceptable to make appropria
 
 ### Session Persistence API with GAMMA
 
-The object of the [GAMMA (Gateway API for Mesh Management and Administration)](/mesh/gamma)
+The object of the [GAMMA (Gateway API for Mesh Management and Administration)](../../mesh/gamma.md)
 initiative is to provide support for service mesh and mesh-adjacent use-cases with Gateway API. GAMMA is focused on
-defining how Gateway API could also be used for inter-service or [east/west](/concepts/glossary/#eastwest-traffic)
+defining how Gateway API could also be used for inter-service or [east/west](../../concepts/glossary.md#eastwest-traffic)
 traffic within the same cluster.
 
 Given that service meshes commonly have session persistence requirements, this API design should take into consideration
@@ -978,7 +978,7 @@ spec:
 
 This is an invalid configuration as two separate sessions cannot have the same cookie name. Implementations SHOULD
 address this scenario in manner they deem appropriate. Implementations MAY choose to reject the configuration, or they
-MAY non-deterministicly allow one cookie to work (e.g. whichever cookie is configured first).
+MAY non-deterministically allow one cookie to work (e.g. whichever cookie is configured first).
 
 #### Traffic Splitting with route rule inline sessionPersistence field
 
@@ -1069,7 +1069,7 @@ TODO
 ### Open Questions
 
 - What happens when session persistence causes traffic splitting scenarios to overload a backend?
-- Should we add status somewhere when a user gets in to a "risky" configuration with session persistence?
+- Should we add status somewhere when a user gets into a "risky" configuration with session persistence?
 - Should there be an API configuration field that specifies how already established sessions are handled?
 - How do implementations drain established sessions during backend upgrades without disruption?
     - Do we need a "session draining timeout" as documented by [A55: xDS-Based Stateful Session Affinity for Proxyless gRPC](https://github.com/grpc/proposal/blob/master/A55-xds-stateful-session-affinity.md#background)
@@ -1090,7 +1090,7 @@ predicable way.
 - We need to clean up the [Implementations](#implementations) table to make it more organized and readable.
 - We need to revisit how to indicate to a user that a `BackendLBPolicy` configuration is being overridden by a route
 configuration via a warning status or log.
-    - This might require addressing as part of an update to [GEP-2648](/geps/gep-2648).
+    - This might require addressing as part of an update to [GEP-2648](../gep-2648/index.md).
 
 ## Alternatives
 
@@ -1227,8 +1227,8 @@ Though session persistence is a ubiquitous name, session affinity is more incons
 - [LBPolicy](https://static.sched.com/hosted_files/kccnceu2023/c4/Autoscaling%20Elastic%20Kubernetes%20Infrastructure%20for%20Stateful%20Applications%20using%20Proxyless%20gRPC%20and%20Istio.pdf#page=25) (proposed extension for session persistence API)
 - [gRPC Stateful Session Affinity Proposal](https://github.com/grpc/proposal/blob/master/A55-xds-stateful-session-affinity.md) (info on session draining and session persistence in gRPC)
 - [Kube-Proxy Session Affinity](https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity)
-- [GEP-713: Metaresources and PolicyAttachment](/geps/gep-713/)
+- [GEP-713: Metaresources and PolicyAttachment](../gep-713/index.md)
 - [RFC6265](https://www.rfc-editor.org/rfc/rfc6265)
-- [Policy Attachment](/reference/policy-attachment)
+- [Policy Attachment](../../reference/policy-attachment.md)
 - [Envoy Session Persistence Design Doc](https://docs.google.com/document/d/1IU4b76AgOXijNa4sew1gfBfSiOMbZNiEt5Dhis8QpYg/edit#heading=h.sobqsca7i45e)
 - [Envoy Session Persistence Issue](https://github.com/envoyproxy/envoy/issues/16698)
diff --git a/geps/gep-1651/index.md b/geps/gep-1651/index.md
index 10822e70..967c65d5 100644
--- a/geps/gep-1651/index.md
+++ b/geps/gep-1651/index.md
@@ -3,7 +3,7 @@
 * Issue: [#1651](https://github.com/kubernetes-sigs/gateway-api/issues/1651)
 * Status: Provisional
 
-(See status definitions [here](overview.md#status).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -408,7 +408,7 @@ Let's say we want to enforce address types to just IP then our `gatewayClassName
 This may not be as flexible for end-users compared to configuring `routability` when creating
 a Gateway.
 
-As howardjohn mentioned [here](https://github.com/kubernetes-sigs/gateway-api/pull/1653#issuecomment-1429992160):
+As mentioned in [howardjohn's comment on GEP-1651: Gateway Routability](https://github.com/kubernetes-sigs/gateway-api/pull/1653#issuecomment-1429992160):
 > having the ability to configure things at a higher level seems nice for Gateway, but being able to configure them on a per-Gateway basis remains important.
 
 ## References
diff --git a/geps/gep-1686/index.md b/geps/gep-1686/index.md
index eacf2a72..e986ee61 100644
--- a/geps/gep-1686/index.md
+++ b/geps/gep-1686/index.md
@@ -15,21 +15,21 @@ This testing plan specifies a new set of tests to define a "Mesh" [conformance p
 
 ## Focus
 
-Currently the GAMMA spec consists of two Gateway API GEPs [defining terminology and goals of Gateway API for service meshes](https://gateway-api.sigs.k8s.io/geps/gep-1324/)
-and specifically [how route resources work in a service mesh context](https://gateway-api.sigs.k8s.io/geps/gep-1426/).
+Currently the GAMMA spec consists of two Gateway API GEPs [defining terminology and goals of Gateway API for service meshes](../gep-1324/index.md)
+and specifically [how route resources work in a service mesh context](/geps/gep-1426/).
 The goal of the initial conformance testing is to check the essential behavior as defined by GEP-1426, as it differs from the wider Gateway API spec. This GEP focuses on using a `Service` object as an `xRoute` `parentRef` to control how the GAMMA implementation directs traffic to the endpoints specified by the `Services` in `backendRefs` and how the traffic is filtered and modified.
 
 ## Conformance Profile
 
-GAMMA intends to introduce a "Mesh" [conformance profile](https://gateway-api.sigs.k8s.io/geps/gep-1709/) to isolate tests specific to East/West functionality from both existing tests focused on North/South functionality and common Gateway API functionality shared by N/S and E/W implementations. A conformance profile is a set of tests that implementations can run to check their conformance to some subset of the Gateway API spec.
+GAMMA intends to introduce a "Mesh" [conformance profile](../gep-1709/index.md) to isolate tests specific to East/West functionality from both existing tests focused on North/South functionality and common Gateway API functionality shared by N/S and E/W implementations. A conformance profile is a set of tests that implementations can run to check their conformance to some subset of the Gateway API spec.
 
-This appropach will enable service meshes to certify that an implementation follows the GAMMA spec without requiring a North/South implementation, and importantly avoid any expectation that North/South Gateway API implementations expand their scope to understand GAMMA and E/W traffic flows.
+This approach will enable service meshes to certify that an implementation follows the GAMMA spec without requiring a North/South implementation, and importantly avoid any expectation that North/South Gateway API implementations expand their scope to understand GAMMA and E/W traffic flows.
 
-Leveraging existing tests for common functionality between N/S and E/W implementations will both ensure consistency across Gateway API implementations and help limit the maintence burden for the conformance testing suite.
+Leveraging existing tests for common functionality between N/S and E/W implementations will both ensure consistency across Gateway API implementations and help limit the maintenance burden for the conformance testing suite.
 
 ### Support Levels
 
-Using a conformance profile will enable granular conformance definitions for GAMMA, splitting functionality along the existing Gateway API [support levels](https://gateway-api.sigs.k8s.io/concepts/conformance/?h=conformance+levels#2-support-levels), with required functionality as Core, standardized but optional functionality as Extended, and Implementation-specific for things beyond the current or intended scope of GAMMA configuration. It is expected that some capabilities will begin as Implementation-specific and eventually migrate to Extended or Core conformance as GAMMA matures.
+Using a conformance profile will enable granular conformance definitions for GAMMA, splitting functionality along the existing Gateway API [support levels](../../concepts/conformance.md?h=conformance+levels#2-support-levels), with required functionality as Core, standardized but optional functionality as Extended, and Implementation-specific for things beyond the current or intended scope of GAMMA configuration. It is expected that some capabilities will begin as Implementation-specific and eventually migrate to Extended or Core conformance as GAMMA matures.
 
 ## Tests
 
@@ -80,7 +80,7 @@ producer).
   - Assert that traffic from a client in a different `Namespace` is routed by the
     `HTTPRoute`
 
-A consumer `HTTPRoute` is in the same `Namespace` as the the request sender (the
+A consumer `HTTPRoute` is in the same `Namespace` as the request sender (the
 consumer), a different `Namespace` as the `parentRef` `Service`.
 
 - Given a consumer `HTTPRoute`
diff --git a/geps/gep-1709/index.md b/geps/gep-1709/index.md
index 102a00b2..b4e29acc 100644
--- a/geps/gep-1709/index.md
+++ b/geps/gep-1709/index.md
@@ -358,7 +358,7 @@ profiles:
 
 > **WARNING**: It is an important clarification that this is NOT a full
 > Kubernetes API. It uses `TypeMeta` for some fields that made sense to re-use
-> and were familiar, but otherwise has it's own structure. It is not a [Custom
+> and were familiar, but otherwise has its own structure. It is not a [Custom
 > Resource Definition (CRD)][crd] nor will it be made available along with our
 > CRDs. It will be used only by conformance test tooling.
 
@@ -368,11 +368,11 @@ profiles:
 > theoretically have multiple projects and should submit separate reports for
 > each of them.
 
-> **NOTE**: The `contact` field indicates the Github usernames or team
+> **NOTE**: The `contact` field indicates the GitHub usernames or team
 > names of those who are responsible for maintaining this file, so they can be
 > easily contacted when needed (e.g. for relevant release announcements
 > regarding conformance, e.t.c.). Optionally, it can be an email address or
-> a support URL (e.g. Github new issue page).
+> a support URL (e.g. GitHub new issue page).
 
 The above report describes an implementation that just released `v1`, uses gateway
 API `v0.8.0` `experimental` channel, and has `HTTP` `core` and `extended` and `TCP`
@@ -601,7 +601,7 @@ Maintainers will provide [badges][bdg] to implementations at the end of the proc
 which link to the implementations page for that specific implementation and can
 be easily added via markdown to Git repositories.
 
-[impl]:https://gateway-api.sigs.k8s.io/implementations/
+[impl]:../../implementations.md
 [bdg]:https://shields.io
 
 ## Alternatives Considered
diff --git a/geps/gep-1713/index.md b/geps/gep-1713/index.md
index 2d3f91ab..f51f044d 100644
--- a/geps/gep-1713/index.md
+++ b/geps/gep-1713/index.md
@@ -1,9 +1,9 @@
 # GEP-1713: ListenerSets - Standard Mechanism to Merge Multiple Gateways
 
-* Issue: [#1713](/kubernetes-sigs/gateway-api/issues/1713)
-* Status: Provisional
+* Issue: [#1713](https://github.com/kubernetes-sigs/gateway-api/issues/1713)
+* Status: Experimental
 
-(See status definitions [here](overview.md#status).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## Introduction
 
@@ -11,14 +11,14 @@ The `Gateway` Resource is a point of contention since it is the only place to at
 
 ## Goals
 - Define a mechanism to merge listeners into a single `Gateway`
+- Attaching listeners to `Gateways` in different namespaces
+- Standardize merging multiple lists of Listeners together ([\#1863](https://github.com/kubernetes-sigs/gateway-api/pull/1863))
+- Increase the number of Gateway Listeners that are supported ([\#2869](https://github.com/kubernetes-sigs/gateway-api/issues/2869))
 
 ## Future Potential Goals (Beyond the GEP)
 
-From [Gateway Hiearchy Brainstorming](https://docs.google.com/document/d/1qj7Xog2t2fWRuzOeTsWkabUaVeOF7_2t_7appe8EXwA/edit#heading=h.w311n4l5qmwk):
+From [Gateway Hierarchy Brainstorming](https://docs.google.com/document/d/1qj7Xog2t2fWRuzOeTsWkabUaVeOF7_2t_7appe8EXwA/edit#heading=h.w311n4l5qmwk):
 
-- Attaching listeners to `Gateways` in different namespaces
-- Standardize merging multiple lists of Listeners together ([\#1863](https://github.com/kubernetes-sigs/gateway-api/pull/1863))
-- Increase the number of Gateway Listeners that are supported ([\#2869](https://github.com/kubernetes-sigs/gateway-api/issues/2869))
 - Provide a mechanism for third party components to generate listeners and attach them to a Gateway ([\#1863](https://github.com/kubernetes-sigs/gateway-api/pull/1863))
 - Delegate TLS certificate management to App Owners and/or different namespaces ([\#102](https://github.com/kubernetes-sigs/gateway-api/issues/102), [\#103](https://github.com/kubernetes-sigs/gateway-api/issues/103))
 - Delegate domains to different namespaces, but allow those namespace to define TLS and routing configuration within those namespaces with Gateway-like resources ([\#102](https://github.com/kubernetes-sigs/gateway-api/issues/102), [\#103](https://github.com/kubernetes-sigs/gateway-api/issues/103))
@@ -54,14 +54,12 @@ This proposal introduces a new `ListenerSet` resource that has the ability to at
 ```go
 type GatewaySpec struct {
 	...
-	// Note: this is a list to allow future potential features
-	AllowedListeners []*AllowedListeners `json:"allowedListeners"`
+	AllowedListeners *AllowedListeners `json:"allowedListeners"`
 	...
 }
 
 type AllowedListeners struct {
-	// TODO - discuss changing this to Same in the future
-	// +kubebuilder:default={from: None}
+	// +kubebuilder:default={from:Same}
 	Namespaces *ListenerNamespaces `json:"namespaces,omitempty"`
 }
 
@@ -71,12 +69,21 @@ type ListenerNamespaces struct {
 	// values are:
 	//
 	// * Same: Only ListenerSets in the same namespace may be attached to this Gateway.
+	// * Selector: ListenerSets in namespaces selected by the selector may be attached to this Gateway.:w
+	// * All: ListenerSets in all namespaces may be attached to this Gateway.
 	// * None: Only listeners defined in the Gateway's spec are allowed
 	//
 	// +optional
-	// +kubebuilder:default=Same
-	// +kubebuilder:validation:Enum=Same;None
+	// +kubebuilder:default=None
+	// +kubebuilder:validation:Enum=Same;None;Selector;All
 	From *FromNamespaces `json:"from,omitempty"`
+
+	// Selector must be specified when From is set to "Selector". In that case,
+	// only ListenerSets in Namespaces matching this Selector will be selected by this
+	// Gateway. This field is ignored for other values of "From".
+	//
+	// +optional
+	Selector *metav1.LabelSelector `json:"selector,omitempty"`
 }
 
 // ListenerSet defines a set of additional listeners to attach to an existing Gateway.
@@ -94,7 +101,7 @@ type ListenerSet struct {
 // ListenerSetSpec defines the desired state of a ListenerSet.
 type ListenerSetSpec struct {
 	// ParentRef references the Gateway that the listeners are attached to.
-	ParentRef ParentGatewayReference `json:"parentRef,omitempty"`
+	ParentRef ParentGatewayReference `json:"parentRef"`
 
 	// Listeners associated with this ListenerSet. Listeners define
 	// logical endpoints that are bound on this referenced parent Gateway's addresses.
@@ -119,9 +126,11 @@ type ListenerSetSpec struct {
 // network connections.
 type ListenerEntry struct {
 	// Name is the name of the Listener. This name MUST be unique within a
-	// Gateway.
+	// ListenerSet.
 	//
-	// Support: Core
+	// Name is not required to be unique across a Gateway and ListenerSets.
+	// Routes can attach to a Listener by having a ListenerSet as a parentRef
+	// and setting the SectionName
 	Name SectionName `json:"name"`
 
 	// Hostname specifies the virtual hostname to match for protocol types that
@@ -149,8 +158,6 @@ type ListenerEntry struct {
 	// as a suffix match. That means that a match for `*.example.com` would match
 	// both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
 	//
-	// Support: Core
-	//
 	// +optional
 	Hostname *Hostname `json:"hostname,omitempty"`
 
@@ -310,6 +317,10 @@ type ParentGatewayReference struct {
 
 	// Name is the name of the referent.
 	Name ObjectName `json:"name"`
+
+	// Namespace is the name of the referent.
+	// +optional
+	Name *ObjectName `json:"namespace"`
 }
 ```
 
@@ -527,14 +538,14 @@ Valid reasons for `Accepted` being `False` are:
 
 - `NotAllowed` - the `parentRef` doesn't allow attachment
 - `ParentNotAccepted` - the `parentRef` isn't accepted (eg. invalid address)
-- `UnsupportedValue` - a listener in the set is using an unsupported feature/value
+- `ListenersNotValid` - one or more listeners in the set are invalid (or using an unsupported feature)
 
 The `Programmed` condition MUST be set on every `ListenerSet` and have a similar meaning to the Gateway `Programmed` condition but only reflect the listeners in this `ListenerSet`.
 
-`Accepted` and `Programmed` conditions when surfacing details about listeners, MUST only summarize the `status.parents.listeners` conditions that are exclusive to the `ListenerSet`.
+`Accepted` and `Programmed` conditions when surfacing details about listeners, MUST only summarize the `status.listeners` conditions that are exclusive to the `ListenerSet`.
 An exception to this is when the parent `Gateway`'s `Accepted` or `Programmed` conditions transition to `False`
 
-`ListenerSets` MUST NOT have their parent `Gateway`'s' listeners in the associated `status.parents.listeners` conditions list.
+`ListenerSets` MUST NOT have their parent `Gateway`'s' listeners in the associated `status.listeners` conditions list.
 
 ### ListenerConditions within a ListenerSet
 
@@ -562,7 +573,7 @@ The main downside of this approach is that users still require `Gateway` write a
 
 ### New 'GatewayGroup' Resource
 
-This was proposed in the Gateway Hiearchy Brainstorming document (see references below). The idea is to introduce a central resource that will coalease Gateways together and offer forms of delegation.
+This was proposed in the Gateway Hierarchy Brainstorming document (see references below). The idea is to introduce a central resource that will coalesce Gateways together and offer forms of delegation.
 
 Issues with this is complexity with status propagation, cluster vs. namespace scoping etc. It also lacks a migration path for existing Gateways to help shard listeners.
 
@@ -579,7 +590,7 @@ For workloads like Knative we can have O(1000) Services on the cluster with uniq
 
 For workloads with many certificates one option would be to introduce a `tls` stanza somewhere in the Route types. These Routes would then attach to a single Gateway. Then application operators can provide their own certificates. This probably would require some ability to have a handshake agreement with the Gateway.
 
-Sorta related there was a Route Delegation GEP (https://github.com/kubernetes-sigs/gateway-api/issues/1058) that was abandoned
+Somewhat related, there was a Route Delegation GEP (https://github.com/kubernetes-sigs/gateway-api/issues/1058) that was abandoned
 
 ## References
 
diff --git a/geps/gep-1713/metadata.yaml b/geps/gep-1713/metadata.yaml
index 2adb1f46..3f8a4606 100644
--- a/geps/gep-1713/metadata.yaml
+++ b/geps/gep-1713/metadata.yaml
@@ -2,6 +2,6 @@ apiVersion: internal.gateway.networking.k8s.io/v1alpha1
 kind: GEPDetails
 number: 1713
 name: Gateway Merging - ListenerSet
-status: Provisional
+status: Experimental
 authors:
   - dprotaso
diff --git a/geps/gep-1731/index.md b/geps/gep-1731/index.md
index f7785e13..acd889e2 100644
--- a/geps/gep-1731/index.md
+++ b/geps/gep-1731/index.md
@@ -3,7 +3,7 @@
 * Issue: [#1731](https://github.com/kubernetes-sigs/gateway-api/issues/1731)
 * Status: Experimental
 
-(See status definitions [here](/geps/overview/#gep-states).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -14,7 +14,7 @@ To allow configuration of a Gateway to retry unsuccessful requests to backends b
 * To allow specification of [HTTP status codes](https://www.rfc-editor.org/rfc/rfc9110#name-overview-of-status-codes) for which a request should be retried.
 * To allow specification of the maximum number of times to retry a request.
 * To allow specification of the minimum backoff interval between retry attempts.
-* To define any interaction with configured HTTPRoute [timeouts](/geps/gep-1742/).
+* To define any interaction with configured HTTPRoute [timeouts](../gep-1742/index.md).
 * Retry configuration must be applicable to most known Gateway API implementations.
 
 ## Future Goals
@@ -272,7 +272,7 @@ type HTTPRouteRetry struct {
     // <gateway:experimental>
     Codes []HTTPRouteRetryStatusCode `json:"codes,omitempty"`
 
-    // Attempts specifies the maxmimum number of times an individual request
+    // Attempts specifies the maximum number of times an individual request
     // from the gateway to a backend should be retried.
     //
     // If the maximum number of retries has been attempted without a successful
@@ -354,7 +354,7 @@ type HTTPRouteRetry struct {
 // +kubebuilder:validation:Maximum:=999
 type HTTPRouteRetryStatusCode int
 
-// Duration is a string value representing a duration in time. The foramat is
+// Duration is a string value representing a duration in time. The format is
 // as specified in GEP-2257, a strict subset of the syntax parsed by Golang
 // time.ParseDuration.
 //
@@ -391,21 +391,21 @@ Basic support for configuring retries in HTTPRoute up to a specified maximum cou
 
 Retrying requests based on HTTP status codes will be gated under the following features:
 
-* `SupportHTTPRRouteRetryBackendTimeout`
+* `SupportHTTPRouteRetryBackendTimeout`
 
   * Will test that backend requests that exceed a BackendRequest timeout duration are retried if a `retry` stanza is configured.
 
-* `SupportHTTPRRouteRetryBackoff`
+* `SupportHTTPRouteRetryBackoff`
 
   * Backoff will only be tested that a retry does not start before the duration specified for conformance, not that the backoff duration is precise.
   * Not currently supportable by NGINX or HAProxy.
 
-* `SupportHTTPRRouteRetryCodes`
+* `SupportHTTPRouteRetryCodes`
 
   * Only 500, 502, 503 and 504 will be tested for conformance.
   * Traefik does not seem to support specifying error codes, and will only retry on backend timeouts.
 
-* `SupportHTTPRRouteRetryConnectionError`
+* `SupportHTTPRouteRetryConnectionError`
 
   * Will test that connections interrupted by a TCP failure, disconnect or reset are retried if a `retry` stanza is configured.
 
@@ -417,9 +417,9 @@ This may be a reasonable approach for configuring broad default retry policies,
 
 ### HTTPRoute filter
 
-Implementing a `requestRetryPolicy` [HTTPRouteFilter](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteFilter) type is likely a reasonable alternative implementation (with the downside of slightly deeping nesting and more complex structural configuration) that was not fully explored.
+Implementing a `requestRetryPolicy` [HTTPRouteFilter](../../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteFilter) type is likely a reasonable alternative implementation (with the downside of slightly deeping nesting and more complex structural configuration) that was not fully explored.
 
-Adding a new field to HTTPRouteRule instead is proposed for parity with the similar and intersecting configuration of [HTTPRouteTimeouts](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteTimeouts).
+Adding a new field to HTTPRouteRule instead is proposed for parity with the similar and intersecting configuration of [HTTPRouteTimeouts](../../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteTimeouts).
 
 ## Other considerations
 
@@ -433,7 +433,7 @@ Retrying on connection errors (disconnect, reset, timeout, TCP failure) is typic
 
 ### Should whether to retry on a backend timeout be configurable?
 
-On Kubernetes, retrying should _typically_ route a backend request to a different pod if the original destination has become unhealthy and therefore should generally be safe. Even if a [BackendLBPolicy](https://gateway-api.sigs.k8s.io/geps/gep-1619/) is configured, most dataplane implementations implement "soft" affinity rather than strict session routing. The warnings against this practice in NGINX and HAProxy documentation seem to reference risks with legacy deployment models using a small number of statically-defined servers. We could consider adding something like a `excludeRetryOnTimeout` boolean field (implementable by NGINX and HAProxy, not by Envoy) in the future if this behavior is desirable, while still retaining the retry-on-timeout behavior as a default.
+On Kubernetes, retrying should _typically_ route a backend request to a different pod if the original destination has become unhealthy and therefore should generally be safe. Even if a [BackendLBPolicy](../gep-1619/index.md) is configured, most dataplane implementations implement "soft" affinity rather than strict session routing. The warnings against this practice in NGINX and HAProxy documentation seem to reference risks with legacy deployment models using a small number of statically-defined servers. We could consider adding something like a `excludeRetryOnTimeout` boolean field (implementable by NGINX and HAProxy, not by Envoy) in the future if this behavior is desirable, while still retaining the retry-on-timeout behavior as a default.
 
 ## References
 
diff --git a/geps/gep-1731/metadata.yaml b/geps/gep-1731/metadata.yaml
index 2bb39802..c85ccbcb 100644
--- a/geps/gep-1731/metadata.yaml
+++ b/geps/gep-1731/metadata.yaml
@@ -4,7 +4,7 @@ number: 1731
 name: HTTPRoute Retries
 status: Experimental
 # Any authors who contribute to the GEP in any way should be listed here using
-# their Github handle.
+# their GitHub handle.
 authors:
   - mikemorris
 relationships:
@@ -13,7 +13,7 @@ relationships:
   # set back to this GEP, and MUST be moved to Declined.
   obsoletes: {}
   obsoletedBy: {}
-  # extends indicates that a GEP extends the linkned GEP, adding more detail
+  # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
   extends: {}
@@ -30,7 +30,7 @@ relationships:
       name: HTTPRoute Timeouts
       description: Covers some overlapping considerations around when requests should be retried.
 # references is a list of hyperlinks to relevant external references.
-# It's intended to be used for storing Github discussions, Google docs, etc.
+# It's intended to be used for storing GitHub discussions, Google docs, etc.
 references:
   - https://www.rfc-editor.org/rfc/rfc9110
   - https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml
diff --git a/geps/gep-1742/index.md b/geps/gep-1742/index.md
index 39ab142b..ad58405e 100644
--- a/geps/gep-1742/index.md
+++ b/geps/gep-1742/index.md
@@ -3,7 +3,7 @@
 * Issue: [#1742](https://github.com/kubernetes-sigs/gateway-api/issues/1742)
 * Status: Standard
 
-(See status definitions [here](overview.md#status).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -372,7 +372,7 @@ Both timeout fields are [GEP-2257 Duration] values. A zero-valued timeout
 ("0s") MUST be interpreted as disabling the timeout; a non-zero-valued timeout
 MUST be >= 1ms.
 
-[GEP-2257 Duration]:/geps/gep-2257/
+[GEP-2257 Duration]:../gep-2257/index.md
 
 ### GO
 
@@ -476,7 +476,7 @@ Timeouts could be configured using policy attachments or in objects other than `
 
 Instead of configuring timeouts directly on an API object, they could be configured using policy
 attachments. The advantage to this approach would be that timeout policies can be not only
-configured for an `HTTPRouteRule`, but can also be added/overriden at a more fine
+configured for an `HTTPRouteRule`, but can also be added/overridden at a more fine
 (e.g., `HTTPBackendRef`) or coarse (e.g. `HTTPRoute`) level of granularity.
 
 The downside, however, is complexity introduced for the most common use case, adding a simple
@@ -506,4 +506,4 @@ previous section, is likely a better way to handle timeout configuration above t
 
 ## References
 
-[GEP-2257]:/geps/gep-2257/
+[GEP-2257]:../gep-2257/index.md
diff --git a/geps/gep-1748/index.md b/geps/gep-1748/index.md
index 21b05866..fa1ec20b 100644
--- a/geps/gep-1748/index.md
+++ b/geps/gep-1748/index.md
@@ -12,7 +12,7 @@
     This GEP is also exempt from the [Probationary Period][expprob] rules as it
     predated them.
 
-[expprob]:https://gateway-api.sigs.k8s.io/geps/overview/#probationary-period
+[expprob]:../overview.md#probationary-period
 
 ## TLDR
 
diff --git a/geps/gep-1762/index.md b/geps/gep-1762/index.md
index 222dde90..e5f4ebf3 100644
--- a/geps/gep-1762/index.md
+++ b/geps/gep-1762/index.md
@@ -214,7 +214,7 @@ Note: there is [discussion](https://github.com/kubernetes-sigs/gateway-api/discu
 
 ## API
 
-This GEP extends the `infrastructure` API introduced in [GEP-1867](https://gateway-api.sigs.k8s.io/geps/gep-1867).
+This GEP extends the `infrastructure` API introduced in [GEP-1867](../gep-1867/index.md).
 
 ```go
 type GatewayInfrastructure struct {
diff --git a/geps/gep-1762/metadata.yaml b/geps/gep-1762/metadata.yaml
index c38ad6a1..2f5677ef 100644
--- a/geps/gep-1762/metadata.yaml
+++ b/geps/gep-1762/metadata.yaml
@@ -5,7 +5,7 @@ name: In Cluster Gateway Deployments
 status: Standard
 authors:
   - howardjohn
-  - frakbu
+  - frankbu
 relationships:
   extendedBy:
     - number: 1867
diff --git a/geps/gep-1767/index.md b/geps/gep-1767/index.md
index c88dcbe0..c2929549 100644
--- a/geps/gep-1767/index.md
+++ b/geps/gep-1767/index.md
@@ -287,7 +287,7 @@ type HTTPCORSFilter struct {
     // Valid values are any method defined by RFC9110, along with the special 
     // value `*`, which represents all HTTP methods are allowed.
     //
-    // Method names are case sensitive, so these values are also case-sensitive.
+    // Method names are case-sensitive, so these values are also case-sensitive.
     // (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)
     //
     // Multiple method names in the value of the `Access-Control-Allow-Methods` 
@@ -359,7 +359,7 @@ type HTTPCORSFilter struct {
     // AllowHeaders indicates which HTTP request headers are supported 
     // for accessing the requested resource.
     //
-    // Header names are not case sensitive.
+    // Header names are not case-sensitive.
     //
     // Multiple header names in the value of the `Access-Control-Allow-Headers` 
     // response header are separated by a comma (",").
@@ -443,7 +443,7 @@ type HTTPCORSFilter struct {
     // When an HTTP header name is specified using the `ExposeHeaders` field, this 
     // additional header will be exposed as part of the response to the client.
     //
-    // Header names are not case sensitive.
+    // Header names are not case-sensitive.
     //
     // Multiple header names in the value of the `Access-Control-Expose-Headers` 
     // response header are separated by a comma (",").
@@ -983,7 +983,7 @@ If a filter logically as a
 fn run_filter(req: HTTPRequest) -> FilterResponse;
 enum FilterResponse {
   Request(HTTPRequest),
-  Response(HTTPResonse)
+  Response(HTTPResponse)
 ```
 
 A `Timeouts` doesn't really meet that, but `CORS` does:
diff --git a/geps/gep-1867/index.md b/geps/gep-1867/index.md
index a44134c7..cf664362 100644
--- a/geps/gep-1867/index.md
+++ b/geps/gep-1867/index.md
@@ -36,7 +36,7 @@ This has been previously discussed in [this issue](https://github.com/kubernetes
 
 As a cluster scoped resource, `GatewayClass` does not meet this requirement.
 This restricts customization use cases to either a few pre-provisioned classes by the admin, or running in an environment where the "Infrastructure Provider" and "Cluster Operator" are the same roles.
-The distinction between these roles is explicitly called out on the [homepage](https://gateway-api.sigs.k8s.io/#what-is-the-gateway-api).
+The distinction between these roles is explicitly called out on the [homepage](../../index.md#what-is-the-gateway-api).
 
 ### Custom Resource
 
@@ -57,7 +57,7 @@ While there is value out of providing class-wide options as defaults, there is a
 
 Some parallels in existing APIs:
 
-[Policy Attachment](https://gateway-api.sigs.k8s.io/reference/policy-attachment) offers a hierarchy of defaults and overrides, allowing attachment to GatewayClass and Gateway.
+[Policy Attachment](../../reference/policy-attachment.md) offers a hierarchy of defaults and overrides, allowing attachment to GatewayClass and Gateway.
 This is similar to our needs here, but representing infrastructure configuration as a "Policy" is a bit problematic, and the existing mechanisms have no hierarchy.
 
 In core Kubernetes, Pods declare their requirements (for example, CPU requests) inline in the Pod resource; there is not a `ResourceClass` API that abstracts these further.
@@ -78,7 +78,7 @@ For example, if I wanted to represent a `version` field and change that to trigg
 In order to address the concerns above, I propose a standard `infrastructure` API is added to `Gateway`.
 
 The exact fields are out of scope for this GEP and will be handled by additional GEPs.
-One example GEP already depending on this is [GEP-1651](/geps/gep-1651).
+One example GEP already depending on this is [GEP-1651](../gep-1651/index.md).
 
 The fields as defined below are, at time of writing, the existing fields covered by this GEP. More fields may be added as needed.
 
diff --git a/geps/gep-1897/index.md b/geps/gep-1897/index.md
index 63e31027..9f2a9918 100644
--- a/geps/gep-1897/index.md
+++ b/geps/gep-1897/index.md
@@ -35,8 +35,8 @@ and CA certificates.
 These are worthy goals, but deserve a different GEP for proper attention.  This GEP is concerned entirely with the
 controlplane, i.e. the hop between gateway and backend.
 
-1. [TCPRoute](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.TCPRoute) and
-[GRPCRoute](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.GRPCRoute) use cases
+1. [TCPRoute](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.TCPRoute) and
+[GRPCRoute](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.GRPCRoute) use cases
 are not addressed here, because at this point in time these two route types are not graduated to beta.
 2. Mutual TLS (mTLS) use cases are intentionally out of scope for this GEP for two reasons.  First, the design of Gateway
 API is backend-attached and does not currently support mutual authentication, and also because this GEP does not
@@ -145,7 +145,7 @@ This GEP is the outcome of the TLS use case #4 in
 To allow the gateway client to know how to connect to the backend pod, when the backend pod has its own
 certificate, we implement a metaresource named `BackendTLSPolicy`, that was previously introduced with the name
 `TLSConnectionPolicy` as a hypothetical Direct Policy Attachment example in
-[GEP-713: Metaresources and PolicyAttachment](https://gateway-api.sigs.k8s.io/geps/gep-713/).
+[GEP-713: Metaresources and PolicyAttachment](../gep-713/index.md).
 Because naming is hard, a new name may be
 substituted without blocking acceptance of the content of the API change.
 
@@ -185,7 +185,7 @@ sharing to BackendTLSPolicy, even if they don't for other cross-namespace sharin
 
 One of the areas of concern for this API is that we need to indicate how and when the API implementations should use the
 backend destination certificate authority.  This solution proposes, as introduced in
-[GEP-713](https://gateway-api.sigs.k8s.io/geps/gep-713/), that the implementation
+[GEP-713](../gep-713/index.md), that the implementation
 should watch the connections to the specified TargetRefs (Services), and if a Service matches a BackendTLSPolicy, then
 assume the connection is TLS, and verify that the TargetRef’s certificate can be validated by the client (Gateway) using
 the provided certificates and hostname before the connection is made. On the question of how to signal
@@ -195,7 +195,7 @@ other signal that makes the failure sufficiently clear to the requester without
 based on established security requirements.
 
 All policy resources must include `TargetRefs` with the fields specified
-[here](https://github.com/kubernetes-sigs/gateway-api/blob/a33a934af9ec6997b34fd9b00d2ecd13d143e48b/apis/v1alpha2/policy_types.go#L24-L41).
+in [PolicyTargetReference](https://github.com/kubernetes-sigs/gateway-api/blob/a33a934af9ec6997b34fd9b00d2ecd13d143e48b/apis/v1alpha2/policy_types.go#L24-L41).
 In an upcoming [extension](https://github.com/kubernetes-sigs/gateway-api/issues/2147) to TargetRefs, policy resources
 _may_ also choose to include `SectionName` and/or `Port` in the target reference following the same mechanics as `ParentRef`.
 
@@ -216,9 +216,9 @@ specified as "").  The use and definition of system certificates is implementati
 these certificates are obtained from the underlying operating system. CACertificateRefs contains one or more
 references to Kubernetes objects that contain PEM-encoded TLS certificates, which are used to establish a TLS handshake
 between the gateway and backend pod. References to a resource in a different namespace are invalid.
-If ClientCertifcateRefs is unspecified, then WellKnownCACertificates must be set to "System" for a valid configuration.
+If ClientCertificateRefs is unspecified, then WellKnownCACertificates must be set to "System" for a valid configuration.
 If WellKnownCACertificates is unspecified, then CACertificateRefs must be specified with at least one entry for a valid configuration.
-If WellKnownCACertficates is set to "System" and there are no system trusted certificates or the implementation doesn't define system
+If WellKnownCACertificates is set to "System" and there are no system trusted certificates or the implementation doesn't define system
 trusted certificates, then the associated TLS connection must fail.
 
 The `Hostname` field is required and is to be used to configure the SNI the Gateway should use to connect to the backend.
@@ -342,7 +342,7 @@ Ref: [TLS Origination](https://www.getambassador.io/docs/emissary/latest/topics/
 ### NGINX implementation through CRDs (Comparable to Route or Policy of Gateway API) supports both TLS and mTLS
 
 * In the Upstream section of a VirtualServer or VirtualServerRoute (equivalent to HTTPRoute) there is a simple toggle to enable TLS.  This does not validate the certificate of the backend and implicitly trusts the backend in order to form the SSL tunnel.  This is not about validating the certificate but obfuscating the traffic with TLS/SSL.
-* A Policy attachment can be provided when certification validation is required that is called egressMTLS (egress from the proxy to the upstream).  This can be tuned to perform various certificate validation tests.  It was created as a Policy becuase it implies some type of AuthN/AuthZ due to the additional checks.  This was also compatible with Open Service Mesh and NGINX Service Mesh and removed the need for a sidecar at the ingress controller.
+* A Policy attachment can be provided when certification validation is required that is called egressMTLS (egress from the proxy to the upstream).  This can be tuned to perform various certificate validation tests.  It was created as a Policy because it implies some type of AuthN/AuthZ due to the additional checks.  This was also compatible with Open Service Mesh and NGINX Service Mesh and removed the need for a sidecar at the ingress controller.
 * A corresponding 'IngressMTLS' policy also exists for mTLS verification of client connections to the proxy.  The Policy object is used for anything that implies AuthN/AuthZ.
 
 Ref: [Upstream.TLS](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#upstreamtls)
@@ -403,11 +403,11 @@ the implementation would be required to fully implement the policy or mark the b
 
 [Gateway API TLS Use Cases](https://docs.google.com/document/d/17sctu2uMJtHmJTGtBi_awGB0YzoCLodtR6rUNmKMCs8/edit#heading=h.cxuq8vo8pcxm)
 
-[GEP-713: Metaresources and PolicyAttachment](https://gateway-api.sigs.k8s.io/geps/gep-713/)
+[GEP-713: Metaresources and PolicyAttachment](../gep-713/index.md)
 
-[Policy Attachment](https://gateway-api.sigs.k8s.io/reference/policy-attachment/#direct-policy-attachment)
+[Policy Attachment](../../reference/policy-attachment.md#direct-policy-attachment)
 
-[Gateway API TLS](https://gateway-api.sigs.k8s.io/guides/tls/)
+[Gateway API TLS](../../guides/tls.md)
 
 [SIG-NET Gateway API: TLS to the K8s.Service/Backend](https://docs.google.com/document/d/1RTYh2brg_vLX9o3pTcrWxtZSsf8Y5NQvIG52lpFcZlo)
 
diff --git a/geps/gep-1911/index.md b/geps/gep-1911/index.md
index ed252294..c26565ce 100644
--- a/geps/gep-1911/index.md
+++ b/geps/gep-1911/index.md
@@ -3,7 +3,7 @@
 * Issue: [#1911](https://github.com/kubernetes-sigs/gateway-api/issues/1911)
 * Status: Standard
 
-(See status definitions [here](overview.md#status).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -25,8 +25,8 @@ Not all implementations support automatic protocol selection. Even in some cases
 
 Since Kubernetes 1.20 the [`core/v1.Service`][k8s-service] and [`core/v1.EndpointSlice`][k8s-endpointslices] resource has a stable `appProtocol` field. It's purpose is to allow end-users to specify an application protocol (L7) for each service port.
 
-Originally the use of this field in the Gateway API was rejected in [GEP-1282](/geps/gep-1282#non-goals):
-> v1.Service’s appProtocol field is not fit for purpose, because it is defined as accepting values either from the IANA Service Name registry, or domain-prefixed values and we need more flexibility than that. 
+Originally the use of this field in the Gateway API was rejected in [GEP-1282](../gep-1282/index.md#non-goals):
+> v1.Service’s appProtocol field is not fit for purpose, because it is defined as accepting values either from the IANA Service Name registry, or domain-prefixed values and we need more flexibility than that.
 
 Since then a Kubernetes enhancement proposal was created [KEP-3726][kep-3726] to repurpose `appProtocol` to include a convention for protocols that are not IANA service names. This would involve prefixing protocol names with `kubernetes.io/*`.
 
@@ -48,7 +48,7 @@ At the moment there exists three defined constants:
 
 ### New Protocols & Reserved Prefix
 
-To add support for a new protocol it should first become a Kubernetes Standard Application Protocol by updating the [KEP-3726][kep-3726]. [KEP-3726][kep-3726] also states the `appProtocol` field accepts a domain-prefixed implementation specific value. Thus, if the suggested protocol is not suited to have a `kubernetes.io/*` prefix, then the Gateway API MAY support the new protocol using it's own prefix `gateway.networking.k8s.io/*`.  Please make a PR to this GEP.
+To add support for a new protocol it should first become a Kubernetes Standard Application Protocol by updating the [KEP-3726][kep-3726]. [KEP-3726][kep-3726] also states the `appProtocol` field accepts a domain-prefixed implementation specific value. Thus, if the suggested protocol is not suited to have a `kubernetes.io/*` prefix, then the Gateway API MAY support the new protocol using its own prefix `gateway.networking.k8s.io/*`.  Please make a PR to this GEP.
 
 For example we may want to add a sentinel `appProtocol` value that prevents Gateway implementations from discovering the protocol of the application. Instead they should just refer to the Service's `protocol` field. Such a constant was rejected upstream (https://github.com/kubernetes/enhancements/pull/4106) but as an example it could be defined in a future addition to this GEP as `gateway.networking.k8s.io/no-sniff`.
 
@@ -88,7 +88,7 @@ ServicePort Protocol | ServicePort AppProtocol | Route Type | Supported
 ServicePort Protocol | ServicePort AppProtocol | Route Type | Supported
 `TCP`  | `kubernetes.io/wss` | `HTTPRoute` | Conditional [1]
 
-1. Only if there is a corresponding `BackendTLSPolicy` - see [GEP-1897](/geps/gep-1897)
+1. Only if there is a corresponding `BackendTLSPolicy` - see [GEP-1897](../gep-1897/index.md)
 
 ## Open Questions
 
@@ -104,9 +104,9 @@ Should we upstream new constants for websocket over [HTTP/2](https://www.rfc-edi
 
 ## Alternatives
 
-### Single Meta-resource 
+### Single Meta-resource
 
-The first pass of this GEP proposed a new meta-resource [GEP-713](/geps/gep-713) called `BackendProtocol`.
+The first pass of this GEP proposed a new meta-resource [GEP-713](../gep-713/index.md) called `BackendProtocol`.
 
 This allows end-users to specify a list of ports and a list of corresponding protocols that that single
 port supports.
@@ -116,7 +116,7 @@ This was dropped in favour of supporting Kubernetes Standard Application Protoco
 ### Multiple Protocol Meta-resources
 
 Rather than bundle protocol details into a single resource an alternative would be to create distinct meta resources.
-ie. `HTTP2Backend`, `GPRCBackend`, `WebsocketBackend`.
+ie. `HTTP2Backend`, `GRPCBackend`, `WebsocketBackend`.
 
 The advantages of this approach are:
 
@@ -130,7 +130,7 @@ The disadvantages of this approach are:
 
 ### Adding Properties on Gateway Route Objects
 
-From [GEP-1282](/geps/gep-1282#tldr):
+From [GEP-1282](../gep-1282/index.md#tldr):
 > some types of configuration requested by users are more about defining functionality that describes capabilities of the backend more than the route you take to get to the backend.
 
 Backend protocol is specifying capabilities. This configuration is less about routing.
@@ -142,20 +142,20 @@ that operate at a higher 'application' level (eg. HTTP/GRPC etc.)
 
 ### Extending Kubernetes Service
 
-This is considered untenable due to the 'the turnaround time for those changes can be years.' ([ref-1282](/geps/gep-1282#non-goals))
+This is considered untenable due to the 'the turnaround time for those changes can be years.' ([ref-1282](../gep-1282/index.md#non-goals))
 
 ### Unstructured Data/Special Values
 
 Unstructured data refers to using labels and annotations.
 
-From [GEP-1282](/geps/gep-1282#non-goals):
+From [GEP-1282](../gep-1282/index.md#non-goals):
 > these are very sticky and hard to get rid of once you start using them.
 
 Special values refers to using special strings in existing Kubernetes Resources.
 For example Istio allows for protocol to be specified by prefixing the Kubernetes
 Service's port name with the protocol (ie. `http-`, `grpc-`). This approach is
-limiting as it doesn't allow for multiple protocols on the same port and future 
-configuration per protocol. One protocol per port may be relaxed in the future see 
+limiting as it doesn't allow for multiple protocols on the same port and future
+configuration per protocol. One protocol per port may be relaxed in the future see
 [KEP 1435][kep-1435]
 
 Additionally, annotations are not self-documenting unlike CRD fields which can display
@@ -165,9 +165,9 @@ documentation via `kubectl explain`
 
 - [GitHub Discussion](https://github.com/kubernetes-sigs/gateway-api/discussions/1244)
 - GEP-1282 - Describing Backend Properties
-    - [GEP](/geps/gep-1282)
+    - [GEP](../gep-1282/index.md)
     - [Issue](https://github.com/kubernetes-sigs/gateway-api/issues/1911)
-- [GEP-713 - Metaresources](/geps/gep-713)
+- [GEP-713 - Metaresources](../gep-713/index.md)
 - [Linkerd Protocol Detection](https://linkerd.io/2.12/features/protocol-detection/)
 - [Istio Protocol Selection](https://istio.io/latest/docs/ops/configuration/traffic-management/protocol-selection/)
 - Contour Protocol Selection
diff --git a/geps/gep-2162/index.md b/geps/gep-2162/index.md
index 43f5d052..38b2dbf6 100644
--- a/geps/gep-2162/index.md
+++ b/geps/gep-2162/index.md
@@ -123,7 +123,7 @@ Every feature should:
 
 #### Conformance test names
 
-Conformance tests file names should try to follow the the `pascal-case-name.go` format.
+Conformance tests file names should try to follow the `pascal-case-name.go` format.
 For example for `HTTPRoutePortRedirect` - the test file would be `httproute-port-redirect.go`.
 
 We should treat this guidance as "best effort" because we might have test files that check the combination of several features and can't follow the same format.
@@ -179,7 +179,7 @@ Once the GatewayClass features support are is published into the status we could
 
 ### Add Gateway API Version field to the GatewayClass Status
 
-We got some feedback that it will be useful to indicate what what Gateway API version the implementation supports. So when we have supported features published in the GatewayClass Status, users will also be able to understand that those are the supported features for a specific Gateway API version.
+We got some feedback that it will be useful to indicate which Gateway API version the implementation supports. So when we have supported features published in the GatewayClass Status, users will also be able to understand that those are the supported features for a specific Gateway API version.
 
 This work is likely to require its own small GEP but ideally what this field would mean is that an implementation supports Max(vX.X). 
 
@@ -187,4 +187,4 @@ The value of it is to provide a better user experience and also more foundation
 
 ### Add a table with feature name and description to document what each feature means
 
-Create a comprehensive table detailing feature names and their corresponding descriptions, providing a clear understanding of each feature's purpose and functionality.
\ No newline at end of file
+Create a comprehensive table detailing feature names and their corresponding descriptions, providing a clear understanding of each feature's purpose and functionality.
diff --git a/geps/gep-2257/index.md b/geps/gep-2257/index.md
index 78c528fe..24cabffa 100644
--- a/geps/gep-2257/index.md
+++ b/geps/gep-2257/index.md
@@ -9,7 +9,7 @@ As we extend the Gateway API to have more functionality, we need a standard
 way to represent duration values. The first instance is the [HTTPRoute
 Timeouts GEP][GEP-1742]; doubtless others will arise.
 
-[GEP-1742]:/geps/gep-1742
+[GEP-1742]:../gep-1742/index.md
 
 ## Gateway API Duration Format
 
diff --git a/geps/gep-2648/index.md b/geps/gep-2648/index.md
index 681cf15a..96366db7 100644
--- a/geps/gep-2648/index.md
+++ b/geps/gep-2648/index.md
@@ -3,7 +3,7 @@
 * Issue: [#2648](https://github.com/kubernetes-sigs/gateway-api/issues/2648)
 * Status: Provisional
 
-(See status definitions [here](/geps/overview/#gep-states)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -73,7 +73,7 @@ A Direct Policy Attachment is tightly bound to one instance of a particular
 Kind within a single namespace (or to an instance of a single Kind at cluster scope),
 and only modifies the behavior of the object that matches its binding.
 
-As an example, the BackendTLSPolicy is specified in [GEP-1897](https://gateway-api.sigs.k8s.io/geps/gep-1897/),
+As an example, the BackendTLSPolicy is specified in [GEP-1897](../gep-1897/index.md),
 BackendTLSPolicy - Explicit Backend TLS Connection Configuration. This Policy
 attaches to the Service object and tells Gateway API implementations what TLS
 settings should be used to connect to that Service when it is used as a backend
@@ -95,7 +95,7 @@ the Policy object, the DataplaneConfig object does not affect if the Policy is
 a Direct one or not. This is because _a user can understand the state of the
 hierarchy by looking at all the objects in the hierarchy_. DataplaneConfig is
 _outside_ the hierarchy in terms of understanding the state of the Policy.
-Direct Attacthed Policy is intended as a way to _manage the complexity_ of
+Direct Attached Policy is intended as a way to _manage the complexity_ of
 Policy objects and allow a _limited_ set of Policies to follow vastly more
 simple design patterns _if they meet a set of criteria_.
 
@@ -162,7 +162,7 @@ of other resources, for example:
 
 * Service.Ports.Name
 * Gateway.Listeners.Name
-* HTTPRoute.Rules.Name (once they are added in [GEP-995](https://gateway-api.sigs.k8s.io/geps/gep-995), implementation tracked by [#2985](https://github.com/kubernetes-sigs/gateway-api/pull/2985))
+* HTTPRoute.Rules.Name (once they are added in [GEP-995](../gep-995/index.md), implementation tracked by [#2985](https://github.com/kubernetes-sigs/gateway-api/pull/2985))
 
 Implementations SHOULD NOT use the name of a `backendRef` for applying Policy,
 since the `backendRef` both is not guaranteed to be unique across a Route's rules,
@@ -300,7 +300,7 @@ const (
 Implementations that use Direct Policy objects SHOULD put a Condition into
 `status.Conditions` of any objects affected by a Direct Policy, if that field
 is present. Ideally, there should be a set of Conditions that can be namespaced
-by the implementing controller, but if that is not posisble, use the guidance below.
+by the implementing controller, but if that is not possible, use the guidance below.
 
 If they do, that Condition MUST have a `type` ending in `PolicyAffected` (like
 `gateway.networking.k8s.io/PolicyAffected`),
@@ -370,7 +370,7 @@ See [GEP-1897][gep-1897] for the exact details. A snapshot of the Go code is
 included here for reference, but the canonical representation is in the code
 itself (at the time of writing, this is in `apis/v1alpha2/policy_types.go`).
 
-[gep-1897]: /geps/gep-1897
+[gep-1897]: ../gep-1897/index.md
 
 ```go
 // PolicyAncestorStatus describes the status of a route with respect to an
@@ -485,7 +485,7 @@ to that Gateway.
 
 ### BackendTLSPolicy
 
-BackendTLSPolicy, introduced in [GEP-1897](https://gateway-api.sigs.k8s.io/geps/gep-1897/)
+BackendTLSPolicy, introduced in [GEP-1897](../gep-1897/index.md)
 allows backends to set the TLS details that a Gateway implementation must use
 to connect to that backend.
 
diff --git a/geps/gep-2648/metadata.yaml b/geps/gep-2648/metadata.yaml
index fe9fe843..7e9b54a8 100644
--- a/geps/gep-2648/metadata.yaml
+++ b/geps/gep-2648/metadata.yaml
@@ -4,7 +4,7 @@ number: 2648
 name: Direct Policy Attachment
 status: Provisional
 # Any authors who contribute to the GEP in any way should be listed here using
-# their Github handle.
+# their GitHub handle.
 authors:
   - youngnick
   - robscott
@@ -14,7 +14,7 @@ relationships:
       number: 713
       description: Split out Direct Policy Attachment into its own GEP
 # references is a list of hyperlinks to relevant external references.
-# It's intended to be used for storing Github discussions, Google docs, etc.
+# It's intended to be used for storing GitHub discussions, Google docs, etc.
 references:
   - "https://github.com/kubernetes-sigs/gateway-api/discussions/2927"
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
diff --git a/geps/gep-2649/index.md b/geps/gep-2649/index.md
index a6f18877..dbcc73f7 100644
--- a/geps/gep-2649/index.md
+++ b/geps/gep-2649/index.md
@@ -3,7 +3,7 @@
 * Issue: [#2649](https://github.com/kubernetes-sigs/gateway-api/issues/2649)
 * Status: Experimental
 
-(See status definitions [here](/geps/overview/#gep-states)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -60,7 +60,7 @@ an Inherited Policy.
 
 Note that the same object may be have some properties of both an Inherited Policy
 _and_ a Direct Policy if it can attach to multiple points of a hierarchy, such
-as if the same Policy can be atttached to a Gateway (where it affects all Routes
+as if the same Policy can be attached to a Gateway (where it affects all Routes
 attached to that Gateway) or to a Route (where it affects only that Route).
 
 If a Policy _can be_ used as an Inherited Policy, it MUST be treated as an
diff --git a/geps/gep-2649/metadata.yaml b/geps/gep-2649/metadata.yaml
index b6eda3b4..403a0c72 100644
--- a/geps/gep-2649/metadata.yaml
+++ b/geps/gep-2649/metadata.yaml
@@ -12,7 +12,7 @@ relationships:
       number: 713
       description: Split out Inherited Policy Attachment
 # references is a list of hyperlinks to relevant external references.
-# It's intended to be used for storing Github discussions, Google docs, etc.
+# It's intended to be used for storing GitHub discussions, Google docs, etc.
 references:
   - "https://github.com/kubernetes-sigs/gateway-api/discussions/2927"
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
diff --git a/geps/gep-2659/index.md b/geps/gep-2659/index.md
index b2838a7c..00cabd8e 100644
--- a/geps/gep-2659/index.md
+++ b/geps/gep-2659/index.md
@@ -4,7 +4,7 @@
 * Type: Memorandum
 * Status: Accepted
 
-(See status definitions [here](overview.md#status).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -26,7 +26,7 @@ As part of preparing for work to split up GEP-713, we (the Gateway API and GAMMA
 maintainers) have noticed a few shortcomings in our GEP process.
 
 In particular, we have some GEPs that are very different to other GEPs.
-[GEP-1324](https://gateway-api.sigs.k8s.io/geps/gep-1324/) is a good example,
+[GEP-1324](../gep-1324/index.md) is a good example,
 as it lays out the general agreement and use cases for the GAMMA initiative, but
 has no firm deliverables of its own. In fact, its main purpose was to ensure
 that the community was in agreement on the language around and scope of the
@@ -36,10 +36,10 @@ work (in the form of subsequent GEPs). However, our current GEP system of checkl
 for graduating levels fits this type of GEP poorly.
 
 Additionally, we've had two GEPs moved to Declined ([GEP-735: TCP and UDP address
-matching](https://gateway-api.sigs.k8s.io/geps/gep-735/) and
-[GEP-1282: Describing Backend Properties](https://gateway-api.sigs.k8s.io/geps/gep-1282/)).
+matching](../gep-735/index.md) and
+[GEP-1282: Describing Backend Properties](../gep-1282/index.md)).
 In the case of GEP-1282, we now have a replacement GEP,
-[GEP-1897: BackendTLSPolicy](https://gateway-api.sigs.k8s.io/geps/gep-1897/)
+[GEP-1897: BackendTLSPolicy](../gep-1897/index.md)
 which obsoletes the older GEP. But we have no way of representing this
 relationship (or any other, in fact) between GEPs at the moment.
 
@@ -87,7 +87,7 @@ Memorandum GEPs after this GEP is merged.
 
 ### Addition of YAML metadata file
 
-The core Gateway API mainatainers were hoping not to need metadata YAMLs for a
+The core Gateway API maintainers were hoping not to need metadata YAMLs for a
 while, but the addition of relationships has turbocharged the need for machine
 parseable GEP metadata.
 
@@ -118,7 +118,7 @@ relationships:
   # set back to this GEP, and MUST be moved to Declined.
   obsoletes: {}
   obsoletedBy: {}
-  # extends indicates that a GEP extends the linkned GEP, adding more detail
+  # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
   extends: {}
@@ -127,7 +127,7 @@ relationships:
   # covered by an existing relationship.
   seeAlso: {}
 # references is a list of hyperlinks to relevant external references.
-# It's intended to be used for storing Github discussions, Google docs, etc.
+# It's intended to be used for storing GitHub discussions, Google docs, etc.
 references: {}
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
diff --git a/geps/gep-2722/index.md b/geps/gep-2722/index.md
index 450bb836..135e2c76 100644
--- a/geps/gep-2722/index.md
+++ b/geps/gep-2722/index.md
@@ -14,12 +14,12 @@ TLDR: This GEP proposes `gwctl`, a new command line tool designed to streamline
 
 ## Motivations
 
-* Limited kubectl customizability for CRDs: 
+* Limited kubectl customizability for CRDs:
     * kubectl's customization capabilities for CRDs (through
       `additionalPrinterColumns`) is constrained, limiting the ability to create
-      optimal views for Gateway API resources. 
-* Complex policy attachment management: 
-    * As described in [GEP-713](https://gateway-api.sigs.k8s.io/geps/gep-713/),
+      optimal views for Gateway API resources.
+* Complex policy attachment management:
+    * As described in [GEP-713](../gep-713/index.md),
       policies present a valuable mechanism for expanding the capabilities of
       Gateway API resources. However, discoverability poses a challenge due to
       the absence of a clear connection between resources and their associated
@@ -27,7 +27,7 @@ TLDR: This GEP proposes `gwctl`, a new command line tool designed to streamline
       as a means to provide extensions.
 * Challenging multi-resource model navigation:
     * Comprehending the relationships between multiple Gateway API resources can
-      be challenging within kubectl. 
+      be challenging within kubectl.
 
 ## Goals
 
@@ -47,7 +47,7 @@ TLDR: This GEP proposes `gwctl`, a new command line tool designed to streamline
       issue identification and resolution. This would complement the ability of
       users to readily pinpoint configuration problems themselves.
 * Provide incentive for policy implementations that are consistent across cloud
-  providers: 
+  providers:
     * Encourage the adoption of consistent policy implementations across
       different Gateway API providers, promoting interoperability and
       predictability.
@@ -103,7 +103,7 @@ TLDR: This GEP proposes `gwctl`, a new command line tool designed to streamline
       format.
     * Wide format (-o wide): Includes additional columns beyond those displayed in
       the one-line format.
-  
+
   <details>
     <summary>Output columns while using get</summary>
     <table>
@@ -387,12 +387,12 @@ distribution mechanisms will be provided:
   for visualizing data and presenting information in a visually appealing
   manner.
 * Evaluate how gwctl can be extended to support [Mesh use
-  cases](https://gateway-api.sigs.k8s.io/concepts/gamma/#how-the-gateway-api-works-for-service-mesh)
+  cases](/concepts/gamma/#how-the-gateway-api-works-for-service-mesh)
 
 ## References
 
 * [GEP-713: Metaresources and Policy
-  Attachment](https://gateway-api.sigs.k8s.io/geps/gep-713)
+  Attachment](../gep-713/index.md)
 
 ## Sample outputs
 
diff --git a/geps/gep-2907/index.md b/geps/gep-2907/index.md
index e3ff1dfc..019d336b 100644
--- a/geps/gep-2907/index.md
+++ b/geps/gep-2907/index.md
@@ -7,8 +7,8 @@
 This GEP aims to define high level TLS terminology and structure within Gateway
 API to ensure that all our independent proposals related to TLS result in a
 coherent set of APIs. This will result in some adjustments to provisional and
-experimental TLS-related GEPs, specifically [BackendTLSPolicy](/geps/gep-1897)
-and [Client Certificate Verification](/geps/gep-91).
+experimental TLS-related GEPs, specifically [BackendTLSPolicy](../gep-1897/index.md)
+and [Client Certificate Verification](../gep-91/index.md).
 
 ## Goals
 * Define high-level terminology for how we refer to TLS in Gateway API.
@@ -43,7 +43,7 @@ such as a virtual IP.
 Each Gateway contains multiple “Listeners”. Each HTTPS Listener in a Gateway
 must have a unique combination of protocol, port, and SNI (Server Name
 Indication). TLS configuration attached at this layer should be [isolated via
-SNI](/guides/implementers/#listener-isolation).
+SNI](../../guides/implementers.md#listener-isolation).
 
 #### C. BackendTLSPolicy
 This policy allows us to attach unique TLS configuration per Backend. Depending
diff --git a/geps/gep-3155/index.md b/geps/gep-3155/index.md
index 8652b3b1..b75b64cc 100644
--- a/geps/gep-3155/index.md
+++ b/geps/gep-3155/index.md
@@ -64,7 +64,7 @@ type GatewayBackendTLS struct {
   // ClientCertificateRef can reference to standard Kubernetes resources, i.e.
   // Secret, or implementation-specific custom resources.
   //
-  // This setting can be overriden on the service level by use of BackendTLSPolicy.
+  // This setting can be overridden on the service level by use of BackendTLSPolicy.
   ClientCertificateRef SecretObjectReference `json:"clientCertificateRef,omitempty"`
 }
 ```
@@ -191,6 +191,6 @@ This GEP does not cover per-service overrides for client certificate. This is mo
 ## References
 
 This is a natural continuation of
-[GEP-2907](https://gateway-api.sigs.k8s.io/geps/gep-2907/), the memorandum GEP
+[GEP-2907](../gep-2907/index.md), the memorandum GEP
 that provided the overall vision for where TLS configuration should fit
 throughout Gateway API.
diff --git a/geps/gep-3155/metadata.yaml b/geps/gep-3155/metadata.yaml
index d89201ce..6e052881 100644
--- a/geps/gep-3155/metadata.yaml
+++ b/geps/gep-3155/metadata.yaml
@@ -6,6 +6,8 @@ status: Experimental
 authors:
   - mkosieradzki
   - robscott
+featureNames:
+  - BackendTLSPolicySANs
 relationships:
   seeAlso:
     - number: 2907
diff --git a/geps/gep-3171/index.md b/geps/gep-3171/index.md
index fbf21c4c..631223f2 100644
--- a/geps/gep-3171/index.md
+++ b/geps/gep-3171/index.md
@@ -1,13 +1,13 @@
 # GEP-3171: Percentage-based Request Mirroring
 
 * Issue: [#3171](https://github.com/kubernetes-sigs/gateway-api/issues/3171)
-* Status: **Experimental**
+* Status: Standard
 
-(See status definitions [here](/geps/overview/#gep-states).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
-Enhance the existing [Request Mirroring](https://gateway-api.sigs.k8s.io/guides/http-request-mirroring/) feature by allowing users to specify a percentage of requests they'd like mirrored.
+Enhance the existing [Request Mirroring](../../guides/http-request-mirroring.md) feature by allowing users to specify a percentage of requests they'd like mirrored.
 
 ## Goals
 
@@ -20,15 +20,17 @@ The scope of this GEP is to add support for this feature in both HTTPRoute and G
 
 ## Introduction
 
-[Request Mirroring](https://gateway-api.sigs.k8s.io/guides/http-request-mirroring/) is a feature that allows a user to mirror requests going to some backend A along to some other specified backend B. Right now Request Mirroring is an all or nothing feature – either 100% of request are mirrored, or 0% are. Percentage-based Request Mirroring will allow users to specify a percentage of requests they'd like mirrored as opposed to every single request.   
+[Request Mirroring](../../guides/http-request-mirroring.md) is a feature that allows a user to mirror requests going to some backend A along to some other specified backend B. Right now Request Mirroring is an all or nothing feature – either 100% of request are mirrored, or 0% are. Percentage-based Request Mirroring will allow users to specify a percentage of requests they'd like mirrored as opposed to every single request.
 
-This feature is already [supported by Envoy](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-msg-config-route-v3-routeaction-requestmirrorpolicy), so adding it for the Gateway API would enable better integration between the two products. There's also an existing user desire for this feature on the [HAProxy side](https://www.haproxy.com/blog/haproxy-traffic-mirroring-for-real-world-testing) and [NGINX side](https://alex.dzyoba.com/blog/nginx-mirror/). Since Request Mirroring is already supported by the Gateway API, Percentage-based Request Mirroring would a clear improvement on this pre-existing feature.
+This feature is already [supported by Envoy][config.route.v3.RouteAction.RequestMirrorPolicy], so adding it for the Gateway API would enable better integration between the two products. There's also an existing user desire for this feature on the [HAProxy side](https://www.haproxy.com/blog/haproxy-traffic-mirroring-for-real-world-testing) and [NGINX side](https://alex.dzyoba.com/blog/nginx-mirror/). Since Request Mirroring is already supported by the Gateway API, Percentage-based Request Mirroring would a clear improvement on this preexisting feature.
+
+[config.route.v3.RouteAction.RequestMirrorPolicy]: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-msg-config-route-v3-routeaction-requestmirrorpolicy
 
 ## Existing Support in Implementations
 
 | Implementation | Support |
 |----------------|------------|
-| Envoy | [config.route.v3.RouteAction.RequestMirrorPolicy](config.route.v3.RouteAction.RequestMirrorPolicy) |
+| Envoy | [config.route.v3.RouteAction.RequestMirrorPolicy][config.route.v3.RouteAction.RequestMirrorPolicy] |
 | HAProxy | [HAProxy SPOP](https://github.com/haproxytech/spoa-mirror) |
 | NGINX | [ngx_http_mirror_module](https://nginx.org/en/docs/http/ngx_http_mirror_module.html) |
 
@@ -85,7 +87,7 @@ type HTTPRequestMirrorFilter struct {
         //
         // Support: Implementation-specific for any other resource
         BackendRef BackendObjectReference `json:"backendRef"`
-      
+
         // Percent represents the percentage of requests that should be
         // mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
         // requests) and its maximum value is 100 (indicating 100% of requests).
@@ -146,7 +148,7 @@ spec:
         percent: 42
 ```
 
-This would result in 42% of requests going to `foo-v1` to be mirrored to `foo-v2`.    
+This would result in 42% of requests going to `foo-v1` to be mirrored to `foo-v2`.
 
 An example with Fraction:
 
diff --git a/geps/gep-3171/metadata.yaml b/geps/gep-3171/metadata.yaml
index 0e9f4a70..1c3b0550 100644
--- a/geps/gep-3171/metadata.yaml
+++ b/geps/gep-3171/metadata.yaml
@@ -2,7 +2,7 @@ apiVersion: internal.gateway.networking.k8s.io/v1alpha2
 kind: GEPDetails
 number: 3171
 name: Percentage-based Request Mirroring
-status: Experimental
+status: Standard
 authors:
   - jakebennert
 references:
diff --git a/geps/gep-3388/index.md b/geps/gep-3388/index.md
index ecf10dcd..6d0227e4 100644
--- a/geps/gep-3388/index.md
+++ b/geps/gep-3388/index.md
@@ -1,9 +1,9 @@
 # GEP-3388: Retry Budgets
 
 * Issue: [#3388](https://github.com/kubernetes-sigs/gateway-api/issues/3388)
-* Status: Provisional
+* Status: Experimental
 
-(See status definitions [here](/geps/overview/#gep-states).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -29,7 +29,7 @@ Multiple data plane proxies offer optional configuration for budgeted retries, i
 
 Configuring a limit for client retries is an important factor in building a resilient system, allowing requests to be successfully retried during periods of intermittent failure. But too many client-side retries can also exacerbate consistent failures and slow down recovery, quickly overwhelming a failing system and leading to cascading failures such as retry storms. Configuring a sane limit for max client-side retries is often challenging in complex systems. Allowing an application developer (Ana) to configure a dynamic "retry budget" reduces the risk of a high number of retries across clients. It allows a service to perform as expected in both times of high & low request load, as well as both during periods of intermittent & consistent failures.
 
-While retry budget configuration has been a frequently discussed feature within the community, differences in the semantics between data plane implementations creates a challenge for a consensus on the correct location for the configuration. This proposal aims to determine where retry budget's should be defined within the Gateway API, and whether data plane proxies may need to be altered to accommodate the specification. 
+While retry budget configuration has been a frequently discussed feature within the community, differences in the semantics between data plane implementations creates a challenge for a consensus on the correct location for the configuration. This proposal aims to determine where retry budgets should be defined within the Gateway API, and whether data plane proxies may need to be altered to accommodate the specification.
 
 ### Background on implementations
 
@@ -49,7 +49,9 @@ By default, Envoy uses a static threshold for retries. But when configured, Envo
 
 The Linkerd implementation of retry budgets is configured alongside service route configuration, within the [ServiceProfile CRD](https://linkerd.io/2.12/reference/service-profiles/), limiting the number of total retries for a service as a percentage of the number of recent requests. In practice, this functions similarly to Envoy's retry budget implementation, as it is configured in a single location and measures the ratio of retry requests to original requests across all traffic destined for the service.
 
-Linkerd uses [budgeted retries](https://linkerd.io/2.15/features/retries-and-timeouts/) as the default configuration to specify retries to a service, but - as of [edge-24.7.5](https://github.com/linkerd/linkerd2/releases/tag/edge-24.7.5) - supports counted retries. In all cases, retries are implemented by the `linkerd2-proxy` making the request on behalf on an application workload.
+(Note that budgeted retries have become less commonly used since Linkerd added support for counted retries in [edge-24.7.5](https://github.com/linkerd/linkerd2/releases/tag/edge-24.7.5): ServiceProfile operates at the level of a backend workload, meaning that it cannot configure anything at the level of a route, but counted retries can be configured using annotations on Service, HTTPRoute, and GRPCRoute.)
+
+For both counted retries and budgeted retries, the actual retry logic is implemented by the `linkerd2-proxy` making the request on behalf on an application workload. The receiving proxy is not aware of the retry configuration at all.
 
 Linkerd's budgeted retries allow retrying an indefinite number of times, as long as the fraction of retries remains within the budget. Budgeted retries are supported only using Linkerd's native ServiceProfile CRD, which allows enabling retries, setting the retry budget (by default, 20% plus 10 "extra" retries per second), and configuring the window over which the fraction of retries to non-retries is calculated. The `retryBudget` field of the ServiceProfile spec can be configured with the following optional parameters:
 
@@ -81,11 +83,144 @@ The implementation of a version of Linkerd's `ttl` parameter within Envoy might
 
 ### Go
 
-TODO
+```golang
+type BackendTrafficPolicy struct {
+    // BackendTrafficPolicy defines the configuration for how traffic to a target backend should be handled.
+    //
+    // Support: Extended
+    //
+    // +optional
+    // <gateway:experimental>
+    //
+    // Note: there is no Override or Default policy configuration.
+
+    metav1.TypeMeta   `json:",inline"`
+    metav1.ObjectMeta `json:"metadata,omitempty"`
+
+    // Spec defines the desired state of BackendTrafficPolicy.
+    Spec BackendTrafficPolicySpec `json:"spec"`
+    
+    // Status defines the current state of BackendTrafficPolicy.
+    Status PolicyStatus `json:"status,omitempty"`
+}
+
+type BackendTrafficPolicySpec struct {
+  // TargetRef identifies an API object to apply policy to.
+  // Currently, Backends (i.e. Service, ServiceImport, or any
+  // implementation-specific backendRef) are the only valid API
+  // target references.
+  // +listType=map
+  // +listMapKey=group
+  // +listMapKey=kind
+  // +listMapKey=name
+  // +kubebuilder:validation:MinItems=1
+  // +kubebuilder:validation:MaxItems=16
+  TargetRefs []LocalPolicyTargetReference `json:"targetRefs"`
+
+  // Retry defines the configuration for when to retry a request to a target backend.
+  //
+  // Implementations SHOULD retry on connection errors (disconnect, reset, timeout,
+  // TCP failure) if a retry stanza is configured.
+  //
+  // Support: Extended
+  //
+  // +optional
+  // <gateway:experimental>
+  Retry *CommonRetryPolicy `json:"retry,omitempty"`
+
+  // SessionPersistence defines and configures session persistence
+  // for the backend.
+  //
+  // Support: Extended
+  //
+  // +optional
+  SessionPersistence *SessionPersistence `json:"sessionPersistence,omitempty"`
+}
+
+// CommonRetryPolicy defines the configuration for when to retry a request.
+//
+type CommonRetryPolicy struct {
+    // Support: Extended
+    //
+    // +optional
+    BudgetPercent *Int `json:"budgetPercent,omitempty"`
+
+    // Support: Extended
+    //
+    // +optional
+    BudgetInterval *Duration `json:"budgetInterval,omitempty"`
+
+    // Support: Extended
+    //
+    // +optional
+    MinRetryRate *RequestRate `json:"minRetryRate,omitempty"`
+}
+
+// RequestRate expresses a rate of requests over a given period of time.
+//
+type RequestRate struct {
+    // Support: Extended
+    //
+    // +optional
+    Count *Int `json:"count,omitempty"`
+
+    // Support: Extended
+    //
+    // +optional
+    Interval *Duration `json:"interval,omitempty"`
+}
+
+// Duration is a string value representing a duration in time. The format is
+// as specified in GEP-2257, a strict subset of the syntax parsed by Golang
+// time.ParseDuration.
+//
+// +kubebuilder:validation:Pattern=`^([0-9]{1,5}(h|m|s|ms)){1,4}$`
+type Duration string
 
 ### YAML
 
-TODO
+```yaml
+apiVersion: gateway.networking.x-k8s.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: traffic-policy-example
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: foo
+  retry:
+    budgetPercent: 20
+    budgetInterval: 10s
+    minRetryRate:
+      count: 3
+      interval: 1s
+  sessionPersistence:
+    ...
+  status:
+    ancestors:
+    - ancestorRef:
+        kind: Mesh
+        namespace: istio-system
+        name: istio
+      controllerName: "istio.io/mesh-controller"
+      conditions:
+      - type: "Accepted"
+        status: "False"
+        reason: "Invalid"
+        message: "BackendTrafficPolicy field sessionPersistence is not supported for Istio mesh traffic."
+    - ancestorRef:
+        kind: Gateway
+        namespace: foo-ns
+        name: foo-ingress
+      controllerName: "istio.io/mesh-controller"
+      conditions:
+      - type: "Accepted"
+        status: "False"
+        reason: "Invalid"
+        message: "BackendTrafficPolicy fields retry.budgetPercentage, retry.budgetInterval and retry.minRetryRate are not supported for Istio ingress gateways."
+    ...
+```
 
 ## Conformance Details
 
diff --git a/geps/gep-3388/metadata.yaml b/geps/gep-3388/metadata.yaml
index 02bbf069..5f33570f 100644
--- a/geps/gep-3388/metadata.yaml
+++ b/geps/gep-3388/metadata.yaml
@@ -2,9 +2,9 @@ apiVersion: internal.gateway.networking.k8s.io/v1alpha1
 kind: GEPDetails
 number: 3388
 name: Retry Budgets
-status: Provisional
+status: Implementable
 # Any authors who contribute to the GEP in any way should be listed here using
-# their Github handle.
+# their GitHub handle.
 authors:
   - ericdbishop
   - mikemorris
@@ -14,7 +14,7 @@ relationships:
   # set back to this GEP, and MUST be moved to Declined.
   obsoletes: {}
   obsoletedBy: {}
-  # extends indicates that a GEP extends the linkned GEP, adding more detail
+  # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
   extends:
@@ -25,7 +25,7 @@ relationships:
   # covered by an existing relationship.
   seeAlso: {}
 # references is a list of hyperlinks to relevant external references.
-# It's intended to be used for storing Github discussions, Google docs, etc.
+# It's intended to be used for storing GitHub discussions, Google docs, etc.
 references: {}
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
diff --git a/geps/gep-3567/index.md b/geps/gep-3567/index.md
index c9dad293..c6a4c36f 100644
--- a/geps/gep-3567/index.md
+++ b/geps/gep-3567/index.md
@@ -1,7 +1,7 @@
 # GEP-3567: Gateway TLS Updates for HTTP/2 Connection Coalescing
 
 * Issue: [#3567](https://github.com/kubernetes-sigs/gateway-api/issues/3567)
-* Status: Implementable
+* Status: Experimental
 
 ## TLDR
 
@@ -40,7 +40,9 @@ the client sends.
 
 Gateway API deals with this situation imprecisely, stating:
 
-    The Listener Hostname SHOULD match at both the TLS and HTTP protocol layers as described above. If an implementation does not ensure that both the SNI and Host header match the Listener hostname, it MUST clearly document that.
+    The Listener Hostname SHOULD match at both the TLS and HTTP protocol layers
+    as described above. If an implementation does not ensure that both the SNI
+    and Host header match the Listener hostname, it MUST clearly document that.
 
 In practice we can end up with an implementation that misroutes requests when a
 Gateway is configured using certificates that use multiple or wildcard SANs.
@@ -48,7 +50,7 @@ Gateway is configured using certificates that use multiple or wildcard SANs.
 ### Example
 
 The following configuration ([from the Gateway API
-documentation](https://gateway-api.sigs.k8s.io/guides/tls/#wildcard-tls-listeners))
+documentation](../../guides/tls.md#wildcard-tls-listeners))
 illustrates the problem:
 
 
@@ -97,16 +99,16 @@ negotiated with the other Listener’s certificate.
 
 Mapping a request to a Listener matters if the Gateway configuration has
 different
-[HTTPRoutes](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRoute)
+[HTTPRoutes](../../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRoute)
 bound to the different Listeners. It also matters if the Listeners have
 different
-[GatewayTlsConfigs](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.GatewayTLSConfig)
+[GatewayTlsConfigs](../../reference/spec.md#gateway.networking.k8s.io/v1.GatewayTLSConfig)
 attached, for example if one Listener uses mutual TLS and the other does not.
 
 
 ### Interaction with Client Cert Validation
 
-[GEP-91](https://gateway-api.sigs.k8s.io/geps/gep-91/) introduced Client
+[GEP-91](../gep-91/index.md) introduced Client
 Certificate Validation to Gateway Listeners as a new experimental concept. If an
 implementation is unable to properly isolate HTTPS listeners, this could result
 in this Client Cert Validation being bypassed. Before this feature can graduate
@@ -119,7 +121,7 @@ A new condition will be added to Gateways: `OverlappingTLSConfig`.
 Implementations MUST add this condition to status when a Gateway is configured
 with TLS configuration across multiple Listeners. Implementations MAY add this
 condition to status when a Gateway is configured with overlapping TLS
-certifications. Note that since this is a negative polarity condition, it would
+certificates. Note that since this is a negative polarity condition, it would
 only be populated when it is true.
 
 ### B) Modify API Spec to recommend sending 421s
diff --git a/geps/gep-3567/metadata.yaml b/geps/gep-3567/metadata.yaml
index 2ab8064f..be9f0fd3 100644
--- a/geps/gep-3567/metadata.yaml
+++ b/geps/gep-3567/metadata.yaml
@@ -4,7 +4,7 @@ number: 3567
 name: Gateway TLS Updates for HTTP/2 Connection Coalescing
 status: Implementable
 # Any authors who contribute to the GEP in any way should be listed here using
-# their Github handle.
+# their GitHub handle.
 authors:
   - robscott
 relationships:
@@ -13,7 +13,7 @@ relationships:
   # set back to this GEP, and MUST be moved to Declined.
   obsoletes: {}
   obsoletedBy: {}
-  # extends indicates that a GEP extends the linkned GEP, adding more detail
+  # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
   extends: {}
@@ -22,7 +22,7 @@ relationships:
   # covered by an existing relationship.
   seeAlso: {}
 # references is a list of hyperlinks to relevant external references.
-# It's intended to be used for storing Github discussions, Google docs, etc.
+# It's intended to be used for storing GitHub discussions, Google docs, etc.
 references: {}
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
diff --git a/geps/gep-696/index.md b/geps/gep-696/index.md
index 19f4f6e9..bedcc6e6 100644
--- a/geps/gep-696/index.md
+++ b/geps/gep-696/index.md
@@ -3,7 +3,7 @@
 * Issue: [#696](https://github.com/kubernetes-sigs/gateway-api/issues/696)
 * Status: Provisional|Implementable|Experimental|Standard|Deferred|Rejected|Withdrawn|Replaced
 
-(See status definitions [here](/geps/overview/#gep-states).)
+(See [status definitions](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -27,7 +27,7 @@ the content into the GEP as online documents are easier to lose
 (... details, can point to PR with changes)
 
 ### Gateway for Ingress (North/South)
-(Include API details for North/South usecases)
+(Include API details for North/South use cases)
 
 ### Gateway For Mesh (East/West)
 (Include East/West API considerations, examples, and if different - APIs)
@@ -49,7 +49,7 @@ Every feature should:
 
 ### Conformance tests 
 
-Conformance tests file names should try to follow the the `pascal-case-name.go` format.
+Conformance tests file names should try to follow the `pascal-case-name.go` format.
 For example for `HTTPRoutePortRedirect` - the test file would be `httproute-port-redirect.go`.
 
 Treat this guidance as "best effort" because we might have test files that check the combination of several features and can't follow the same format.
diff --git a/geps/gep-696/metadata.yaml b/geps/gep-696/metadata.yaml
index efcc0d2f..cd15a89c 100644
--- a/geps/gep-696/metadata.yaml
+++ b/geps/gep-696/metadata.yaml
@@ -4,7 +4,7 @@ number: 696
 name: GEP template
 status: Completed
 # Any authors who contribute to the GEP in any way should be listed here using
-# their Github handle.
+# their GitHub handle.
 authors:
   - bowei
   - robscott
@@ -16,7 +16,7 @@ relationships:
   # set back to this GEP, and MUST be moved to Declined.
   obsoletes: {}
   obsoletedBy: {}
-  # extends indicates that a GEP extends the linkned GEP, adding more detail
+  # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
   extends: {}
@@ -25,7 +25,7 @@ relationships:
   # covered by an existing relationship.
   seeAlso: {}
 # references is a list of hyperlinks to relevant external references.
-# It's intended to be used for storing Github discussions, Google docs, etc.
+# It's intended to be used for storing GitHub discussions, Google docs, etc.
 references: {}
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
diff --git a/geps/gep-709/index.md b/geps/gep-709/index.md
index a4a8d213..1a2ea88f 100644
--- a/geps/gep-709/index.md
+++ b/geps/gep-709/index.md
@@ -132,7 +132,7 @@ type ReferenceGrantSpec struct {
 
 // ReferenceGrantFrom describes trusted namespaces and kinds.
 type ReferenceGrantFrom struct {
-    // Group is the group of the referrent.
+    // Group is the group of the referent.
     //
     // Support: Core
     //
@@ -140,7 +140,7 @@ type ReferenceGrantFrom struct {
     // +kubebuilder:validation:MaxLength=253
     Group string `json:"group"`
 
-    // Kind is the kind of the referrent. Although implementations may support
+    // Kind is the kind of the referent. Although implementations may support
     // additional resources, the following Route types are part of the "Core"
     // support level for this field:
     //
@@ -153,7 +153,7 @@ type ReferenceGrantFrom struct {
     // +kubebuilder:validation:MaxLength=253
     Kind string `json:"kind"`
 
-    // Namespace is the namespace of the referrent.
+    // Namespace is the namespace of the referent.
     //
     // Support: Core
     //
@@ -165,7 +165,7 @@ type ReferenceGrantFrom struct {
 // ReferenceGrantTo describes what Kinds are allowed as targets of the
 // references.
 type ReferenceGrantTo struct {
-    // Group is the group of the referrent.
+    // Group is the group of the referent.
     //
     // Support: Core
     //
@@ -173,7 +173,7 @@ type ReferenceGrantTo struct {
     // +kubebuilder:validation:MaxLength=253
     Group string `json:"group"`
 
-    // Kind is the kind of the referrent. Although implementations may support
+    // Kind is the kind of the referent. Although implementations may support
     // additional resources, the following types are part of the "Core"
     // support level for this field:
     //
diff --git a/geps/gep-713/index.md b/geps/gep-713/index.md
index b6dfa836..1038eb06 100644
--- a/geps/gep-713/index.md
+++ b/geps/gep-713/index.md
@@ -54,7 +54,7 @@ more resources, and are consequently harder to understand and require a more
 complex status design.
 
 Splitting these two design patterns apart into separate GEPs is intended to
-allow proceeding with stablizing the simpler (Direct) case while we work on
+allow proceeding with stabilizing the simpler (Direct) case while we work on
 solving the status problem for the more complex (Inherited) case.
 
 Direct Attached Policies are further specified in the addendum GEP GEP-2648,
@@ -106,7 +106,7 @@ When designing Gateway API, one of the things we’ve found is that we often nee
 able change the behavior of objects without being able to make changes to the spec
 of those objects. Sometimes, this is because we can’t change the spec of the object
 to hold the information we need ( ReferenceGrant, from
-[GEP-709](https://gateway-api.sigs.k8s.io/geps/gep-709/), affecting Secrets
+[GEP-709](../gep-709/index.md), affecting Secrets
 and Services is an example, as is Direct Policy Attachment), and sometimes it’s
 because we want the behavior change to flow across multiple objects
 (this is what Inherited Policy Attachment is for).
@@ -156,12 +156,12 @@ Avoid annotation hell
 ### Direct Policy Attachment
 
 For more description of the details of Direct Policy Attachment,
-see [GEP-2648](https://gateway-api.sigs.k8s.io/geps/gep-2648/).
+see [GEP-2648](../gep-2648/index.md).
 
 ### Inherited Policy Attachment
 
 For more description of the details of Inherited Policy Attachment,
-see [GEP-2649](https://gateway-api.sigs.k8s.io/geps/gep-2649/).
+see [GEP-2649](../gep-2649/index.md).
 
 ### How to determine if a Policy is a Direct or Inherited one
 
@@ -555,7 +555,7 @@ that _every_ Policy update does not require a status update.
 
 Because Policy Attachment is a pattern for APIs, not an API, and needs to address
 all the problems above, the strategy this GEP proposes is to define a range of
-options for increasing the discoverabilty of Policy resources, and provide
+options for increasing the discoverability of Policy resources, and provide
 guidelines for when they should be used.
 
 It's likely that at some stage, the Gateway API CRDs will include some Policy
@@ -588,7 +588,7 @@ plugin.
 
 ##### Design considerations
 
-This is already part of the API pattern, but is being lifted to more prominience
+This is already part of the API pattern, but is being lifted to more prominence
 here.
 
 #### Standard status struct
@@ -628,7 +628,7 @@ combination of the `AncestorRef` and the `ControllerName` fields as a key.
 
 See [GEP-1897][gep-1897] for the exact details.
 
-[gep-1897]: /geps/gep-1897
+[gep-1897]: ../gep-1897/index.md
 
 ```go
 // PolicyAncestorStatus describes the status of a route with respect to an
@@ -789,7 +789,7 @@ This solution:
 - is low cost in terms of apiserver updates (because it's only on the GatewayClass,
   and only on implementation startup)
 - provides a standard place for all users to look for relevant objects
-- ties in to the Conformance Profiles design and other efforts about GatewayClass 
+- ties into the Conformance Profiles design and other efforts about GatewayClass 
   status
 
 #### Standard status stanza
@@ -871,7 +871,7 @@ contains `status` information.
 
 ```yaml
 kind: EffectivePolicy
-apiVersion: gateway.networkking.k8s.io/v1alpha2
+apiVersion: gateway.networking.k8s.io/v1alpha2
 metadata:
   name: targeted-object
   namespace: targeted-object-namespace
@@ -940,7 +940,7 @@ will be capable of describing the computed sum of policy that applies to a given
 resource, including policies applied to parent resources.
 
 Each Policy CRD that wants to be supported by this plugin will need to follow
-the API structure defined above and add the [corresponding label](https://gateway-api.sigs.k8s.io/geps/gep-713/#standard-label-on-crd-objects)
+the API structure defined above and add the [corresponding label](index.md#standard-label-on-crd-objects)
 to the CRD.
 
 ### Conditions
@@ -1003,7 +1003,7 @@ const (
 
 #### On targeted resources
 
-(copied from [Standard Status Condition][#standard-status-condition])
+(copied from [Standard status Condition on Policy-affected objects](#standard-status-condition-on-policy-affected-objects))
 
 This solution requires definition in a GEP of its own to become binding.
 
diff --git a/geps/gep-724/index.md b/geps/gep-724/index.md
index bb1e9854..59bab7d2 100644
--- a/geps/gep-724/index.md
+++ b/geps/gep-724/index.md
@@ -16,7 +16,7 @@ for the future addition of Route inclusion (Routes including other Routes).
 Refactor cross-namespace Route-Gateway binding to:
 
 * Be more consistent with [cross-namespace references from
-  Routes](/geps/gep-709)
+  Routes](../gep-709/index.md)
 * Provide a clear path to enable Route inclusion (Routes including Routes).
 * Simplify user experience based on initial feedback.
 * Enable other kinds of Route parents in addition to Gateway, this could include:
@@ -57,7 +57,7 @@ directly reference the Gateways they wanted to attach to. This pattern was
 already possible with the existing API, but not clearly documented.
 
 One of the key concepts in the [cross-namespace references from Routes
-GEP](/geps/gep-709) was that of a handshake for
+GEP](../gep-709/index.md) was that of a handshake for
 references that cross namespace boundaries. A key part of that handshake was
 that one direction included a direct reference, while the other direction
 provided a way to denote trust for a set of Namespaces and kind of resources.
@@ -618,7 +618,7 @@ bar namespace. Unfortunately that would be very difficult to recreate with
 ReferenceGrant.
 
 ReferenceGrant is fundamentally about trusting references from resource of kind
-Foo in to resources of kind Bar. Names and section names are intentionally
+Foo in resources of kind Bar. Names and section names are intentionally
 excluded. If we added both of those concepts to ReferenceGrant, this would be
 possible, but quite complex and verbose. This is what the example from above
 would look like with this approach:
@@ -686,7 +686,7 @@ spec:
 
 **GEPs**
 
-* [GEP 709: ReferenceGrant + Cross Namespace References from Routes](/geps/gep-709)
+* [GEP 709: ReferenceGrant + Cross Namespace References from Routes](../gep-709/index.md)
 
 **Docs:**
 
@@ -696,4 +696,4 @@ spec:
 **Issues:**
 
 * [Simplify Gateway Route Binding](https://github.com/kubernetes-sigs/gateway-api/issues/594)
-* [Route selector improvements on Gateway](https://github.com/kubernetes-sigs/gateway-api/issues/515)
\ No newline at end of file
+* [Route selector improvements on Gateway](https://github.com/kubernetes-sigs/gateway-api/issues/515)
diff --git a/geps/gep-746/index.md b/geps/gep-746/index.md
index 475a0ae8..7175c98d 100644
--- a/geps/gep-746/index.md
+++ b/geps/gep-746/index.md
@@ -176,7 +176,7 @@ type TLSRouteOverrideType string
 
 const (
     // Allows the parameter to be configured from all routes.
-    TLSROuteOVerrideAllow TLSRouteOverrideType = "Allow"
+    TLSRouteOverrideAllow TLSRouteOverrideType = "Allow"
 
     // Prohibits the parameter from being configured from any route.
     TLSRouteOverrideDeny TLSRouteOverrideType = "Deny"
@@ -262,4 +262,4 @@ chooses to claim a hostname.
 
 Docs:
 
-* [Gateway API: Replacing TLS Certificates in Routes](https://docs.google.com/document/d/1Cv95XFCL6S_9pIyS0drnsDLsfinWc2tHOFl_x3-_SWI/edit)
\ No newline at end of file
+* [Gateway API: Replacing TLS Certificates in Routes](https://docs.google.com/document/d/1Cv95XFCL6S_9pIyS0drnsDLsfinWc2tHOFl_x3-_SWI/edit)
diff --git a/geps/gep-820/index.md b/geps/gep-820/index.md
index e683060e..78b92a94 100644
--- a/geps/gep-820/index.md
+++ b/geps/gep-820/index.md
@@ -52,7 +52,7 @@ The following fields and all associated documentation will be removed:
 - HTTPRouteMatch.ExtensionRef
 - TCPRouteMatch.ExtensionRef will be removed. This results in a struct without
   any members: TCPRouteMatch. The struct will be kept as it is expected that
-  more match criterias might be added to L4 routes.
+  more match criteria might be added to L4 routes.
 
   - Do the same to UDPRoute and TLSRoute
 
diff --git a/geps/gep-91/index.md b/geps/gep-91/index.md
index 5999bf9a..6fddddb5 100644
--- a/geps/gep-91/index.md
+++ b/geps/gep-91/index.md
@@ -3,7 +3,7 @@
 * Issue: [#91](https://github.com/kubernetes-sigs/gateway-api/issues/91)
 * Status: Implementable
 
-(See definitions in [GEP Status][/contributing/gep#status].)
+(See definitions in [GEP States](../overview.md#gep-states).)
 
 ## TLDR
 
@@ -151,7 +151,7 @@ spec:
 This section highlights use cases that may be covered in a future iteration of this GEP
 
 * Using system CA certificates as the trust anchor to validate the certificates presented by the frontend client.
-* Supporting a mode where validating client certficates is optional, useful for debugging and migrating to strict TLS.
+* Supporting a mode where validating client certificates is optional, useful for debugging and migrating to strict TLS.
 * Supporting an optional `subjectAltNames` field within `FrontendTLSValidation` that can be used to specify one or more alternate names to verify the subject identity in the certificate presented by the client. This field falls under Authorization, the initial focus here is on Client Authentication and will be revisited when Authorization is tackled as a whole in the project.
 * Specifying the verification depth in the client certificate chain. This is being deferred because the default verification depth differs across implementations.
 
@@ -160,7 +160,7 @@ This section highlights use cases that may be covered in a future iteration of t
 
 [TLS Handshake Protocol]: https://www.rfc-editor.org/rfc/rfc5246#section-7.4
 [Certificate Path Validation]: https://www.rfc-editor.org/rfc/rfc5280#section-6
-[GatewayTLSConfig]: https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.GatewayTLSConfig
-[BackendTLSPolicy]: https://gateway-api.sigs.k8s.io/api-types/backendtlspolicy/
-[TLS Configuration GEP]: https://gateway-api.sigs.k8s.io/geps/gep-2907/
+[GatewayTLSConfig]: /references/spec/#gateway.networking.k8s.io/v1.GatewayTLSConfig
+[BackendTLSPolicy]: ../../api-types/backendtlspolicy.md
+[TLS Configuration GEP]: ../gep-2907/index.md
 [Gateway API TLS Use Cases]: https://docs.google.com/document/d/17sctu2uMJtHmJTGtBi_awGB0YzoCLodtR6rUNmKMCs8/edit?pli=1#heading=h.cxuq8vo8pcxm
diff --git a/geps/gep-922/index.md b/geps/gep-922/index.md
index a1afba79..1d0ffa6f 100644
--- a/geps/gep-922/index.md
+++ b/geps/gep-922/index.md
@@ -7,7 +7,7 @@
     Although this GEP serves as a reference for how we developed the Gateway API
     versioning model, it is not meant to be the current source of truth.
     Instead, please refer to our [official Versioning
-    Policy](/concepts/versioning) for the most up-to-date guidelines.
+    Policy](../../concepts/versioning.md) for the most up-to-date guidelines.
 
 ## TLDR
 Each Gateway API release will be represented by a bundle version that represents
@@ -51,7 +51,7 @@ and/or removing old ones as part of a new bundle.
 ## Limitations of Webhook and CRD Validation
 CRD and webhook validation is not the final validation i.e. webhook is “nice UX”
 but not schema enforcement. This validation is intended to provide immediate
-feedback to users when they provide an invalid configuration, but can not
+feedback to users when they provide an invalid configuration, but cannot
 completely be relied on because it:
 
 * Is not guaranteed to be present or up to date in all clusters.
@@ -180,4 +180,4 @@ API. That process would involve:
 This is potentially the most complex of all the options presented. It would
 effectively require us to consistently maintain an alpha API version. Of all the
 options presented, this is probably the most likely to confuse users and
-implementers of the API.
\ No newline at end of file
+implementers of the API.
diff --git a/geps/gep-957/index.md b/geps/gep-957/index.md
index f4de43e3..d2f3ead5 100644
--- a/geps/gep-957/index.md
+++ b/geps/gep-957/index.md
@@ -120,14 +120,14 @@ spec:
 Port matching can be supported if SectionName accepts port numbers in addition
 to listener names. This approach results in a less explicit API when a ParentRef
 points to a resource that is not `Gateway`. For example, an implementation may
-attach a route to an `Mesh` CRD. In this case, it's less inituitive to set
+attach a route to an `Mesh` CRD. In this case, it's less intuitive to set
 `ParentRef.SectionName` to `443` to express `route all traffic whose destination
 port is 443 to ...`. It also complicates the validation on SectionName in order
 to differentiate between a listener name and a port number.
 
 ### 2. Update TrafficMatches to support port matching
 TrafficMatches was proposed in
-[gep-735](https://gateway-api.sigs.k8s.io/geps/gep-735/) to support TCP and UDP
+[gep-735](../gep-735/index.md) to support TCP and UDP
 address matching. TrafficMatches can be extended to support port matching.
 TrafficMatches will need to be added to HTTPRoute/TLSRoute if the feature is
 desired there.
diff --git a/geps/gep-995/index.md b/geps/gep-995/index.md
index e74c9ae0..6236d1a2 100644
--- a/geps/gep-995/index.md
+++ b/geps/gep-995/index.md
@@ -5,11 +5,11 @@
 
 ## TLDR
 
-Add a new optional `name` field to the route rule types ([GRPCRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.GRPCRouteRule), [HTTPRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteRule), [TCPRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.TCPRouteRule), [TLSRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.TLSRouteRule) and [UDPRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.UDPRouteRule)) to support referencing individual rules by name.
+Add a new optional `name` field to the route rule types ([GRPCRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.GRPCRouteRule), [HTTPRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteRule), [TCPRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.TCPRouteRule), [TLSRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.TLSRouteRule) and [UDPRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.UDPRouteRule)) to support referencing individual rules by name.
 
 ## Goals
 
-* Support referencing individual route rules by name from other resources, such as from metaresources ([GEP-2648](https://gateway-api.sigs.k8s.io/geps/gep-2648/#apply-policies-to-sections-of-a-resource).)
+* Support referencing individual route rules by name from other resources, such as from metaresources ([GEP-2648](../gep-2648/index.md#apply-policies-to-sections-of-a-resource).)
 * Support referencing individual route rules by name from condition messages propagated in the status stanza of route resources as suggested in https://github.com/kubernetes-sigs/gateway-api/issues/1696#issuecomment-1666258188.
 * Support referencing individual route rules by name at other observability and networking tools that are part of the ecosystem based on Gateway API.
 * Provide a rather intuitive API for users of Kubernetes who are familiar with the same pattern employed already by other kinds of resources where lists of complex elements can be declared – e.g. service [ports](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#ServiceSpec), pod [containers](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#containers) and pod [volumes](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes).
@@ -23,13 +23,13 @@ Add a new optional `name` field to the route rule types ([GRPCRouteRule](https:/
 
 ## Introduction
 
-Some kinds of Gateway API types are complex types that support specifying lists of yet other complex object details within them. Examples include the [`GatewaySpec`](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.GatewaySpec) type, the [`HTTPRouteSpec`](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteSpec) type, as well as other kinds of route specification types. Specifically, `Gateway` objects can declare multiple complex listener details (`spec.listeners`); similarly, `HTTPRoute` objects may contain multiple complex routing rule details (`spec.rules`).
+Some kinds of Gateway API types are complex types that support specifying lists of yet other complex object details within them. Examples include the [`GatewaySpec`](../../reference/spec.md#gateway.networking.k8s.io/v1.GatewaySpec) type, the [`HTTPRouteSpec`](../../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteSpec) type, as well as other kinds of route specification types. Specifically, `Gateway` objects can declare multiple complex listener details (`spec.listeners`); similarly, `HTTPRoute` objects may contain multiple complex routing rule details (`spec.rules`).
 
 Even with a limited number of elements declared within those lists of resource specification details, without a field that works as a unique identifier of each element (e.g., a `name` field), referring individual ones can often lead to implementations that are inconsistent, complex, and error-prone. This is an issue for any kind of referencing pattern, including for Policy Attachment, status reporting, event logging, etc.
 
 Referencing list elements without a unique identifier is also prone to execution errors, either when relying on how the elements are sorted in the list (i.e., based on the index) or on partial or total repetition of values of the referents. The order of elements within a list may change without necessarily any semantic reason. Complex elements can sometimes differ only subtly from each other, thus easily being overlooked when making the reference and resulting in a higher chance of typos and/or references that are possibly ambiguous or broken. In both cases, such references are fragile and can result in unexpected errors.
 
-For the `Gateway` resource, problems above were addressed/mitigated by adding a `name` field to the [`Listener`](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Listener) type ([#724](https://github.com/kubernetes-sigs/gateway-api/issues/).) Listener names are required and must be unique of each listener declared in a gateway. This allowed for more explicit route and policy attachment relying on _sectionName_, as well as it opened for better implementation of status reporting and log recording of events related to specific gateway listeners.
+For the `Gateway` resource, problems above were addressed/mitigated by adding a `name` field to the [`Listener`](../../reference/spec.md#gateway.networking.k8s.io/v1.Listener) type ([#724](https://github.com/kubernetes-sigs/gateway-api/issues/).) Listener names are required and must be unique of each listener declared in a gateway. This allowed for more explicit route and policy attachment relying on _sectionName_, as well as it opened for better implementation of status reporting and log recording of events related to specific gateway listeners.
 
 In general, declaring explicit names for complex list elements is a common pattern in Kubernetes, observed in several other APIs. Examples include [containers](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#containers) and [volumes](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes) of a Pod, [ports](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#ServiceSpec) of a Service, and many others.
 
@@ -37,7 +37,7 @@ This GEP aims to rollout the same pattern of declarative `name` fields of these
 
 ## API
 
-This GEP proposes to add a new optional `name` field to the [GRPCRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.GRPCRouteRule), [HTTPRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteRule), [TCPRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.TCPRouteRule), [TLSRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.TLSRouteRule) and [UDPRouteRule](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.UDPRouteRule) types.
+This GEP proposes to add a new optional `name` field to the [GRPCRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.GRPCRouteRule), [HTTPRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteRule), [TCPRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.TCPRouteRule), [TLSRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.TLSRouteRule) and [UDPRouteRule](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.UDPRouteRule) types.
 
 ### Format
 
@@ -50,7 +50,7 @@ If specified, the name of a route rule MUST comply with the [`SectionName`](http
 
 To preserve backward compatibility with previous version of the affected APIs, the `name` field for route rules should be introduced in the API as optional – i.e., end-user are not forced to add it to their existing or new route objects.
 
-Implementations MAY recomend the usage of the `name` field for enabling specific features, such as for supporting policy attachment targetting individual route rules, and more assertive log messages and/or status reporting that include on the name of the rule. However, because as by API design the presence of the field is optional, implementations MUST take into account that a value may sometimes not be available. For such cases, implementations are free to decide whether to provide the feature depending the `name` field, if the feature is not required for Core compliance, or to enable the feature relying on another method of referencing of choice.
+Implementations MAY recommend the usage of the `name` field for enabling specific features, such as for supporting policy attachment targeting individual route rules, and more assertive log messages and/or status reporting that include on the name of the rule. However, because as by API design the presence of the field is optional, implementations MUST take into account that a value may sometimes not be available. For such cases, implementations are free to decide whether to provide the feature depending the `name` field, if the feature is not required for Core compliance, or to enable the feature relying on another method of referencing of choice.
 
 ### Default value
 
diff --git a/geps/overview.md b/geps/overview.md
index 74fed428..808cdb0a 100644
--- a/geps/overview.md
+++ b/geps/overview.md
@@ -59,7 +59,7 @@ of stability of the change described in the GEP:
 
   * **Provisional:** The goals described by this GEP have consensus but
     implementation details have not been agreed to yet.
-  * **Prototyping:** An extension of `Provisional` which can be opted in to in
+  * **Prototyping:** An optional extension of `Provisional` in
     order to indicate to the community that there are some active practical tests
     and experiments going on which are intended to be a part of the development
     of this GEP. This may include APIs or code, but that content _must_ not be
@@ -105,7 +105,7 @@ several places this may be done:
 
 - A [new GitHub Discussion](https://github.com/kubernetes-sigs/gateway-api/discussions/new)
 - On our [Slack Channel](https://kubernetes.slack.com/archives/CR0H13KGA)
-- On one of our [community meetings](https://gateway-api.sigs.k8s.io/contributing/?h=meetings#meetings)
+- On one of our [community meetings](../contributing/index.md?h=meetings#meetings)
 
 Please default to GitHub discussions: they work a lot like GitHub issues which
 makes them easy to search.
@@ -188,7 +188,7 @@ maintainers.
 
 ### 5. Graduate the GEP to "Standard"
 
-Once this feature has met the [graduation criteria](/concepts/versioning/#graduation-criteria), it is
+Once this feature has met the [graduation criteria](../concepts/versioning.md#graduation-criteria), it is
 time to graduate it to the "Standard" channel of the API. Depending on the feature, this may include
 any of the following:
 
@@ -208,7 +208,7 @@ that means for that GEP).
 
 ## Format
 
-GEPs should match the format of the template found in [GEP-696](/geps/gep-696).
+GEPs should match the format of the template found in [GEP-696](gep-696/index.md).
 
 ## Out of scope
 
diff --git a/go.mod b/go.mod
index bdcec2ca..6b4994a1 100644
--- a/go.mod
+++ b/go.mod
@@ -6,11 +6,11 @@ require (
 	github.com/ahmetb/gen-crd-api-reference-docs v0.3.0
 	github.com/miekg/dns v1.1.63
 	github.com/stretchr/testify v1.10.0
-	golang.org/x/net v0.34.0
-	golang.org/x/sync v0.10.0
-	google.golang.org/grpc v1.70.0
+	golang.org/x/net v0.35.0
+	golang.org/x/sync v0.11.0
+	google.golang.org/grpc v1.71.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
-	google.golang.org/protobuf v1.36.4
+	google.golang.org/protobuf v1.36.5
 	k8s.io/api v0.31.3
 	k8s.io/apiextensions-apiserver v0.31.3
 	k8s.io/apimachinery v0.31.3
@@ -62,13 +62,13 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f // indirect
 	golang.org/x/mod v0.21.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
-	golang.org/x/sys v0.29.0 // indirect
-	golang.org/x/term v0.28.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
+	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/term v0.29.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.26.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
diff --git a/go.sum b/go.sum
index 97ba7b1a..f1bb27b9 100644
--- a/go.sum
+++ b/go.sum
@@ -128,16 +128,18 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opentelemetry.io/otel v1.32.0 h1:WnBN+Xjcteh0zdk01SVqV55d/m62NJLJdIyb4y/WO5U=
-go.opentelemetry.io/otel v1.32.0/go.mod h1:00DCVSB0RQcnzlwyTfqtxSm+DRr9hpYrHjNGiBHVQIg=
-go.opentelemetry.io/otel/metric v1.32.0 h1:xV2umtmNcThh2/a/aCP+h64Xx5wsj8qqnkYZktzNa0M=
-go.opentelemetry.io/otel/metric v1.32.0/go.mod h1:jH7CIbbK6SH2V2wE16W05BHCtIDzauciCRLoc/SyMv8=
-go.opentelemetry.io/otel/sdk v1.32.0 h1:RNxepc9vK59A8XsgZQouW8ue8Gkb4jpWtJm9ge5lEG4=
-go.opentelemetry.io/otel/sdk v1.32.0/go.mod h1:LqgegDBjKMmb2GC6/PrTnteJG39I8/vJCAP9LlJXEjU=
-go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
-go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
-go.opentelemetry.io/otel/trace v1.32.0 h1:WIC9mYrXf8TmY/EXuULKc8hR17vE+Hjv2cssQDe03fM=
-go.opentelemetry.io/otel/trace v1.32.0/go.mod h1:+i4rkvCraA+tG6AzwloGaCtkx53Fa+L+V8e9a7YvhT8=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
+go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
+go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
+go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
+go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
+go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
+go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
+go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
+go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
+go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
@@ -155,28 +157,28 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
+golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
-golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
+golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
+golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
+golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -190,14 +192,14 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a h1:hgh8P4EuoxpsuKMXX/To36nOFD7vixReXgn8lPGnt+o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
-google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
-google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f h1:OxYkA3wjPsZyBylwymxSHa7ViiW1Sml4ToBrncvFehI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:+2Yz8+CLJbIfL9z73EW45avw8Lmge3xVElCP9zEKi50=
+google.golang.org/grpc v1.71.0 h1:kF77BGdPTQ4/JZWMlb9VpJ5pa25aqvVqogsxNHHdeBg=
+google.golang.org/grpc v1.71.0/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
-google.golang.org/protobuf v1.36.4 h1:6A3ZDJHn/eNqc1i+IdefRzy/9PokBTPvcqMySR7NNIM=
-google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/hack/implementations/envoy-gateway/README.md b/hack/implementations/envoy-gateway/README.md
index d1c5c5c7..fa118ddb 100644
--- a/hack/implementations/envoy-gateway/README.md
+++ b/hack/implementations/envoy-gateway/README.md
@@ -1,6 +1,6 @@
 # Running Conformance Tests for Envoy Gateway
 
-## Prerequisities
+## Prerequisites
 
 Make sure you have these tools installed
 
diff --git a/hack/invalid-examples/standard/httproute/invalid-httredirect-hostname.yaml b/hack/invalid-examples/standard/httproute/invalid-httpredirect-hostname.yaml
similarity index 100%
rename from hack/invalid-examples/standard/httproute/invalid-httredirect-hostname.yaml
rename to hack/invalid-examples/standard/httproute/invalid-httpredirect-hostname.yaml
diff --git a/hack/mkdocs-copy-geps.py b/hack/mkdocs-copy-geps.py
index 4ee4d846..90566ccc 100644
--- a/hack/mkdocs-copy-geps.py
+++ b/hack/mkdocs-copy-geps.py
@@ -15,11 +15,50 @@
 import shutil
 import logging
 from mkdocs import plugins
+from mkdocs.structure.files import File
+from pathlib import Path
 
-log = logging.getLogger('mkdocs')
+log = logging.getLogger(f'mkdocs.plugins.{__name__}')
 
 
 @plugins.event_priority(100)
-def on_pre_build(config, **kwargs):
-    log.info("copying geps")
-    shutil.copytree("geps", "site-src/geps", dirs_exist_ok=True)
+def on_files(files, config, **kwargs):
+    log.info("adding geps")
+
+    # Check if site-src/geps exists (files copied out-of-band from MkDocs)
+    site_src_geps = Path('site-src/geps')
+    if site_src_geps.exists() and site_src_geps.is_dir():
+      log.info("Found site-src/gep/ directory. Deleting...")
+
+      # Iterate over the list of files in this directory and remove them from
+      # MkDocs
+      for root_dir, _, gep_files  in Path(site_src_geps).walk():
+        for filename in gep_files:
+          # Exclude the leading 'site-src/' to get the relative path as it
+          # exists on the site. (i.e., geps/overview.md)
+          path = '/'.join(root_dir.parts[1:])
+
+          existing_file = files.get_file_from_path(f'{path}/{filename}')
+          if existing_file:
+            files.remove(existing_file)
+
+      # Delete the 'site-src/geps' directory
+      shutil.rmtree(site_src_geps)
+
+    for root_dir, _, gep_files in Path('geps').walk():
+
+      # Iterate over the all the files in the GEP folder and add them to the site
+      for filename in gep_files:
+        file_path = str(root_dir / filename)
+
+        if files.get_file_from_path(file_path) is None:
+          new_file = File(
+            path=file_path,
+            src_dir='./',
+            dest_dir=config['site_dir'],
+            use_directory_urls=config['use_directory_urls']
+          )
+
+          files.append(new_file)
+
+    return files
diff --git a/hack/mkdocs-generate-conformance.py b/hack/mkdocs-generate-conformance.py
index 1328f7d0..c64c1350 100644
--- a/hack/mkdocs-generate-conformance.py
+++ b/hack/mkdocs-generate-conformance.py
@@ -13,26 +13,41 @@
 # limitations under the License.
 
 import logging
+from io import StringIO
 from mkdocs import plugins
+from mkdocs.structure.files import File
 import yaml
 import pandas
 from fnmatch import fnmatch
 import glob
 import os
 
-log = logging.getLogger('mkdocs')
+log = logging.getLogger(f'mkdocs.plugins.{__name__}')
 
 
 @plugins.event_priority(100)
-def on_pre_build(config, **kwargs):
+def on_files(files, config, **kwargs):
     log.info("generating conformance")
 
     vers = getConformancePaths()
+    # Iterate over the list of versions. Exclude the pre 1.0 versions.
     for v in vers[3:]:
 
         confYamls = getYaml(v)
         releaseVersion = v.split(os.sep)[-2]
-        generate_conformance_tables(confYamls, releaseVersion)
+        file = generate_conformance_tables(confYamls, releaseVersion, config)
+
+        if file:
+          existing_file = files.get_file_from_path(file.src_uri)
+          if existing_file:
+              # Remove the existing file that is likely present in the
+              # repository
+              files.remove(existing_file)
+
+          # Add the generated file to the site
+          files.append(file)
+
+    return files
 
 
 desc = """
@@ -51,7 +66,10 @@ warning_text = """
 
 
 
-def generate_conformance_tables(reports, currVersion):
+def generate_conformance_tables(reports, currVersion, mkdocsConfig):
+
+    # Enable Pandas copy-on-write
+    pandas.options.mode.copy_on_write = True
 
     gateway_tls_table = pandas.DataFrame()
     gateway_grpc_table = pandas.DataFrame()
@@ -79,7 +97,8 @@ def generate_conformance_tables(reports, currVersion):
     if entries.Project < 3:
         return
 
-    with open('site-src/implementations/'+versionFile+'.md', 'w') as f:
+    try:
+        f = StringIO()
 
         f.write(desc)
         f.write("\n\n")
@@ -90,7 +109,7 @@ def generate_conformance_tables(reports, currVersion):
         f.write("## Gateway Profile\n\n")
         f.write("### HTTPRoute\n\n")
         f.write(gateway_http_table.to_markdown()+'\n\n')
-        if currVersion != 'v1.0.0': 
+        if currVersion != 'v1.0.0':
             f.write('### GRPCRoute\n\n')
             f.write(gateway_grpc_table.to_markdown()+'\n\n')
             f.write('### TLSRoute\n\n')
@@ -100,6 +119,20 @@ def generate_conformance_tables(reports, currVersion):
         f.write("### HTTPRoute\n\n")
         f.write(mesh_http_table.to_markdown())
 
+        file_contents = f.getvalue()
+    finally:
+        f.close()
+
+    new_file = File(
+      src_dir=None,
+      dest_dir=mkdocsConfig['site_dir'],
+      path=f'implementations/{versionFile}.md',
+      use_directory_urls=mkdocsConfig['use_directory_urls'],
+    )
+    new_file.content_string = file_contents
+    new_file.generated_by = f'{__name__}'
+
+    return new_file
 
 def generate_profiles_report(reports, route,version):
 
@@ -114,7 +147,7 @@ def generate_profiles_report(reports, route,version):
                                'version','mode', 'extended.supportedFeatures']].T
     http_table.columns = http_table.iloc[0]
     http_table = http_table[1:].T
-    
+
     for row in http_table.itertuples():
         if type(row._4) is list:
             for feat in row._4:
@@ -130,8 +163,8 @@ def generate_profiles_report(reports, route,version):
 
 
 pathTemp = "conformance/reports/*/"
-allVersions = []
-reportedImplementationsPath = []
+allVersions = set()
+reportedImplementationsPath = set()
 
 # returns v1.0.0 and greater, since that's when reports started being generated in the comparison table
 
@@ -141,9 +174,10 @@ def getConformancePaths():
     report_path = versions[-1]+"**"
     for v in versions:
         vers = v.split(os.sep)[-2]
-        allVersions.append(vers)
-        reportedImplementationsPath.append(v+"**")
-    return reportedImplementationsPath
+        allVersions.add(vers)
+        reportedImplementationsPath.add(v+"**")
+
+    return sorted(list(reportedImplementationsPath))
 
 
 def getYaml(conf_path):
@@ -154,11 +188,12 @@ def getYaml(conf_path):
         if fnmatch(p, "*.yaml"):
 
             x = load_yaml(p)
-            profiles = pandas.json_normalize(
-                x, record_path=['profiles'], meta=["mode","implementation"], errors='ignore')
+            if 'profiles' in x:
+              profiles = pandas.json_normalize(
+                  x, record_path=['profiles'], meta=["mode","implementation"], errors='ignore')
 
-            implementation = pandas.json_normalize(profiles.implementation)
-            yamls.append(pandas.concat([implementation, profiles], axis=1))
+              implementation = pandas.json_normalize(profiles.implementation)
+              yamls.append(pandas.concat([implementation, profiles], axis=1))
 
     yamls = pandas.concat(yamls)
     return yamls
diff --git a/hack/update-clientset.sh b/hack/update-clientset.sh
new file mode 100755
index 00000000..d36dbd8f
--- /dev/null
+++ b/hack/update-clientset.sh
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# https://github.com/kubernetes/code-generator provides generator code to generate a custom typed
+# and versioned client for custom API types similar to what https://github.com/kubernetes/client-go
+# provides for core types. This script generates such a client for the Gateway API types, in service of any
+# projects that need them.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+
+readonly SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE}")"/.. && pwd)"
+
+if [[ "${VERIFY_CODEGEN:-}" == "true" ]]; then
+  echo "Running in verification mode"
+  readonly VERIFY_FLAG="--verify-only"
+fi
+
+readonly COMMON_FLAGS="${VERIFY_FLAG:-} --go-header-file ${SCRIPT_ROOT}/hack/boilerplate/boilerplate.generatego.txt"
+
+readonly APIS_PKG=sigs.k8s.io/gateway-api
+readonly CLIENTSET_NAME=versioned
+readonly CLIENTSET_PKG_NAME=clientset
+readonly OUTPUT_DIR=pkg/client
+readonly OUTPUT_PKG=sigs.k8s.io/gateway-api/pkg/client
+readonly API_PATHS=(apis apisx)
+
+GATEWAY_INPUT_DIRS_SPACE=""
+GATEWAY_INPUT_DIRS_COMMA=""
+
+for API_PATH in "${API_PATHS[@]}"; do
+  VERSIONS=($(find ./${API_PATH} -maxdepth 1 -name "v*" -exec bash -c 'basename {}' \; | LC_ALL=C sort -u))
+  for VERSION in "${VERSIONS[@]}"; do
+    GATEWAY_INPUT_DIRS_SPACE+="${APIS_PKG}/${API_PATH}/${VERSION} "
+    GATEWAY_INPUT_DIRS_COMMA+="${APIS_PKG}/${API_PATH}/${VERSION},"
+  done
+done
+GATEWAY_INPUT_DIRS_SPACE="${GATEWAY_INPUT_DIRS_SPACE%,}" # drop trailing space
+GATEWAY_INPUT_DIRS_COMMA="${GATEWAY_INPUT_DIRS_COMMA%,}" # drop trailing comma
+
+# throw away
+new_report="$(mktemp -t "$(basename "$0").api_violations.XXXXXX")"
+
+echo "Generating openapi schema"
+go run k8s.io/kube-openapi/cmd/openapi-gen \
+  --output-file zz_generated.openapi.go \
+  --report-filename "${new_report}" \
+  --output-dir "pkg/generated/openapi" \
+  --output-pkg "sigs.k8s.io/gateway-api/pkg/generated/openapi" \
+  ${COMMON_FLAGS} \
+  $GATEWAY_INPUT_DIRS_SPACE \
+  k8s.io/apimachinery/pkg/apis/meta/v1 \
+  k8s.io/apimachinery/pkg/runtime \
+  k8s.io/apimachinery/pkg/version
+
+
+echo "Generating apply configuration"
+go run k8s.io/code-generator/cmd/applyconfiguration-gen \
+  --openapi-schema <(go run ${SCRIPT_ROOT}/cmd/modelschema) \
+  --output-dir "applyconfiguration" \
+  --output-pkg "${APIS_PKG}/applyconfiguration" \
+  ${COMMON_FLAGS} \
+  ${GATEWAY_INPUT_DIRS_SPACE}
+
+echo "Generating clientset at ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME}"
+go run k8s.io/code-generator/cmd/client-gen \
+  --clientset-name "${CLIENTSET_NAME}" \
+  --input-base "${APIS_PKG}" \
+  --input "${GATEWAY_INPUT_DIRS_COMMA//${APIS_PKG}/}" \
+  --output-dir "${OUTPUT_DIR}/${CLIENTSET_PKG_NAME}" \
+  --output-pkg "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME}" \
+  --apply-configuration-package "${APIS_PKG}/applyconfiguration" \
+  ${COMMON_FLAGS}
+
+echo "Generating listers at ${OUTPUT_PKG}/listers"
+go run k8s.io/code-generator/cmd/lister-gen \
+  --output-dir "${OUTPUT_DIR}/listers" \
+  --output-pkg "${OUTPUT_PKG}/listers" \
+  ${COMMON_FLAGS} \
+  ${GATEWAY_INPUT_DIRS_SPACE}
+
+echo "Generating informers"
+go run k8s.io/code-generator/cmd/informer-gen \
+  --versioned-clientset-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME}/${CLIENTSET_NAME}" \
+  --listers-package "${OUTPUT_PKG}/listers" \
+  --output-dir "${OUTPUT_DIR}/informers" \
+  --output-pkg "${OUTPUT_PKG}/informers" \
+  ${COMMON_FLAGS} \
+  ${GATEWAY_INPUT_DIRS_SPACE}
+
+echo "Generating register helpers"
+go run k8s.io/code-generator/cmd/register-gen \
+  --output-file zz_generated.register.go \
+  ${COMMON_FLAGS} \
+  ${GATEWAY_INPUT_DIRS_SPACE}
+
+echo "Generating deepcopy"
+go run sigs.k8s.io/controller-tools/cmd/controller-gen \
+  object:headerFile=${SCRIPT_ROOT}/hack/boilerplate/boilerplate.generatego.txt \
+  paths="./apis/..." \
+  paths="./apisx/..."
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index 2608fc2c..23862dbb 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -46,202 +46,8 @@ export GOMODCACHE GO111MODULE GOFLAGS GOPATH
 mkdir -p "$GOPATH/src/sigs.k8s.io"
 ln -s "${SCRIPT_ROOT}" "$GOPATH/src/sigs.k8s.io/gateway-api"
 
-readonly OUTPUT_PKG=sigs.k8s.io/gateway-api/pkg/client
-readonly APIS_PKG=sigs.k8s.io/gateway-api
-readonly CLIENTSET_NAME=versioned
-readonly CLIENTSET_PKG_NAME=clientset
-readonly VERSIONS=(v1alpha2 v1alpha3 v1beta1 v1)
-
-GATEWAY_INPUT_DIRS_SPACE=""
-GATEWAY_INPUT_DIRS_COMMA=""
-for VERSION in "${VERSIONS[@]}"
-do
-  GATEWAY_INPUT_DIRS_SPACE+="${APIS_PKG}/apis/${VERSION} "
-  GATEWAY_INPUT_DIRS_COMMA+="${APIS_PKG}/apis/${VERSION},"
-done
-GATEWAY_INPUT_DIRS_SPACE="${GATEWAY_INPUT_DIRS_SPACE%,}" # drop trailing space
-GATEWAY_INPUT_DIRS_COMMA="${GATEWAY_INPUT_DIRS_COMMA%,}" # drop trailing comma
-
-
-if [[ "${VERIFY_CODEGEN:-}" == "true" ]]; then
-  echo "Running in verification mode"
-  readonly VERIFY_FLAG="--verify-only"
-fi
-
-readonly COMMON_FLAGS="${VERIFY_FLAG:-} --go-header-file ${SCRIPT_ROOT}/hack/boilerplate/boilerplate.generatego.txt"
-
 echo "Generating CRDs"
 go run ./pkg/generator
 
-# throw away
-new_report="$(mktemp -t "$(basename "$0").api_violations.XXXXXX")"
-
-echo "Generating openapi schema"
-go run k8s.io/kube-openapi/cmd/openapi-gen \
-  --output-file zz_generated.openapi.go \
-  --report-filename "${new_report}" \
-  --output-dir "pkg/generated/openapi" \
-  --output-pkg "sigs.k8s.io/gateway-api/pkg/generated/openapi" \
-  ${COMMON_FLAGS} \
-  $GATEWAY_INPUT_DIRS_SPACE \
-  k8s.io/apimachinery/pkg/apis/meta/v1 \
-  k8s.io/apimachinery/pkg/runtime \
-  k8s.io/apimachinery/pkg/version
-
-
-echo "Generating apply configuration"
-go run k8s.io/code-generator/cmd/applyconfiguration-gen \
-  --openapi-schema <(go run ${SCRIPT_ROOT}/cmd/modelschema) \
-  --output-dir "apis/applyconfiguration" \
-  --output-pkg "${APIS_PKG}/apis/applyconfiguration" \
-  ${COMMON_FLAGS} \
-  ${GATEWAY_INPUT_DIRS_SPACE}
-
-
-# Temporary hack until https://github.com/kubernetes/kubernetes/pull/124371 is released
-function fix_applyconfiguration() {
-  local package="$1"
-  local version="$(basename $1)"
-
-  echo $package
-  echo $version
-  pushd $package > /dev/null
-
-  # Replace import
-  for filename in *.go; do
-    import_line=$(grep "$package" "$filename")
-    if [[ -z "$import_line" ]]; then
-      continue
-    fi
-    import_prefix=$(echo "$import_line" | awk '{print $1}')
-    sed -i'.bak' -e "s,${import_prefix} \"sigs.k8s.io/gateway-api/${package}\",,g" "$filename"
-    sed -i'.bak' -e "s,\[\]${import_prefix}\.,\[\],g" "$filename"
-    sed -i'.bak' -e "s,&${import_prefix}\.,&,g" "$filename"
-    sed -i'.bak' -e "s,*${import_prefix}\.,*,g" "$filename"
-    sed -i'.bak' -e "s,^\t${import_prefix}\.,,g" "$filename"
-  done
-
-  rm *.bak
-  go fmt .
-  find . -type f -name "*.go" -exec sed -i'.bak' -e "s,import (),,g" {} \;
-  rm *.bak
-  go fmt .
-
-  popd > /dev/null
-}
-
-export -f fix_applyconfiguration
-find apis/applyconfiguration/apis -name "v*" -type d -exec bash -c 'fix_applyconfiguration $0' {} \;
-
-echo "Generating clientset at ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME}"
-go run k8s.io/code-generator/cmd/client-gen \
-  --clientset-name "${CLIENTSET_NAME}" \
-  --input-base "${APIS_PKG}" \
-  --input "${GATEWAY_INPUT_DIRS_COMMA//${APIS_PKG}/}" \
-  --output-dir "pkg/client/${CLIENTSET_PKG_NAME}" \
-  --output-pkg "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME}" \
-  --apply-configuration-package "${APIS_PKG}/apis/applyconfiguration" \
-  ${COMMON_FLAGS}
-
-echo "Generating listers at ${OUTPUT_PKG}/listers"
-go run k8s.io/code-generator/cmd/lister-gen \
-  --output-dir "pkg/client/listers" \
-  --output-pkg "${OUTPUT_PKG}/listers" \
-  ${COMMON_FLAGS} \
-  ${GATEWAY_INPUT_DIRS_SPACE}
-
-echo "Generating informers at ${OUTPUT_PKG}/informers"
-go run k8s.io/code-generator/cmd/informer-gen \
-  --versioned-clientset-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME}/${CLIENTSET_NAME}" \
-  --listers-package "${OUTPUT_PKG}/listers" \
-  --output-dir "pkg/client/informers" \
-  --output-pkg "${OUTPUT_PKG}/informers" \
-  ${COMMON_FLAGS} \
-  ${GATEWAY_INPUT_DIRS_SPACE}
-
-echo "Generating ${VERSION} register at ${APIS_PKG}/apis/${VERSION}"
-go run k8s.io/code-generator/cmd/register-gen \
-  --output-file zz_generated.register.go \
-  ${COMMON_FLAGS} \
-  ${GATEWAY_INPUT_DIRS_SPACE}
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Generating ${VERSION} deepcopy at ${APIS_PKG}/apis/${VERSION}"
-  go run sigs.k8s.io/controller-tools/cmd/controller-gen \
-    object:headerFile=${SCRIPT_ROOT}/hack/boilerplate/boilerplate.generatego.txt \
-    paths="${APIS_PKG}/apis/${VERSION}"
-done
-
-echo "Generating gRPC/Protobuf code"
-
-readonly PROTOC_CACHE_DIR="/tmp/protoc.cache"
-readonly PROTOC_BINARY="${PROTOC_CACHE_DIR}/bin/protoc"
-readonly PROTOC_VERSION="22.2"
-readonly PROTOC_REPO="https://github.com/protocolbuffers/protobuf"
-
-readonly PROTOC_LINUX_X86_URL="${PROTOC_REPO}/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-x86_64.zip"
-readonly PROTOC_LINUX_X86_CHECKSUM="4805ba56594556402a6c327a8d885a47640ee363  ${PROTOC_BINARY}"
-
-readonly PROTOC_LINUX_ARM64_URL="${PROTOC_REPO}/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-aarch_64.zip"
-readonly PROTOC_LINUX_ARM64_CHECKSUM="47285b2386f990da319e9eef92cadec2dfa28733  ${PROTOC_BINARY}"
-
-readonly PROTOC_MAC_UNIVERSAL_URL="${PROTOC_REPO}/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-osx-universal_binary.zip"
-readonly PROTOC_MAC_UNIVERSAL_CHECKSUM="2a79d0eb235c808eca8de893762072b94dc6144c  ${PROTOC_BINARY}"
-
-PROTOC_URL=""
-PROTOC_CHECKSUM=""
-
-ARCH=$(uname -m)
-OS=$(uname)
-
-if [[ "${OS}" != "Linux" ]] && [[ "${OS}" != "Darwin" ]]; then
-  echo "Unsupported operating system ${OS}" >/dev/stderr
-  exit 1
-fi
-
-if [[ "${OS}" == "Linux" ]]; then
-  if [[ "$ARCH" == "x86_64" ]]; then
-    PROTOC_URL="$PROTOC_LINUX_X86_URL"
-    PROTOC_CHECKSUM="$PROTOC_LINUX_X86_CHECKSUM"
-  elif [[ "$ARCH" == "arm64" ]]; then
-    PROTOC_URL="$PROTOC_LINUX_ARM64_URL"
-    PROTOC_CHECKSUM="$PROTOC_LINUX_ARM64_CHECKSUM"
-  elif [[ "$ARCH" == "aarch64" ]]; then
-    PROTOC_URL="$PROTOC_LINUX_ARM64_URL"
-    PROTOC_CHECKSUM="$PROTOC_LINUX_ARM64_CHECKSUM"
-  else
-    echo "Architecture ${ARCH} is not supported on OS ${OS}." >/dev/stderr
-    exit 1
-  fi
-elif [[ "${OS}" == "Darwin" ]]; then
-    PROTOC_URL="$PROTOC_MAC_UNIVERSAL_URL"
-    PROTOC_CHECKSUM="$PROTOC_MAC_UNIVERSAL_CHECKSUM"
-fi
-
-function verify_protoc {
-  if ! echo "${PROTOC_CHECKSUM}" | shasum -c >/dev/null; then
-    echo "Downloaded protoc binary failed checksum." >/dev/stderr
-    exit 1
-  fi
-}
-
-function ensure_protoc {
-  mkdir -p "${PROTOC_CACHE_DIR}"
-  if [ ! -f "${PROTOC_BINARY}" ]; then
-    curl -sL -o "${PROTOC_CACHE_DIR}/protoc.zip" "${PROTOC_URL}"
-    unzip -d "${PROTOC_CACHE_DIR}" "${PROTOC_CACHE_DIR}/protoc.zip"
-  fi
-  verify_protoc
-}
-
-ensure_protoc
-go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.28
-go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.2
-
-(cd conformance/echo-basic && \
-  export PATH="$PATH:$GOPATH/bin" && \
-  "${PROTOC_BINARY}" --go_out=grpcechoserver --go_opt=paths=source_relative \
-    --go-grpc_out=grpcechoserver --go-grpc_opt=paths=source_relative \
-    grpcecho.proto
-)
+./hack/update-clientset.sh
+./hack/update-protos.sh
diff --git a/hack/update-protos.sh b/hack/update-protos.sh
new file mode 100755
index 00000000..02828dbe
--- /dev/null
+++ b/hack/update-protos.sh
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+readonly SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE}")"/.. && pwd)"
+
+echo "Generating gRPC/Protobuf code"
+
+readonly PROTOC_CACHE_DIR="/tmp/protoc.cache"
+readonly PROTOC_BINARY="${PROTOC_CACHE_DIR}/bin/protoc"
+readonly PROTOC_VERSION="22.2"
+readonly PROTOC_REPO="https://github.com/protocolbuffers/protobuf"
+
+readonly PROTOC_LINUX_X86_URL="${PROTOC_REPO}/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-x86_64.zip"
+readonly PROTOC_LINUX_X86_CHECKSUM="4805ba56594556402a6c327a8d885a47640ee363  ${PROTOC_BINARY}"
+
+readonly PROTOC_LINUX_ARM64_URL="${PROTOC_REPO}/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-aarch_64.zip"
+readonly PROTOC_LINUX_ARM64_CHECKSUM="47285b2386f990da319e9eef92cadec2dfa28733  ${PROTOC_BINARY}"
+
+readonly PROTOC_MAC_UNIVERSAL_URL="${PROTOC_REPO}/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-osx-universal_binary.zip"
+readonly PROTOC_MAC_UNIVERSAL_CHECKSUM="2a79d0eb235c808eca8de893762072b94dc6144c  ${PROTOC_BINARY}"
+
+PROTOC_URL=""
+PROTOC_CHECKSUM=""
+
+ARCH=$(uname -m)
+OS=$(uname)
+
+if [[ "${OS}" != "Linux" ]] && [[ "${OS}" != "Darwin" ]]; then
+  echo "Unsupported operating system ${OS}" >/dev/stderr
+  exit 1
+fi
+
+if [[ "${OS}" == "Linux" ]]; then
+  if [[ "$ARCH" == "x86_64" ]]; then
+    PROTOC_URL="$PROTOC_LINUX_X86_URL"
+    PROTOC_CHECKSUM="$PROTOC_LINUX_X86_CHECKSUM"
+  elif [[ "$ARCH" == "arm64" ]]; then
+    PROTOC_URL="$PROTOC_LINUX_ARM64_URL"
+    PROTOC_CHECKSUM="$PROTOC_LINUX_ARM64_CHECKSUM"
+  elif [[ "$ARCH" == "aarch64" ]]; then
+    PROTOC_URL="$PROTOC_LINUX_ARM64_URL"
+    PROTOC_CHECKSUM="$PROTOC_LINUX_ARM64_CHECKSUM"
+  else
+    echo "Architecture ${ARCH} is not supported on OS ${OS}." >/dev/stderr
+    exit 1
+  fi
+elif [[ "${OS}" == "Darwin" ]]; then
+    PROTOC_URL="$PROTOC_MAC_UNIVERSAL_URL"
+    PROTOC_CHECKSUM="$PROTOC_MAC_UNIVERSAL_CHECKSUM"
+fi
+
+function verify_protoc {
+  if ! echo "${PROTOC_CHECKSUM}" | shasum -c >/dev/null; then
+    echo "Downloaded protoc binary failed checksum." >/dev/stderr
+    exit 1
+  fi
+}
+
+function ensure_protoc {
+  mkdir -p "${PROTOC_CACHE_DIR}"
+  if [ ! -f "${PROTOC_BINARY}" ]; then
+    curl -sL -o "${PROTOC_CACHE_DIR}/protoc.zip" "${PROTOC_URL}"
+    unzip -d "${PROTOC_CACHE_DIR}" "${PROTOC_CACHE_DIR}/protoc.zip"
+  fi
+  verify_protoc
+}
+
+ensure_protoc
+go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.28
+go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.2
+
+(cd conformance/echo-basic && \
+  export PATH="$PATH:$GOPATH/bin" && \
+  "${PROTOC_BINARY}" --go_out=grpcechoserver --go_opt=paths=source_relative \
+    --go-grpc_out=grpcechoserver --go-grpc_opt=paths=source_relative \
+    grpcecho.proto
+)
diff --git a/mkdocs.yml b/mkdocs.yml
index 607a131d..7efbbccf 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -3,7 +3,8 @@ repo_url: https://github.com/kubernetes-sigs/gateway-api
 repo_name: kubernetes-sigs/gateway-api
 site_dir: site
 docs_dir: site-src
-trademark: https://www.linuxfoundation.org/legal/trademark-usage
+extra:
+  trademark: https://www.linuxfoundation.org/legal/trademark-usage
 extra_css:
   - stylesheets/extra.css
 extra_javascript:
@@ -52,8 +53,8 @@ markdown_extensions:
   - admonition
   - meta
   - pymdownx.emoji:
-      emoji_index: !!python/name:materialx.emoji.twemoji
-      emoji_generator: !!python/name:materialx.emoji.to_svg
+      emoji_index: !!python/name:material.extensions.emoji.twemoji
+      emoji_generator: !!python/name:material.extensions.emoji.to_svg
   - pymdownx.details
   - pymdownx.highlight
   - pymdownx.inlinehilite
@@ -70,17 +71,17 @@ nav:
   - Overview:
     - Introduction: index.md
     - Concepts:
-        API Overview: concepts/api-overview.md
-        Conformance: concepts/conformance.md
-        Roles and Personas: concepts/roles-and-personas.md
-        Security Model: concepts/security-model.md
-        Tools: concepts/tooling.md
-        Use Cases: concepts/use-cases.md
-        Versioning: concepts/versioning.md
+      - API Overview: concepts/api-overview.md
+      - Conformance: concepts/conformance.md
+      - Roles and Personas: concepts/roles-and-personas.md
+      - Security Model: concepts/security-model.md
+      - Tools: concepts/tooling.md
+      - Use Cases: concepts/use-cases.md
+      - Versioning: concepts/versioning.md
     - Service Mesh:
-        Overview: mesh/index.md
-        GAMMA Initiative: mesh/gamma.md
-        Service Facets: mesh/service-facets.md
+      - Overview: mesh/index.md
+      - GAMMA Initiative: mesh/gamma.md
+      - Service Facets: mesh/service-facets.md
     - Implementations:
         - List: implementations.md
         - Comparisons:
@@ -122,25 +123,25 @@ nav:
   - Enhancements:
     - Overview: geps/overview.md
     - Provisional:
-      - geps/gep-91/index.md
       - geps/gep-1494/index.md
       - geps/gep-1651/index.md
-      - geps/gep-1713/index.md
-      - geps/gep-1867/index.md
+      - geps/gep-1767/index.md
       - geps/gep-2648/index.md
-      - geps/gep-2649/index.md
-      - geps/gep-3388/index.md
     - Implementable:
-      - geps/gep-3155/index.md
+      - geps/gep-91/index.md
+      - geps/gep-3567/index.md
+      - geps/gep-3388/index.md
     - Experimental:
       - geps/gep-995/index.md
       - geps/gep-1619/index.md
+      - geps/gep-1713/index.md
       - geps/gep-1731/index.md
       - geps/gep-1748/index.md
       - geps/gep-1897/index.md
       - geps/gep-2162/index.md
+      - geps/gep-2649/index.md
       - geps/gep-3155/index.md
-      - geps/gep-3171/index.md
+      - geps/gep-3567/index.md
     - Standard:
       - geps/gep-709/index.md
       - geps/gep-718/index.md
@@ -158,8 +159,10 @@ nav:
       - geps/gep-1709/index.md
       - geps/gep-1742/index.md
       - geps/gep-1762/index.md
+      - geps/gep-1867/index.md
       - geps/gep-1911/index.md
       - geps/gep-2257/index.md
+      - geps/gep-3171/index.md
     - Memorandum:
       - geps/gep-713/index.md
       - geps/gep-917/index.md
@@ -178,3 +181,6 @@ nav:
     - Enhancement Requests: contributing/enhancement-requests.md
     - Release Cycle: contributing/release-cycle.md
     - Contributor Ladder: contributing/contributor-ladder.md
+not_in_nav: |
+  /blog/*
+  /geps/gep-696/*
diff --git a/netlify.toml b/netlify.toml
index 5ff94e03..b8b4bfb6 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -3,7 +3,7 @@
     command = "make docs"
     publish = "site"
 [build.environment]
-    PYTHON_VERSION = "3.9"
+    PYTHON_VERSION = "3.12"
     GO_VERSION = "1.22.8"
 
 # Standard Netlify redirects
@@ -30,4 +30,4 @@
     from = "/geps/gep-1426"
     to = "/geps/gep-1294"
     status = 301
-    force = true
\ No newline at end of file
+    force = true
diff --git a/pkg/client/clientset/versioned/clientset.go b/pkg/client/clientset/versioned/clientset.go
index 116d5cca..c65cf8f5 100644
--- a/pkg/client/clientset/versioned/clientset.go
+++ b/pkg/client/clientset/versioned/clientset.go
@@ -29,23 +29,31 @@ import (
 	gatewayv1alpha2 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1alpha2"
 	gatewayv1alpha3 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1alpha3"
 	gatewayv1beta1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1beta1"
+	experimentalv1alpha1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apisx/v1alpha1"
 )
 
 type Interface interface {
 	Discovery() discovery.DiscoveryInterface
+	GatewayV1() gatewayv1.GatewayV1Interface
 	GatewayV1alpha2() gatewayv1alpha2.GatewayV1alpha2Interface
 	GatewayV1alpha3() gatewayv1alpha3.GatewayV1alpha3Interface
 	GatewayV1beta1() gatewayv1beta1.GatewayV1beta1Interface
-	GatewayV1() gatewayv1.GatewayV1Interface
+	ExperimentalV1alpha1() experimentalv1alpha1.ExperimentalV1alpha1Interface
 }
 
 // Clientset contains the clients for groups.
 type Clientset struct {
 	*discovery.DiscoveryClient
-	gatewayV1alpha2 *gatewayv1alpha2.GatewayV1alpha2Client
-	gatewayV1alpha3 *gatewayv1alpha3.GatewayV1alpha3Client
-	gatewayV1beta1  *gatewayv1beta1.GatewayV1beta1Client
-	gatewayV1       *gatewayv1.GatewayV1Client
+	gatewayV1            *gatewayv1.GatewayV1Client
+	gatewayV1alpha2      *gatewayv1alpha2.GatewayV1alpha2Client
+	gatewayV1alpha3      *gatewayv1alpha3.GatewayV1alpha3Client
+	gatewayV1beta1       *gatewayv1beta1.GatewayV1beta1Client
+	experimentalV1alpha1 *experimentalv1alpha1.ExperimentalV1alpha1Client
+}
+
+// GatewayV1 retrieves the GatewayV1Client
+func (c *Clientset) GatewayV1() gatewayv1.GatewayV1Interface {
+	return c.gatewayV1
 }
 
 // GatewayV1alpha2 retrieves the GatewayV1alpha2Client
@@ -63,9 +71,9 @@ func (c *Clientset) GatewayV1beta1() gatewayv1beta1.GatewayV1beta1Interface {
 	return c.gatewayV1beta1
 }
 
-// GatewayV1 retrieves the GatewayV1Client
-func (c *Clientset) GatewayV1() gatewayv1.GatewayV1Interface {
-	return c.gatewayV1
+// ExperimentalV1alpha1 retrieves the ExperimentalV1alpha1Client
+func (c *Clientset) ExperimentalV1alpha1() experimentalv1alpha1.ExperimentalV1alpha1Interface {
+	return c.experimentalV1alpha1
 }
 
 // Discovery retrieves the DiscoveryClient
@@ -112,6 +120,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset,
 
 	var cs Clientset
 	var err error
+	cs.gatewayV1, err = gatewayv1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
 	cs.gatewayV1alpha2, err = gatewayv1alpha2.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
@@ -124,7 +136,7 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset,
 	if err != nil {
 		return nil, err
 	}
-	cs.gatewayV1, err = gatewayv1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	cs.experimentalV1alpha1, err = experimentalv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -149,10 +161,11 @@ func NewForConfigOrDie(c *rest.Config) *Clientset {
 // New creates a new Clientset for the given RESTClient.
 func New(c rest.Interface) *Clientset {
 	var cs Clientset
+	cs.gatewayV1 = gatewayv1.New(c)
 	cs.gatewayV1alpha2 = gatewayv1alpha2.New(c)
 	cs.gatewayV1alpha3 = gatewayv1alpha3.New(c)
 	cs.gatewayV1beta1 = gatewayv1beta1.New(c)
-	cs.gatewayV1 = gatewayv1.New(c)
+	cs.experimentalV1alpha1 = experimentalv1alpha1.New(c)
 
 	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
 	return &cs
diff --git a/pkg/client/clientset/versioned/fake/clientset_generated.go b/pkg/client/clientset/versioned/fake/clientset_generated.go
index 7d165c93..ecf37e8b 100644
--- a/pkg/client/clientset/versioned/fake/clientset_generated.go
+++ b/pkg/client/clientset/versioned/fake/clientset_generated.go
@@ -24,7 +24,7 @@ import (
 	"k8s.io/client-go/discovery"
 	fakediscovery "k8s.io/client-go/discovery/fake"
 	"k8s.io/client-go/testing"
-	applyconfiguration "sigs.k8s.io/gateway-api/apis/applyconfiguration"
+	applyconfiguration "sigs.k8s.io/gateway-api/applyconfiguration"
 	clientset "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned"
 	gatewayv1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1"
 	fakegatewayv1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1/fake"
@@ -34,6 +34,8 @@ import (
 	fakegatewayv1alpha3 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1alpha3/fake"
 	gatewayv1beta1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1beta1"
 	fakegatewayv1beta1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1beta1/fake"
+	experimentalv1alpha1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apisx/v1alpha1"
+	fakeexperimentalv1alpha1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake"
 )
 
 // NewSimpleClientset returns a clientset that will respond with the provided objects.
@@ -122,6 +124,11 @@ var (
 	_ testing.FakeClient  = &Clientset{}
 )
 
+// GatewayV1 retrieves the GatewayV1Client
+func (c *Clientset) GatewayV1() gatewayv1.GatewayV1Interface {
+	return &fakegatewayv1.FakeGatewayV1{Fake: &c.Fake}
+}
+
 // GatewayV1alpha2 retrieves the GatewayV1alpha2Client
 func (c *Clientset) GatewayV1alpha2() gatewayv1alpha2.GatewayV1alpha2Interface {
 	return &fakegatewayv1alpha2.FakeGatewayV1alpha2{Fake: &c.Fake}
@@ -137,7 +144,7 @@ func (c *Clientset) GatewayV1beta1() gatewayv1beta1.GatewayV1beta1Interface {
 	return &fakegatewayv1beta1.FakeGatewayV1beta1{Fake: &c.Fake}
 }
 
-// GatewayV1 retrieves the GatewayV1Client
-func (c *Clientset) GatewayV1() gatewayv1.GatewayV1Interface {
-	return &fakegatewayv1.FakeGatewayV1{Fake: &c.Fake}
+// ExperimentalV1alpha1 retrieves the ExperimentalV1alpha1Client
+func (c *Clientset) ExperimentalV1alpha1() experimentalv1alpha1.ExperimentalV1alpha1Interface {
+	return &fakeexperimentalv1alpha1.FakeExperimentalV1alpha1{Fake: &c.Fake}
 }
diff --git a/pkg/client/clientset/versioned/fake/register.go b/pkg/client/clientset/versioned/fake/register.go
index 502a6efc..4a4e3f84 100644
--- a/pkg/client/clientset/versioned/fake/register.go
+++ b/pkg/client/clientset/versioned/fake/register.go
@@ -28,16 +28,18 @@ import (
 	gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gatewayv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 	gatewayv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	experimentalv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
 )
 
 var scheme = runtime.NewScheme()
 var codecs = serializer.NewCodecFactory(scheme)
 
 var localSchemeBuilder = runtime.SchemeBuilder{
+	gatewayv1.AddToScheme,
 	gatewayv1alpha2.AddToScheme,
 	gatewayv1alpha3.AddToScheme,
 	gatewayv1beta1.AddToScheme,
-	gatewayv1.AddToScheme,
+	experimentalv1alpha1.AddToScheme,
 }
 
 // AddToScheme adds all types of this clientset into the given scheme. This allows composition
diff --git a/pkg/client/clientset/versioned/scheme/register.go b/pkg/client/clientset/versioned/scheme/register.go
index c6eca7a8..673060f9 100644
--- a/pkg/client/clientset/versioned/scheme/register.go
+++ b/pkg/client/clientset/versioned/scheme/register.go
@@ -28,16 +28,18 @@ import (
 	gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gatewayv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 	gatewayv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	experimentalv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
 )
 
 var Scheme = runtime.NewScheme()
 var Codecs = serializer.NewCodecFactory(Scheme)
 var ParameterCodec = runtime.NewParameterCodec(Scheme)
 var localSchemeBuilder = runtime.SchemeBuilder{
+	gatewayv1.AddToScheme,
 	gatewayv1alpha2.AddToScheme,
 	gatewayv1alpha3.AddToScheme,
 	gatewayv1beta1.AddToScheme,
-	gatewayv1.AddToScheme,
+	experimentalv1alpha1.AddToScheme,
 }
 
 // AddToScheme adds all types of this clientset into the given scheme. This allows composition
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_gateway.go b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_gateway.go
index 38b4ec9c..7c85aa8e 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_gateway.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_gateway.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // FakeGateways implements GatewayInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_gatewayclass.go b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_gatewayclass.go
index 4cec1cac..02e9b847 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_gatewayclass.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_gatewayclass.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // FakeGatewayClasses implements GatewayClassInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_grpcroute.go b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_grpcroute.go
index e4992e42..bda7bc36 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_grpcroute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_grpcroute.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // FakeGRPCRoutes implements GRPCRouteInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_httproute.go b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_httproute.go
index 2673628e..468b1e2d 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_httproute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_httproute.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // FakeHTTPRoutes implements HTTPRouteInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/gateway.go b/pkg/client/clientset/versioned/typed/apis/v1/gateway.go
index 0e7d9372..44e612b6 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/gateway.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/gateway.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/gatewayclass.go b/pkg/client/clientset/versioned/typed/apis/v1/gatewayclass.go
index 2f764f14..7f68e5f0 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/gatewayclass.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/gatewayclass.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/grpcroute.go b/pkg/client/clientset/versioned/typed/apis/v1/grpcroute.go
index 55748a1d..37d7406d 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/grpcroute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/grpcroute.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/httproute.go b/pkg/client/clientset/versioned/typed/apis/v1/httproute.go
index 29f4fe9c..d62867fa 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/httproute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/httproute.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/backendlbpolicy.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/backendlbpolicy.go
index 04299450..6fde1bb8 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/backendlbpolicy.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/backendlbpolicy.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_backendlbpolicy.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_backendlbpolicy.go
index 9053eac0..c95451a6 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_backendlbpolicy.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_backendlbpolicy.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 )
 
 // FakeBackendLBPolicies implements BackendLBPolicyInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_grpcroute.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_grpcroute.go
index 82ea2b8d..dbe6013e 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_grpcroute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_grpcroute.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 )
 
 // FakeGRPCRoutes implements GRPCRouteInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_referencegrant.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_referencegrant.go
index 31b65d3a..4268d0b0 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_referencegrant.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_referencegrant.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 )
 
 // FakeReferenceGrants implements ReferenceGrantInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_tcproute.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_tcproute.go
index 32b88e16..bb90b445 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_tcproute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_tcproute.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 )
 
 // FakeTCPRoutes implements TCPRouteInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_tlsroute.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_tlsroute.go
index ba825521..360a9ae1 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_tlsroute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_tlsroute.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 )
 
 // FakeTLSRoutes implements TLSRouteInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_udproute.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_udproute.go
index 54a5b4d7..2defe25c 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_udproute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/fake/fake_udproute.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 )
 
 // FakeUDPRoutes implements UDPRouteInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/grpcroute.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/grpcroute.go
index 75752337..aa10accc 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/grpcroute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/grpcroute.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/referencegrant.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/referencegrant.go
index bbe6f879..d0154afd 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/referencegrant.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/referencegrant.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/tcproute.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/tcproute.go
index 9a9959cf..b46cc0c5 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/tcproute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/tcproute.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/tlsroute.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/tlsroute.go
index d98da0fb..e73625bb 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/tlsroute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/tlsroute.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha2/udproute.go b/pkg/client/clientset/versioned/typed/apis/v1alpha2/udproute.go
index 820bed9f..128a861c 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha2/udproute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha2/udproute.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1alpha2 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha2"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	apisv1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha3/backendtlspolicy.go b/pkg/client/clientset/versioned/typed/apis/v1alpha3/backendtlspolicy.go
index 3edd7e62..3cb0b128 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha3/backendtlspolicy.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha3/backendtlspolicy.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1alpha3 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha3"
 	v1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
+	apisv1alpha3 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha3"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1alpha3/fake/fake_backendtlspolicy.go b/pkg/client/clientset/versioned/typed/apis/v1alpha3/fake/fake_backendtlspolicy.go
index 042a931a..fbddc317 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1alpha3/fake/fake_backendtlspolicy.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1alpha3/fake/fake_backendtlspolicy.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1alpha3 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1alpha3"
 	v1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
+	apisv1alpha3 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha3"
 )
 
 // FakeBackendTLSPolicies implements BackendTLSPolicyInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_gateway.go b/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_gateway.go
index 757c95f1..2f309e4d 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_gateway.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_gateway.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
 )
 
 // FakeGateways implements GatewayInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_gatewayclass.go b/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_gatewayclass.go
index 02609747..d18395c2 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_gatewayclass.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_gatewayclass.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
 )
 
 // FakeGatewayClasses implements GatewayClassInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_httproute.go b/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_httproute.go
index 75b4b710..6ec049f8 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_httproute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_httproute.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
 )
 
 // FakeHTTPRoutes implements HTTPRouteInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_referencegrant.go b/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_referencegrant.go
index 2f5daecf..610c6a96 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_referencegrant.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1beta1/fake/fake_referencegrant.go
@@ -28,8 +28,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
-	apisv1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
 )
 
 // FakeReferenceGrants implements ReferenceGrantInterface
diff --git a/pkg/client/clientset/versioned/typed/apis/v1beta1/gateway.go b/pkg/client/clientset/versioned/typed/apis/v1beta1/gateway.go
index 6ed67c99..5a784116 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1beta1/gateway.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1beta1/gateway.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1beta1/gatewayclass.go b/pkg/client/clientset/versioned/typed/apis/v1beta1/gatewayclass.go
index f54b1e49..d9b14b03 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1beta1/gatewayclass.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1beta1/gatewayclass.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1beta1/httproute.go b/pkg/client/clientset/versioned/typed/apis/v1beta1/httproute.go
index 884a3d61..9123a629 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1beta1/httproute.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1beta1/httproute.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apis/v1beta1/referencegrant.go b/pkg/client/clientset/versioned/typed/apis/v1beta1/referencegrant.go
index 992727e3..8ea52fad 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1beta1/referencegrant.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1beta1/referencegrant.go
@@ -25,8 +25,8 @@ import (
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	gentype "k8s.io/client-go/gentype"
-	apisv1beta1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1beta1"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisv1beta1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1beta1"
 	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
 )
 
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/apisx_client.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/apisx_client.go
new file mode 100644
index 00000000..9cbdd892
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/apisx_client.go
@@ -0,0 +1,112 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"net/http"
+
+	rest "k8s.io/client-go/rest"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	"sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
+)
+
+type ExperimentalV1alpha1Interface interface {
+	RESTClient() rest.Interface
+	BackendTrafficPoliciesGetter
+	ListenerSetsGetter
+}
+
+// ExperimentalV1alpha1Client is used to interact with features provided by the gateway.networking.x-k8s.io group.
+type ExperimentalV1alpha1Client struct {
+	restClient rest.Interface
+}
+
+func (c *ExperimentalV1alpha1Client) BackendTrafficPolicies(namespace string) BackendTrafficPolicyInterface {
+	return newBackendTrafficPolicies(c, namespace)
+}
+
+func (c *ExperimentalV1alpha1Client) ListenerSets(namespace string) ListenerSetInterface {
+	return newListenerSets(c, namespace)
+}
+
+// NewForConfig creates a new ExperimentalV1alpha1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ExperimentalV1alpha1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ExperimentalV1alpha1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExperimentalV1alpha1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &ExperimentalV1alpha1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ExperimentalV1alpha1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ExperimentalV1alpha1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ExperimentalV1alpha1Client for the given RESTClient.
+func New(c rest.Interface) *ExperimentalV1alpha1Client {
+	return &ExperimentalV1alpha1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) error {
+	gv := v1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	return nil
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ExperimentalV1alpha1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/backendtrafficpolicy.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/backendtrafficpolicy.go
new file mode 100644
index 00000000..74455d90
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/backendtrafficpolicy.go
@@ -0,0 +1,73 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/applyconfiguration/apisx/v1alpha1"
+	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
+)
+
+// BackendTrafficPoliciesGetter has a method to return a BackendTrafficPolicyInterface.
+// A group's client should implement this interface.
+type BackendTrafficPoliciesGetter interface {
+	BackendTrafficPolicies(namespace string) BackendTrafficPolicyInterface
+}
+
+// BackendTrafficPolicyInterface has methods to work with BackendTrafficPolicy resources.
+type BackendTrafficPolicyInterface interface {
+	Create(ctx context.Context, backendTrafficPolicy *v1alpha1.BackendTrafficPolicy, opts v1.CreateOptions) (*v1alpha1.BackendTrafficPolicy, error)
+	Update(ctx context.Context, backendTrafficPolicy *v1alpha1.BackendTrafficPolicy, opts v1.UpdateOptions) (*v1alpha1.BackendTrafficPolicy, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, backendTrafficPolicy *v1alpha1.BackendTrafficPolicy, opts v1.UpdateOptions) (*v1alpha1.BackendTrafficPolicy, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.BackendTrafficPolicy, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.BackendTrafficPolicyList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.BackendTrafficPolicy, err error)
+	Apply(ctx context.Context, backendTrafficPolicy *apisxv1alpha1.BackendTrafficPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.BackendTrafficPolicy, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, backendTrafficPolicy *apisxv1alpha1.BackendTrafficPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.BackendTrafficPolicy, err error)
+	BackendTrafficPolicyExpansion
+}
+
+// backendTrafficPolicies implements BackendTrafficPolicyInterface
+type backendTrafficPolicies struct {
+	*gentype.ClientWithListAndApply[*v1alpha1.BackendTrafficPolicy, *v1alpha1.BackendTrafficPolicyList, *apisxv1alpha1.BackendTrafficPolicyApplyConfiguration]
+}
+
+// newBackendTrafficPolicies returns a BackendTrafficPolicies
+func newBackendTrafficPolicies(c *ExperimentalV1alpha1Client, namespace string) *backendTrafficPolicies {
+	return &backendTrafficPolicies{
+		gentype.NewClientWithListAndApply[*v1alpha1.BackendTrafficPolicy, *v1alpha1.BackendTrafficPolicyList, *apisxv1alpha1.BackendTrafficPolicyApplyConfiguration](
+			"backendtrafficpolicies",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *v1alpha1.BackendTrafficPolicy { return &v1alpha1.BackendTrafficPolicy{} },
+			func() *v1alpha1.BackendTrafficPolicyList { return &v1alpha1.BackendTrafficPolicyList{} }),
+	}
+}
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/doc.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/doc.go
new file mode 100644
index 00000000..df51baa4
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/doc.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/doc.go
new file mode 100644
index 00000000..16f44399
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_apisx_client.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_apisx_client.go
new file mode 100644
index 00000000..12f35d1b
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_apisx_client.go
@@ -0,0 +1,44 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1alpha1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apisx/v1alpha1"
+)
+
+type FakeExperimentalV1alpha1 struct {
+	*testing.Fake
+}
+
+func (c *FakeExperimentalV1alpha1) BackendTrafficPolicies(namespace string) v1alpha1.BackendTrafficPolicyInterface {
+	return &FakeBackendTrafficPolicies{c, namespace}
+}
+
+func (c *FakeExperimentalV1alpha1) ListenerSets(namespace string) v1alpha1.ListenerSetInterface {
+	return &FakeListenerSets{c, namespace}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeExperimentalV1alpha1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_backendtrafficpolicy.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_backendtrafficpolicy.go
new file mode 100644
index 00000000..905e295b
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_backendtrafficpolicy.go
@@ -0,0 +1,197 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+	json "encoding/json"
+	"fmt"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/applyconfiguration/apisx/v1alpha1"
+)
+
+// FakeBackendTrafficPolicies implements BackendTrafficPolicyInterface
+type FakeBackendTrafficPolicies struct {
+	Fake *FakeExperimentalV1alpha1
+	ns   string
+}
+
+var backendtrafficpoliciesResource = v1alpha1.SchemeGroupVersion.WithResource("backendtrafficpolicies")
+
+var backendtrafficpoliciesKind = v1alpha1.SchemeGroupVersion.WithKind("BackendTrafficPolicy")
+
+// Get takes name of the backendTrafficPolicy, and returns the corresponding backendTrafficPolicy object, and an error if there is any.
+func (c *FakeBackendTrafficPolicies) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.BackendTrafficPolicy, err error) {
+	emptyResult := &v1alpha1.BackendTrafficPolicy{}
+	obj, err := c.Fake.
+		Invokes(testing.NewGetActionWithOptions(backendtrafficpoliciesResource, c.ns, name, options), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.BackendTrafficPolicy), err
+}
+
+// List takes label and field selectors, and returns the list of BackendTrafficPolicies that match those selectors.
+func (c *FakeBackendTrafficPolicies) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.BackendTrafficPolicyList, err error) {
+	emptyResult := &v1alpha1.BackendTrafficPolicyList{}
+	obj, err := c.Fake.
+		Invokes(testing.NewListActionWithOptions(backendtrafficpoliciesResource, backendtrafficpoliciesKind, c.ns, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.BackendTrafficPolicyList{ListMeta: obj.(*v1alpha1.BackendTrafficPolicyList).ListMeta}
+	for _, item := range obj.(*v1alpha1.BackendTrafficPolicyList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested backendTrafficPolicies.
+func (c *FakeBackendTrafficPolicies) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchActionWithOptions(backendtrafficpoliciesResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a backendTrafficPolicy and creates it.  Returns the server's representation of the backendTrafficPolicy, and an error, if there is any.
+func (c *FakeBackendTrafficPolicies) Create(ctx context.Context, backendTrafficPolicy *v1alpha1.BackendTrafficPolicy, opts v1.CreateOptions) (result *v1alpha1.BackendTrafficPolicy, err error) {
+	emptyResult := &v1alpha1.BackendTrafficPolicy{}
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateActionWithOptions(backendtrafficpoliciesResource, c.ns, backendTrafficPolicy, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.BackendTrafficPolicy), err
+}
+
+// Update takes the representation of a backendTrafficPolicy and updates it. Returns the server's representation of the backendTrafficPolicy, and an error, if there is any.
+func (c *FakeBackendTrafficPolicies) Update(ctx context.Context, backendTrafficPolicy *v1alpha1.BackendTrafficPolicy, opts v1.UpdateOptions) (result *v1alpha1.BackendTrafficPolicy, err error) {
+	emptyResult := &v1alpha1.BackendTrafficPolicy{}
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateActionWithOptions(backendtrafficpoliciesResource, c.ns, backendTrafficPolicy, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.BackendTrafficPolicy), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeBackendTrafficPolicies) UpdateStatus(ctx context.Context, backendTrafficPolicy *v1alpha1.BackendTrafficPolicy, opts v1.UpdateOptions) (result *v1alpha1.BackendTrafficPolicy, err error) {
+	emptyResult := &v1alpha1.BackendTrafficPolicy{}
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceActionWithOptions(backendtrafficpoliciesResource, "status", c.ns, backendTrafficPolicy, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.BackendTrafficPolicy), err
+}
+
+// Delete takes name of the backendTrafficPolicy and deletes it. Returns an error if one occurs.
+func (c *FakeBackendTrafficPolicies) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteActionWithOptions(backendtrafficpoliciesResource, c.ns, name, opts), &v1alpha1.BackendTrafficPolicy{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeBackendTrafficPolicies) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewDeleteCollectionActionWithOptions(backendtrafficpoliciesResource, c.ns, opts, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.BackendTrafficPolicyList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched backendTrafficPolicy.
+func (c *FakeBackendTrafficPolicies) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.BackendTrafficPolicy, err error) {
+	emptyResult := &v1alpha1.BackendTrafficPolicy{}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceActionWithOptions(backendtrafficpoliciesResource, c.ns, name, pt, data, opts, subresources...), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.BackendTrafficPolicy), err
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied backendTrafficPolicy.
+func (c *FakeBackendTrafficPolicies) Apply(ctx context.Context, backendTrafficPolicy *apisxv1alpha1.BackendTrafficPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.BackendTrafficPolicy, err error) {
+	if backendTrafficPolicy == nil {
+		return nil, fmt.Errorf("backendTrafficPolicy provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(backendTrafficPolicy)
+	if err != nil {
+		return nil, err
+	}
+	name := backendTrafficPolicy.Name
+	if name == nil {
+		return nil, fmt.Errorf("backendTrafficPolicy.Name must be provided to Apply")
+	}
+	emptyResult := &v1alpha1.BackendTrafficPolicy{}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceActionWithOptions(backendtrafficpoliciesResource, c.ns, *name, types.ApplyPatchType, data, opts.ToPatchOptions()), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.BackendTrafficPolicy), err
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *FakeBackendTrafficPolicies) ApplyStatus(ctx context.Context, backendTrafficPolicy *apisxv1alpha1.BackendTrafficPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.BackendTrafficPolicy, err error) {
+	if backendTrafficPolicy == nil {
+		return nil, fmt.Errorf("backendTrafficPolicy provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(backendTrafficPolicy)
+	if err != nil {
+		return nil, err
+	}
+	name := backendTrafficPolicy.Name
+	if name == nil {
+		return nil, fmt.Errorf("backendTrafficPolicy.Name must be provided to Apply")
+	}
+	emptyResult := &v1alpha1.BackendTrafficPolicy{}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceActionWithOptions(backendtrafficpoliciesResource, c.ns, *name, types.ApplyPatchType, data, opts.ToPatchOptions(), "status"), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.BackendTrafficPolicy), err
+}
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_listenerset.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_listenerset.go
new file mode 100644
index 00000000..6888d2cb
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_listenerset.go
@@ -0,0 +1,197 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+	json "encoding/json"
+	"fmt"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/applyconfiguration/apisx/v1alpha1"
+)
+
+// FakeListenerSets implements ListenerSetInterface
+type FakeListenerSets struct {
+	Fake *FakeExperimentalV1alpha1
+	ns   string
+}
+
+var listenersetsResource = v1alpha1.SchemeGroupVersion.WithResource("listenersets")
+
+var listenersetsKind = v1alpha1.SchemeGroupVersion.WithKind("ListenerSet")
+
+// Get takes name of the listenerSet, and returns the corresponding listenerSet object, and an error if there is any.
+func (c *FakeListenerSets) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.ListenerSet, err error) {
+	emptyResult := &v1alpha1.ListenerSet{}
+	obj, err := c.Fake.
+		Invokes(testing.NewGetActionWithOptions(listenersetsResource, c.ns, name, options), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.ListenerSet), err
+}
+
+// List takes label and field selectors, and returns the list of ListenerSets that match those selectors.
+func (c *FakeListenerSets) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha1.ListenerSetList, err error) {
+	emptyResult := &v1alpha1.ListenerSetList{}
+	obj, err := c.Fake.
+		Invokes(testing.NewListActionWithOptions(listenersetsResource, listenersetsKind, c.ns, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.ListenerSetList{ListMeta: obj.(*v1alpha1.ListenerSetList).ListMeta}
+	for _, item := range obj.(*v1alpha1.ListenerSetList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested listenerSets.
+func (c *FakeListenerSets) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchActionWithOptions(listenersetsResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a listenerSet and creates it.  Returns the server's representation of the listenerSet, and an error, if there is any.
+func (c *FakeListenerSets) Create(ctx context.Context, listenerSet *v1alpha1.ListenerSet, opts v1.CreateOptions) (result *v1alpha1.ListenerSet, err error) {
+	emptyResult := &v1alpha1.ListenerSet{}
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateActionWithOptions(listenersetsResource, c.ns, listenerSet, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.ListenerSet), err
+}
+
+// Update takes the representation of a listenerSet and updates it. Returns the server's representation of the listenerSet, and an error, if there is any.
+func (c *FakeListenerSets) Update(ctx context.Context, listenerSet *v1alpha1.ListenerSet, opts v1.UpdateOptions) (result *v1alpha1.ListenerSet, err error) {
+	emptyResult := &v1alpha1.ListenerSet{}
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateActionWithOptions(listenersetsResource, c.ns, listenerSet, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.ListenerSet), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeListenerSets) UpdateStatus(ctx context.Context, listenerSet *v1alpha1.ListenerSet, opts v1.UpdateOptions) (result *v1alpha1.ListenerSet, err error) {
+	emptyResult := &v1alpha1.ListenerSet{}
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceActionWithOptions(listenersetsResource, "status", c.ns, listenerSet, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.ListenerSet), err
+}
+
+// Delete takes name of the listenerSet and deletes it. Returns an error if one occurs.
+func (c *FakeListenerSets) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteActionWithOptions(listenersetsResource, c.ns, name, opts), &v1alpha1.ListenerSet{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeListenerSets) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewDeleteCollectionActionWithOptions(listenersetsResource, c.ns, opts, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.ListenerSetList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched listenerSet.
+func (c *FakeListenerSets) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ListenerSet, err error) {
+	emptyResult := &v1alpha1.ListenerSet{}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceActionWithOptions(listenersetsResource, c.ns, name, pt, data, opts, subresources...), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.ListenerSet), err
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied listenerSet.
+func (c *FakeListenerSets) Apply(ctx context.Context, listenerSet *apisxv1alpha1.ListenerSetApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.ListenerSet, err error) {
+	if listenerSet == nil {
+		return nil, fmt.Errorf("listenerSet provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(listenerSet)
+	if err != nil {
+		return nil, err
+	}
+	name := listenerSet.Name
+	if name == nil {
+		return nil, fmt.Errorf("listenerSet.Name must be provided to Apply")
+	}
+	emptyResult := &v1alpha1.ListenerSet{}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceActionWithOptions(listenersetsResource, c.ns, *name, types.ApplyPatchType, data, opts.ToPatchOptions()), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.ListenerSet), err
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *FakeListenerSets) ApplyStatus(ctx context.Context, listenerSet *apisxv1alpha1.ListenerSetApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.ListenerSet, err error) {
+	if listenerSet == nil {
+		return nil, fmt.Errorf("listenerSet provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(listenerSet)
+	if err != nil {
+		return nil, err
+	}
+	name := listenerSet.Name
+	if name == nil {
+		return nil, fmt.Errorf("listenerSet.Name must be provided to Apply")
+	}
+	emptyResult := &v1alpha1.ListenerSet{}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceActionWithOptions(listenersetsResource, c.ns, *name, types.ApplyPatchType, data, opts.ToPatchOptions(), "status"), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1alpha1.ListenerSet), err
+}
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/generated_expansion.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/generated_expansion.go
new file mode 100644
index 00000000..ad8c5e14
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type BackendTrafficPolicyExpansion interface{}
+
+type ListenerSetExpansion interface{}
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/listenerset.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/listenerset.go
new file mode 100644
index 00000000..c383f147
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/listenerset.go
@@ -0,0 +1,73 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/applyconfiguration/apisx/v1alpha1"
+	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
+)
+
+// ListenerSetsGetter has a method to return a ListenerSetInterface.
+// A group's client should implement this interface.
+type ListenerSetsGetter interface {
+	ListenerSets(namespace string) ListenerSetInterface
+}
+
+// ListenerSetInterface has methods to work with ListenerSet resources.
+type ListenerSetInterface interface {
+	Create(ctx context.Context, listenerSet *v1alpha1.ListenerSet, opts v1.CreateOptions) (*v1alpha1.ListenerSet, error)
+	Update(ctx context.Context, listenerSet *v1alpha1.ListenerSet, opts v1.UpdateOptions) (*v1alpha1.ListenerSet, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, listenerSet *v1alpha1.ListenerSet, opts v1.UpdateOptions) (*v1alpha1.ListenerSet, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha1.ListenerSet, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.ListenerSetList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.ListenerSet, err error)
+	Apply(ctx context.Context, listenerSet *apisxv1alpha1.ListenerSetApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.ListenerSet, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, listenerSet *apisxv1alpha1.ListenerSetApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.ListenerSet, err error)
+	ListenerSetExpansion
+}
+
+// listenerSets implements ListenerSetInterface
+type listenerSets struct {
+	*gentype.ClientWithListAndApply[*v1alpha1.ListenerSet, *v1alpha1.ListenerSetList, *apisxv1alpha1.ListenerSetApplyConfiguration]
+}
+
+// newListenerSets returns a ListenerSets
+func newListenerSets(c *ExperimentalV1alpha1Client, namespace string) *listenerSets {
+	return &listenerSets{
+		gentype.NewClientWithListAndApply[*v1alpha1.ListenerSet, *v1alpha1.ListenerSetList, *apisxv1alpha1.ListenerSetApplyConfiguration](
+			"listenersets",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *v1alpha1.ListenerSet { return &v1alpha1.ListenerSet{} },
+			func() *v1alpha1.ListenerSetList { return &v1alpha1.ListenerSetList{} }),
+	}
+}
diff --git a/pkg/client/informers/externalversions/apisx/interface.go b/pkg/client/informers/externalversions/apisx/interface.go
new file mode 100644
index 00000000..458ec817
--- /dev/null
+++ b/pkg/client/informers/externalversions/apisx/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package apisx
+
+import (
+	v1alpha1 "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/apisx/v1alpha1"
+	internalinterfaces "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() v1alpha1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1alpha1 returns a new v1alpha1.Interface.
+func (g *group) V1alpha1() v1alpha1.Interface {
+	return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/pkg/client/informers/externalversions/apisx/v1alpha1/backendtrafficpolicy.go b/pkg/client/informers/externalversions/apisx/v1alpha1/backendtrafficpolicy.go
new file mode 100644
index 00000000..27a5e77f
--- /dev/null
+++ b/pkg/client/informers/externalversions/apisx/v1alpha1/backendtrafficpolicy.go
@@ -0,0 +1,90 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	versioned "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned"
+	internalinterfaces "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha1 "sigs.k8s.io/gateway-api/pkg/client/listers/apisx/v1alpha1"
+)
+
+// BackendTrafficPolicyInformer provides access to a shared informer and lister for
+// BackendTrafficPolicies.
+type BackendTrafficPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha1.BackendTrafficPolicyLister
+}
+
+type backendTrafficPolicyInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewBackendTrafficPolicyInformer constructs a new informer for BackendTrafficPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewBackendTrafficPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredBackendTrafficPolicyInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredBackendTrafficPolicyInformer constructs a new informer for BackendTrafficPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredBackendTrafficPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ExperimentalV1alpha1().BackendTrafficPolicies(namespace).List(context.TODO(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ExperimentalV1alpha1().BackendTrafficPolicies(namespace).Watch(context.TODO(), options)
+			},
+		},
+		&apisxv1alpha1.BackendTrafficPolicy{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *backendTrafficPolicyInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredBackendTrafficPolicyInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *backendTrafficPolicyInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&apisxv1alpha1.BackendTrafficPolicy{}, f.defaultInformer)
+}
+
+func (f *backendTrafficPolicyInformer) Lister() v1alpha1.BackendTrafficPolicyLister {
+	return v1alpha1.NewBackendTrafficPolicyLister(f.Informer().GetIndexer())
+}
diff --git a/pkg/client/informers/externalversions/apisx/v1alpha1/interface.go b/pkg/client/informers/externalversions/apisx/v1alpha1/interface.go
new file mode 100644
index 00000000..b95538a9
--- /dev/null
+++ b/pkg/client/informers/externalversions/apisx/v1alpha1/interface.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	internalinterfaces "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// BackendTrafficPolicies returns a BackendTrafficPolicyInformer.
+	BackendTrafficPolicies() BackendTrafficPolicyInformer
+	// ListenerSets returns a ListenerSetInformer.
+	ListenerSets() ListenerSetInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// BackendTrafficPolicies returns a BackendTrafficPolicyInformer.
+func (v *version) BackendTrafficPolicies() BackendTrafficPolicyInformer {
+	return &backendTrafficPolicyInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
+// ListenerSets returns a ListenerSetInformer.
+func (v *version) ListenerSets() ListenerSetInformer {
+	return &listenerSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/pkg/client/informers/externalversions/apisx/v1alpha1/listenerset.go b/pkg/client/informers/externalversions/apisx/v1alpha1/listenerset.go
new file mode 100644
index 00000000..38f8f050
--- /dev/null
+++ b/pkg/client/informers/externalversions/apisx/v1alpha1/listenerset.go
@@ -0,0 +1,90 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"context"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	versioned "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned"
+	internalinterfaces "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha1 "sigs.k8s.io/gateway-api/pkg/client/listers/apisx/v1alpha1"
+)
+
+// ListenerSetInformer provides access to a shared informer and lister for
+// ListenerSets.
+type ListenerSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha1.ListenerSetLister
+}
+
+type listenerSetInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewListenerSetInformer constructs a new informer for ListenerSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewListenerSetInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredListenerSetInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredListenerSetInformer constructs a new informer for ListenerSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredListenerSetInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ExperimentalV1alpha1().ListenerSets(namespace).List(context.TODO(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ExperimentalV1alpha1().ListenerSets(namespace).Watch(context.TODO(), options)
+			},
+		},
+		&apisxv1alpha1.ListenerSet{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *listenerSetInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredListenerSetInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *listenerSetInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&apisxv1alpha1.ListenerSet{}, f.defaultInformer)
+}
+
+func (f *listenerSetInformer) Lister() v1alpha1.ListenerSetLister {
+	return v1alpha1.NewListenerSetLister(f.Informer().GetIndexer())
+}
diff --git a/pkg/client/informers/externalversions/factory.go b/pkg/client/informers/externalversions/factory.go
index 0f5f0550..d42f4a96 100644
--- a/pkg/client/informers/externalversions/factory.go
+++ b/pkg/client/informers/externalversions/factory.go
@@ -29,6 +29,7 @@ import (
 	cache "k8s.io/client-go/tools/cache"
 	versioned "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned"
 	apis "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/apis"
+	apisx "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/apisx"
 	internalinterfaces "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/internalinterfaces"
 )
 
@@ -255,8 +256,13 @@ type SharedInformerFactory interface {
 	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
 
 	Gateway() apis.Interface
+	Experimental() apisx.Interface
 }
 
 func (f *sharedInformerFactory) Gateway() apis.Interface {
 	return apis.New(f, f.namespace, f.tweakListOptions)
 }
+
+func (f *sharedInformerFactory) Experimental() apisx.Interface {
+	return apisx.New(f, f.namespace, f.tweakListOptions)
+}
diff --git a/pkg/client/informers/externalversions/generic.go b/pkg/client/informers/externalversions/generic.go
index 283d2475..d034a3b0 100644
--- a/pkg/client/informers/externalversions/generic.go
+++ b/pkg/client/informers/externalversions/generic.go
@@ -27,6 +27,7 @@ import (
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	v1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
 )
 
 // GenericInformer is type of SharedIndexInformer which will locate and delegate to other
@@ -93,6 +94,12 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case v1beta1.SchemeGroupVersion.WithResource("referencegrants"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Gateway().V1beta1().ReferenceGrants().Informer()}, nil
 
+		// Group=gateway.networking.x-k8s.io, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithResource("backendtrafficpolicies"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Experimental().V1alpha1().BackendTrafficPolicies().Informer()}, nil
+	case v1alpha1.SchemeGroupVersion.WithResource("listenersets"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Experimental().V1alpha1().ListenerSets().Informer()}, nil
+
 	}
 
 	return nil, fmt.Errorf("no informer found for %v", resource)
diff --git a/pkg/client/listers/apisx/v1alpha1/backendtrafficpolicy.go b/pkg/client/listers/apisx/v1alpha1/backendtrafficpolicy.go
new file mode 100644
index 00000000..5f6d3b4e
--- /dev/null
+++ b/pkg/client/listers/apisx/v1alpha1/backendtrafficpolicy.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/listers"
+	"k8s.io/client-go/tools/cache"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+)
+
+// BackendTrafficPolicyLister helps list BackendTrafficPolicies.
+// All objects returned here must be treated as read-only.
+type BackendTrafficPolicyLister interface {
+	// List lists all BackendTrafficPolicies in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.BackendTrafficPolicy, err error)
+	// BackendTrafficPolicies returns an object that can list and get BackendTrafficPolicies.
+	BackendTrafficPolicies(namespace string) BackendTrafficPolicyNamespaceLister
+	BackendTrafficPolicyListerExpansion
+}
+
+// backendTrafficPolicyLister implements the BackendTrafficPolicyLister interface.
+type backendTrafficPolicyLister struct {
+	listers.ResourceIndexer[*v1alpha1.BackendTrafficPolicy]
+}
+
+// NewBackendTrafficPolicyLister returns a new BackendTrafficPolicyLister.
+func NewBackendTrafficPolicyLister(indexer cache.Indexer) BackendTrafficPolicyLister {
+	return &backendTrafficPolicyLister{listers.New[*v1alpha1.BackendTrafficPolicy](indexer, v1alpha1.Resource("backendtrafficpolicy"))}
+}
+
+// BackendTrafficPolicies returns an object that can list and get BackendTrafficPolicies.
+func (s *backendTrafficPolicyLister) BackendTrafficPolicies(namespace string) BackendTrafficPolicyNamespaceLister {
+	return backendTrafficPolicyNamespaceLister{listers.NewNamespaced[*v1alpha1.BackendTrafficPolicy](s.ResourceIndexer, namespace)}
+}
+
+// BackendTrafficPolicyNamespaceLister helps list and get BackendTrafficPolicies.
+// All objects returned here must be treated as read-only.
+type BackendTrafficPolicyNamespaceLister interface {
+	// List lists all BackendTrafficPolicies in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.BackendTrafficPolicy, err error)
+	// Get retrieves the BackendTrafficPolicy from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*v1alpha1.BackendTrafficPolicy, error)
+	BackendTrafficPolicyNamespaceListerExpansion
+}
+
+// backendTrafficPolicyNamespaceLister implements the BackendTrafficPolicyNamespaceLister
+// interface.
+type backendTrafficPolicyNamespaceLister struct {
+	listers.ResourceIndexer[*v1alpha1.BackendTrafficPolicy]
+}
diff --git a/pkg/client/listers/apisx/v1alpha1/expansion_generated.go b/pkg/client/listers/apisx/v1alpha1/expansion_generated.go
new file mode 100644
index 00000000..cfeb378c
--- /dev/null
+++ b/pkg/client/listers/apisx/v1alpha1/expansion_generated.go
@@ -0,0 +1,35 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// BackendTrafficPolicyListerExpansion allows custom methods to be added to
+// BackendTrafficPolicyLister.
+type BackendTrafficPolicyListerExpansion interface{}
+
+// BackendTrafficPolicyNamespaceListerExpansion allows custom methods to be added to
+// BackendTrafficPolicyNamespaceLister.
+type BackendTrafficPolicyNamespaceListerExpansion interface{}
+
+// ListenerSetListerExpansion allows custom methods to be added to
+// ListenerSetLister.
+type ListenerSetListerExpansion interface{}
+
+// ListenerSetNamespaceListerExpansion allows custom methods to be added to
+// ListenerSetNamespaceLister.
+type ListenerSetNamespaceListerExpansion interface{}
diff --git a/pkg/client/listers/apisx/v1alpha1/listenerset.go b/pkg/client/listers/apisx/v1alpha1/listenerset.go
new file mode 100644
index 00000000..ab0fdc1d
--- /dev/null
+++ b/pkg/client/listers/apisx/v1alpha1/listenerset.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/listers"
+	"k8s.io/client-go/tools/cache"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+)
+
+// ListenerSetLister helps list ListenerSets.
+// All objects returned here must be treated as read-only.
+type ListenerSetLister interface {
+	// List lists all ListenerSets in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.ListenerSet, err error)
+	// ListenerSets returns an object that can list and get ListenerSets.
+	ListenerSets(namespace string) ListenerSetNamespaceLister
+	ListenerSetListerExpansion
+}
+
+// listenerSetLister implements the ListenerSetLister interface.
+type listenerSetLister struct {
+	listers.ResourceIndexer[*v1alpha1.ListenerSet]
+}
+
+// NewListenerSetLister returns a new ListenerSetLister.
+func NewListenerSetLister(indexer cache.Indexer) ListenerSetLister {
+	return &listenerSetLister{listers.New[*v1alpha1.ListenerSet](indexer, v1alpha1.Resource("listenerset"))}
+}
+
+// ListenerSets returns an object that can list and get ListenerSets.
+func (s *listenerSetLister) ListenerSets(namespace string) ListenerSetNamespaceLister {
+	return listenerSetNamespaceLister{listers.NewNamespaced[*v1alpha1.ListenerSet](s.ResourceIndexer, namespace)}
+}
+
+// ListenerSetNamespaceLister helps list and get ListenerSets.
+// All objects returned here must be treated as read-only.
+type ListenerSetNamespaceLister interface {
+	// List lists all ListenerSets in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1alpha1.ListenerSet, err error)
+	// Get retrieves the ListenerSet from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*v1alpha1.ListenerSet, error)
+	ListenerSetNamespaceListerExpansion
+}
+
+// listenerSetNamespaceLister implements the ListenerSetNamespaceLister
+// interface.
+type listenerSetNamespaceLister struct {
+	listers.ResourceIndexer[*v1alpha1.ListenerSet]
+}
diff --git a/pkg/features/gateway.go b/pkg/features/gateway.go
index a90a32a4..7fc1a20d 100644
--- a/pkg/features/gateway.go
+++ b/pkg/features/gateway.go
@@ -58,7 +58,7 @@ const (
 	SupportGatewayHTTPListenerIsolation FeatureName = "GatewayHTTPListenerIsolation"
 
 	// SupportGatewayInfrastructureAnnotations option indicates support for
-	// spec.infrastructure.annotations and spec.infrastrucutre.labels
+	// spec.infrastructure.annotations and spec.infrastructure.labels
 	SupportGatewayInfrastructurePropagation FeatureName = "GatewayInfrastructurePropagation"
 )
 
diff --git a/pkg/features/httproute.go b/pkg/features/httproute.go
index cd7d90ec..82640984 100644
--- a/pkg/features/httproute.go
+++ b/pkg/features/httproute.go
@@ -95,7 +95,7 @@ const (
 	// This option indicates support for HTTPRoute with a backendref with an appProtocol 'kubernetes.io/h2c' (extended conformance)
 	SupportHTTPRouteBackendProtocolH2C FeatureName = "HTTPRouteBackendProtocolH2C"
 
-	// This option indicates support for HTTPRoute with a backendref with an appProtoocol 'kubernetes.io/ws' (extended conformance)
+	// This option indicates support for HTTPRoute with a backendref with an appProtocol 'kubernetes.io/ws' (extended conformance)
 	SupportHTTPRouteBackendProtocolWebSocket FeatureName = "HTTPRouteBackendProtocolWebSocket"
 )
 
diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go
index 54774d7c..66ddf154 100644
--- a/pkg/generated/openapi/zz_generated.openapi.go
+++ b/pkg/generated/openapi/zz_generated.openapi.go
@@ -82,6 +82,7 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"k8s.io/apimachinery/pkg/runtime.TypeMeta":                                        schema_k8sio_apimachinery_pkg_runtime_TypeMeta(ref),
 		"k8s.io/apimachinery/pkg/runtime.Unknown":                                         schema_k8sio_apimachinery_pkg_runtime_Unknown(ref),
 		"k8s.io/apimachinery/pkg/version.Info":                                            schema_k8sio_apimachinery_pkg_version_Info(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.AllowedListeners":                                schema_sigsk8sio_gateway_api_apis_v1_AllowedListeners(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.AllowedRoutes":                                   schema_sigsk8sio_gateway_api_apis_v1_AllowedRoutes(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.BackendObjectReference":                          schema_sigsk8sio_gateway_api_apis_v1_BackendObjectReference(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.BackendRef":                                      schema_sigsk8sio_gateway_api_apis_v1_BackendRef(ref),
@@ -113,6 +114,7 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apis/v1.GatewayStatusAddress":                            schema_sigsk8sio_gateway_api_apis_v1_GatewayStatusAddress(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig":                                schema_sigsk8sio_gateway_api_apis_v1_GatewayTLSConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.HTTPBackendRef":                                  schema_sigsk8sio_gateway_api_apis_v1_HTTPBackendRef(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.HTTPCORSFilter":                                  schema_sigsk8sio_gateway_api_apis_v1_HTTPCORSFilter(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.HTTPHeader":                                      schema_sigsk8sio_gateway_api_apis_v1_HTTPHeader(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.HTTPHeaderFilter":                                schema_sigsk8sio_gateway_api_apis_v1_HTTPHeaderFilter(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.HTTPHeaderMatch":                                 schema_sigsk8sio_gateway_api_apis_v1_HTTPHeaderMatch(ref),
@@ -132,6 +134,7 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apis/v1.HTTPRouteTimeouts":                               schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteTimeouts(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.HTTPURLRewriteFilter":                            schema_sigsk8sio_gateway_api_apis_v1_HTTPURLRewriteFilter(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.Listener":                                        schema_sigsk8sio_gateway_api_apis_v1_Listener(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.ListenerNamespaces":                              schema_sigsk8sio_gateway_api_apis_v1_ListenerNamespaces(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.ListenerStatus":                                  schema_sigsk8sio_gateway_api_apis_v1_ListenerStatus(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.LocalObjectReference":                            schema_sigsk8sio_gateway_api_apis_v1_LocalObjectReference(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.LocalParametersReference":                        schema_sigsk8sio_gateway_api_apis_v1_LocalParametersReference(ref),
@@ -189,6 +192,18 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apis/v1beta1.ReferenceGrantList":                         schema_sigsk8sio_gateway_api_apis_v1beta1_ReferenceGrantList(ref),
 		"sigs.k8s.io/gateway-api/apis/v1beta1.ReferenceGrantSpec":                         schema_sigsk8sio_gateway_api_apis_v1beta1_ReferenceGrantSpec(ref),
 		"sigs.k8s.io/gateway-api/apis/v1beta1.ReferenceGrantTo":                           schema_sigsk8sio_gateway_api_apis_v1beta1_ReferenceGrantTo(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.BackendTrafficPolicy":                     schema_sigsk8sio_gateway_api_apisx_v1alpha1_BackendTrafficPolicy(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.BackendTrafficPolicyList":                 schema_sigsk8sio_gateway_api_apisx_v1alpha1_BackendTrafficPolicyList(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.BackendTrafficPolicySpec":                 schema_sigsk8sio_gateway_api_apisx_v1alpha1_BackendTrafficPolicySpec(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerEntry":                            schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerEntry(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerEntryStatus":                      schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerEntryStatus(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSet":                              schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSet(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSetList":                          schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSetList(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSetSpec":                          schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSetSpec(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSetStatus":                        schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSetStatus(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ParentGatewayReference":                   schema_sigsk8sio_gateway_api_apisx_v1alpha1_ParentGatewayReference(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.RequestRate":                              schema_sigsk8sio_gateway_api_apisx_v1alpha1_RequestRate(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.RetryConstraint":                          schema_sigsk8sio_gateway_api_apisx_v1alpha1_RetryConstraint(ref),
 	}
 }
 
@@ -2781,12 +2796,32 @@ func schema_k8sio_apimachinery_pkg_version_Info(ref common.ReferenceCallback) co
 	}
 }
 
-func schema_sigsk8sio_gateway_api_apis_v1_AllowedRoutes(ref common.ReferenceCallback) common.OpenAPIDefinition {
+func schema_sigsk8sio_gateway_api_apis_v1_AllowedListeners(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "AllowedRoutes defines which Routes may be attached to this Listener.",
+				Description: "AllowedListeners defines which ListenerSets can be attached to this Gateway.",
 				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"namespaces": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Namespaces defines which namespaces ListenerSets can be attached to this Gateway. While this feature is experimental, the default value is to allow no ListenerSets.",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.ListenerNamespaces"),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apis/v1.ListenerNamespaces"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apis_v1_AllowedRoutes(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
 					"namespaces": {
 						SchemaProps: spec.SchemaProps{
@@ -3249,7 +3284,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GRPCRouteFilter(ref common.ReferenceCa
 					},
 					"requestMirror": {
 						SchemaProps: spec.SchemaProps{
-							Description: "RequestMirror defines a schema for a filter that mirrors requests. Requests are sent to the specified destination, but responses from that destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that not all implementations will be able to support mirroring to multiple backends.\n\nSupport: Extended\n\n\n<gateway:experimental:validation:XValidation:message=\"Only one of percent or fraction may be specified in HTTPRequestMirrorFilter\",rule=\"!(has(self.percent) && has(self.fraction))\">",
+							Description: "RequestMirror defines a schema for a filter that mirrors requests. Requests are sent to the specified destination, but responses from that destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that not all implementations will be able to support mirroring to multiple backends.\n\nSupport: Extended",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.HTTPRequestMirrorFilter"),
 						},
 					},
@@ -3390,7 +3425,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GRPCRouteRule(ref common.ReferenceCall
 					},
 					"filters": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Filters define the filters that are applied to requests that match this rule.\n\nThe effects of ordering of multiple behaviors are currently unspecified. This can change in the future based on feedback during the alpha stage.\n\nConformance-levels at this level are defined based on the type of filter:\n\n- ALL core filters MUST be supported by all implementations that support\n  GRPCRoute.\n- Implementers are encouraged to support extended filters. - Implementation-specific custom filters have no API guarantees across\n  implementations.\n\nSpecifying the same filter multiple times is not supported unless explicitly indicated in the filter.\n\nIf an implementation can not support a combination of filters, it must clearly document that limitation. In cases where incompatible or unsupported filters are specified and cause the `Accepted` condition to be set to status `False`, implementations may use the `IncompatibleFilters` reason to specify this configuration error.\n\nSupport: Core",
+							Description: "Filters define the filters that are applied to requests that match this rule.\n\nThe effects of ordering of multiple behaviors are currently unspecified. This can change in the future based on feedback during the alpha stage.\n\nConformance-levels at this level are defined based on the type of filter:\n\n- ALL core filters MUST be supported by all implementations that support\n  GRPCRoute.\n- Implementers are encouraged to support extended filters. - Implementation-specific custom filters have no API guarantees across\n  implementations.\n\nSpecifying the same filter multiple times is not supported unless explicitly indicated in the filter.\n\nIf an implementation cannot support a combination of filters, it must clearly document that limitation. In cases where incompatible or unsupported filters are specified and cause the `Accepted` condition to be set to status `False`, implementations may use the `IncompatibleFilters` reason to specify this configuration error.\n\nSupport: Core",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -3939,7 +3974,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 							},
 						},
 						SchemaProps: spec.SchemaProps{
-							Description: "Listeners associated with this Gateway. Listeners define logical endpoints that are bound on this Gateway's addresses. At least one Listener MUST be specified.\n\n## Distinct Listeners\n\nEach Listener in a set of Listeners (for example, in a single Gateway) MUST be _distinct_, in that a traffic flow MUST be able to be assigned to exactly one listener. (This section uses \"set of Listeners\" rather than \"Listeners in a single Gateway\" because implementations MAY merge configuration from multiple Gateways onto a single data plane, and these rules _also_ apply in that case).\n\nPractically, this means that each listener in a set MUST have a unique combination of Port, Protocol, and, if supported by the protocol, Hostname.\n\nSome combinations of port, protocol, and TLS settings are considered Core support and MUST be supported by implementations based on the objects they support:\n\nHTTPRoute\n\n1. HTTPRoute, Port: 80, Protocol: HTTP 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided\n\nTLSRoute\n\n1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough\n\n\"Distinct\" Listeners have the following property:\n\n**The implementation can match inbound requests to a single distinct Listener**.\n\nWhen multiple Listeners share values for fields (for example, two Listeners with the same Port value), the implementation can match requests to only one of the Listeners using other Listener fields.\n\nWhen multiple listeners have the same value for the Protocol field, then each of the Listeners with matching Protocol values MUST have different values for other fields.\n\nThe set of fields that MUST be different for a Listener differs per protocol. The following rules define the rules for what fields MUST be considered for Listeners to be distinct with each protocol currently defined in the Gateway API spec.\n\nThe set of listeners that all share a protocol value MUST have _different_ values for _at least one_ of these fields to be distinct:\n\n* **HTTP, HTTPS, TLS**: Port, Hostname * **TCP, UDP**: Port\n\nOne **very** important rule to call out involves what happens when an implementation:\n\n* Supports TCP protocol Listeners, as well as HTTP, HTTPS, or TLS protocol\n  Listeners, and\n* sees HTTP, HTTPS, or TLS protocols with the same `port` as one with TCP\n  Protocol.\n\nIn this case all the Listeners that share a port with the TCP Listener are not distinct and so MUST NOT be accepted.\n\nIf an implementation does not support TCP Protocol Listeners, then the previous rule does not apply, and the TCP Listeners SHOULD NOT be accepted.\n\nNote that the `tls` field is not used for determining if a listener is distinct, because Listeners that _only_ differ on TLS config will still conflict in all cases.\n\n### Listeners that are distinct only by Hostname\n\nWhen the Listeners are distinct based only on Hostname, inbound request hostnames MUST match from the most specific to least specific Hostname values to choose the correct Listener and its associated set of Routes.\n\nExact matches MUST be processed before wildcard matches, and wildcard matches MUST be processed before fallback (empty Hostname value) matches. For example, `\"foo.example.com\"` takes precedence over `\"*.example.com\"`, and `\"*.example.com\"` takes precedence over `\"\"`.\n\nAdditionally, if there are multiple wildcard entries, more specific wildcard entries must be processed before less specific wildcard entries. For example, `\"*.foo.example.com\"` takes precedence over `\"*.example.com\"`.\n\nThe precise definition here is that the higher the number of dots in the hostname to the right of the wildcard character, the higher the precedence.\n\nThe wildcard character will match any number of characters _and dots_ to the left, however, so `\"*.example.com\"` will match both `\"foo.bar.example.com\"` _and_ `\"bar.example.com\"`.\n\n## Handling indistinct Listeners\n\nIf a set of Listeners contains Listeners that are not distinct, then those Listeners are _Conflicted_, and the implementation MUST set the \"Conflicted\" condition in the Listener Status to \"True\".\n\nThe words \"indistinct\" and \"conflicted\" are considered equivalent for the purpose of this documentation.\n\nImplementations MAY choose to accept a Gateway with some Conflicted Listeners only if they only accept the partial Listener set that contains no Conflicted Listeners.\n\nSpecifically, an implementation MAY accept a partial Listener set subject to the following rules:\n\n* The implementation MUST NOT pick one conflicting Listener as the winner.\n  ALL indistinct Listeners must not be accepted for processing.\n* At least one distinct Listener MUST be present, or else the Gateway effectively\n  contains _no_ Listeners, and must be rejected from processing as a whole.\n\nThe implementation MUST set a \"ListenersNotValid\" condition on the Gateway Status when the Gateway contains Conflicted Listeners whether or not they accept the Gateway. That Condition SHOULD clearly indicate in the Message which Listeners are conflicted, and which are Accepted. Additionally, the Listener status for those listeners SHOULD indicate which Listeners are conflicted and not Accepted.\n\n## General Listener behavior\n\nNote that, for all distinct Listeners, requests SHOULD match at most one Listener. For example, if Listeners are defined for \"foo.example.com\" and \"*.example.com\", a request to \"foo.example.com\" SHOULD only be routed using routes attached to the \"foo.example.com\" Listener (and not the \"*.example.com\" Listener).\n\nThis concept is known as \"Listener Isolation\", and it is an Extended feature of Gateway API. Implementations that do not support Listener Isolation MUST clearly document this, and MUST NOT claim support for the `GatewayHTTPListenerIsolation` feature.\n\nImplementations that _do_ support Listener Isolation SHOULD claim support for the Extended `GatewayHTTPListenerIsolation` feature and pass the associated conformance tests.\n\n## Compatible Listeners\n\nA Gateway's Listeners are considered _compatible_ if:\n\n1. They are distinct. 2. The implementation can serve them in compliance with the Addresses\n   requirement that all Listeners are available on all assigned\n   addresses.\n\nCompatible combinations in Extended support are expected to vary across implementations. A combination that is compatible for one implementation may not be compatible for another.\n\nFor example, an implementation that cannot serve both TCP and UDP listeners on the same address, or cannot mix HTTPS and generic TLS listens on the same port would not consider those cases compatible, even though they are distinct.\n\nImplementations MAY merge separate Gateways onto a single set of Addresses if all Listeners across all Gateways are compatible.\n\nSupport: Core",
+							Description: "Listeners associated with this Gateway. Listeners define logical endpoints that are bound on this Gateway's addresses. At least one Listener MUST be specified.\n\n## Distinct Listeners\n\nEach Listener in a set of Listeners (for example, in a single Gateway) MUST be _distinct_, in that a traffic flow MUST be able to be assigned to exactly one listener. (This section uses \"set of Listeners\" rather than \"Listeners in a single Gateway\" because implementations MAY merge configuration from multiple Gateways onto a single data plane, and these rules _also_ apply in that case).\n\nPractically, this means that each listener in a set MUST have a unique combination of Port, Protocol, and, if supported by the protocol, Hostname.\n\nSome combinations of port, protocol, and TLS settings are considered Core support and MUST be supported by implementations based on the objects they support:\n\nHTTPRoute\n\n1. HTTPRoute, Port: 80, Protocol: HTTP 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided\n\nTLSRoute\n\n1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough\n\n\"Distinct\" Listeners have the following property:\n\n**The implementation can match inbound requests to a single distinct Listener**.\n\nWhen multiple Listeners share values for fields (for example, two Listeners with the same Port value), the implementation can match requests to only one of the Listeners using other Listener fields.\n\nWhen multiple listeners have the same value for the Protocol field, then each of the Listeners with matching Protocol values MUST have different values for other fields.\n\nThe set of fields that MUST be different for a Listener differs per protocol. The following rules define the rules for what fields MUST be considered for Listeners to be distinct with each protocol currently defined in the Gateway API spec.\n\nThe set of listeners that all share a protocol value MUST have _different_ values for _at least one_ of these fields to be distinct:\n\n* **HTTP, HTTPS, TLS**: Port, Hostname * **TCP, UDP**: Port\n\nOne **very** important rule to call out involves what happens when an implementation:\n\n* Supports TCP protocol Listeners, as well as HTTP, HTTPS, or TLS protocol\n  Listeners, and\n* sees HTTP, HTTPS, or TLS protocols with the same `port` as one with TCP\n  Protocol.\n\nIn this case all the Listeners that share a port with the TCP Listener are not distinct and so MUST NOT be accepted.\n\nIf an implementation does not support TCP Protocol Listeners, then the previous rule does not apply, and the TCP Listeners SHOULD NOT be accepted.\n\nNote that the `tls` field is not used for determining if a listener is distinct, because Listeners that _only_ differ on TLS config will still conflict in all cases.\n\n### Listeners that are distinct only by Hostname\n\nWhen the Listeners are distinct based only on Hostname, inbound request hostnames MUST match from the most specific to least specific Hostname values to choose the correct Listener and its associated set of Routes.\n\nExact matches MUST be processed before wildcard matches, and wildcard matches MUST be processed before fallback (empty Hostname value) matches. For example, `\"foo.example.com\"` takes precedence over `\"*.example.com\"`, and `\"*.example.com\"` takes precedence over `\"\"`.\n\nAdditionally, if there are multiple wildcard entries, more specific wildcard entries must be processed before less specific wildcard entries. For example, `\"*.foo.example.com\"` takes precedence over `\"*.example.com\"`.\n\nThe precise definition here is that the higher the number of dots in the hostname to the right of the wildcard character, the higher the precedence.\n\nThe wildcard character will match any number of characters _and dots_ to the left, however, so `\"*.example.com\"` will match both `\"foo.bar.example.com\"` _and_ `\"bar.example.com\"`.\n\n## Handling indistinct Listeners\n\nIf a set of Listeners contains Listeners that are not distinct, then those Listeners are _Conflicted_, and the implementation MUST set the \"Conflicted\" condition in the Listener Status to \"True\".\n\nThe words \"indistinct\" and \"conflicted\" are considered equivalent for the purpose of this documentation.\n\nImplementations MAY choose to accept a Gateway with some Conflicted Listeners only if they only accept the partial Listener set that contains no Conflicted Listeners.\n\nSpecifically, an implementation MAY accept a partial Listener set subject to the following rules:\n\n* The implementation MUST NOT pick one conflicting Listener as the winner.\n  ALL indistinct Listeners must not be accepted for processing.\n* At least one distinct Listener MUST be present, or else the Gateway effectively\n  contains _no_ Listeners, and must be rejected from processing as a whole.\n\nThe implementation MUST set a \"ListenersNotValid\" condition on the Gateway Status when the Gateway contains Conflicted Listeners whether or not they accept the Gateway. That Condition SHOULD clearly indicate in the Message which Listeners are conflicted, and which are Accepted. Additionally, the Listener status for those listeners SHOULD indicate which Listeners are conflicted and not Accepted.\n\n## General Listener behavior\n\nNote that, for all distinct Listeners, requests SHOULD match at most one Listener. For example, if Listeners are defined for \"foo.example.com\" and \"*.example.com\", a request to \"foo.example.com\" SHOULD only be routed using routes attached to the \"foo.example.com\" Listener (and not the \"*.example.com\" Listener).\n\nThis concept is known as \"Listener Isolation\", and it is an Extended feature of Gateway API. Implementations that do not support Listener Isolation MUST clearly document this, and MUST NOT claim support for the `GatewayHTTPListenerIsolation` feature.\n\nImplementations that _do_ support Listener Isolation SHOULD claim support for the Extended `GatewayHTTPListenerIsolation` feature and pass the associated conformance tests.\n\n## Compatible Listeners\n\nA Gateway's Listeners are considered _compatible_ if:\n\n1. They are distinct. 2. The implementation can serve them in compliance with the Addresses\n   requirement that all Listeners are available on all assigned\n   addresses.\n\nCompatible combinations in Extended support are expected to vary across implementations. A combination that is compatible for one implementation may not be compatible for another.\n\nFor example, an implementation that cannot serve both TCP and UDP listeners on the same address, or cannot mix HTTPS and generic TLS listens on the same port would not consider those cases compatible, even though they are distinct.\n\nImplementations MAY merge separate Gateways onto a single set of Addresses if all Listeners across all Gateways are compatible.\n\nIn a future release the MinItems=1 requirement MAY be dropped.\n\nSupport: Core",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -3977,12 +4012,18 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS"),
 						},
 					},
+					"allowedListeners": {
+						SchemaProps: spec.SchemaProps{
+							Description: "AllowedListeners defines which ListenerSets can be attached to this Gateway. While this feature is experimental, the default value is to allow no ListenerSets.\n\n<gateway:experimental>",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.AllowedListeners"),
+						},
+					},
 				},
 				Required: []string{"gatewayClassName", "listeners"},
 			},
 		},
 		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1.GatewayAddress", "sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS", "sigs.k8s.io/gateway-api/apis/v1.GatewayInfrastructure", "sigs.k8s.io/gateway-api/apis/v1.Listener"},
+			"sigs.k8s.io/gateway-api/apis/v1.AllowedListeners", "sigs.k8s.io/gateway-api/apis/v1.GatewayAddress", "sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS", "sigs.k8s.io/gateway-api/apis/v1.GatewayInfrastructure", "sigs.k8s.io/gateway-api/apis/v1.Listener"},
 	}
 }
 
@@ -4092,8 +4133,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewayTLSConfig(ref common.ReferenceC
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "GatewayTLSConfig describes a TLS configuration.",
-				Type:        []string{"object"},
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
 					"mode": {
 						SchemaProps: spec.SchemaProps{
@@ -4219,6 +4259,113 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPBackendRef(ref common.ReferenceCal
 	}
 }
 
+func schema_sigsk8sio_gateway_api_apis_v1_HTTPCORSFilter(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "HTTPCORSFilter defines a filter that that configures Cross-Origin Request Sharing (CORS).",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"allowOrigins": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "set",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "AllowOrigins indicates whether the response can be shared with requested resource from the given `Origin`.\n\nThe `Origin` consists of a scheme and a host, with an optional port, and takes the form `<scheme>://<host>(:<port>)`.\n\nValid values for scheme are: `http` and `https`.\n\nValid values for port are any integer between 1 and 65535 (the list of available TCP/UDP ports). Note that, if not included, port `80` is assumed for `http` scheme origins, and port `443` is assumed for `https` origins. This may affect origin matching.\n\nThe host part of the origin may contain the wildcard character `*`. These wildcard characters behave as follows:\n\n* `*` is a greedy match to the _left_, including any number of\n  DNS labels to the left of its position. This also means that\n  `*` will include any number of period `.` characters to the\n  left of its position.\n* A wildcard by itself matches all hosts.\n\nAn origin value that includes _only_ the `*` character indicates requests from all `Origin`s are allowed.\n\nWhen the `AllowOrigins` field is configured with multiple origins, it means the server supports clients from multiple origins. If the request `Origin` matches the configured allowed origins, the gateway must return the given `Origin` and sets value of the header `Access-Control-Allow-Origin` same as the `Origin` header provided by the client.\n\nThe status code of a successful response to a \"preflight\" request is always an OK status (i.e., 204 or 200).\n\nIf the request `Origin` does not match the configured allowed origins, the gateway returns 204/200 response but doesn't set the relevant cross-origin response headers. Alternatively, the gateway responds with 403 status to the \"preflight\" request is denied, coupled with omitting the CORS headers. The cross-origin request fails on the client side. Therefore, the client doesn't attempt the actual cross-origin request.\n\nThe `Access-Control-Allow-Origin` response header can only use `*` wildcard as value when the `AllowCredentials` field is unspecified.\n\nWhen the `AllowCredentials` field is specified and `AllowOrigins` field specified with the `*` wildcard, the gateway must return a single origin in the value of the `Access-Control-Allow-Origin` response header, instead of specifying the `*` wildcard. The value of the header `Access-Control-Allow-Origin` is same as the `Origin` header provided by the client.\n\nSupport: Extended",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: "",
+										Type:    []string{"string"},
+										Format:  "",
+									},
+								},
+							},
+						},
+					},
+					"allowCredentials": {
+						SchemaProps: spec.SchemaProps{
+							Description: "AllowCredentials indicates whether the actual cross-origin request allows to include credentials.\n\nThe only valid value for the `Access-Control-Allow-Credentials` response header is true (case-sensitive).\n\nIf the credentials are not allowed in cross-origin requests, the gateway will omit the header `Access-Control-Allow-Credentials` entirely rather than setting its value to false.\n\nSupport: Extended",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"allowMethods": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "set",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "AllowMethods indicates which HTTP methods are supported for accessing the requested resource.\n\nValid values are any method defined by RFC9110, along with the special value `*`, which represents all HTTP methods are allowed.\n\nMethod names are case sensitive, so these values are also case-sensitive. (See https://www.rfc-editor.org/rfc/rfc2616#section-5.1.1)\n\nMultiple method names in the value of the `Access-Control-Allow-Methods` response header are separated by a comma (\",\").\n\nA CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`. (See https://fetch.spec.whatwg.org/#cors-safelisted-method) The CORS-safelisted methods are always allowed, regardless of whether they are specified in the `AllowMethods` field.\n\nWhen the `AllowMethods` field is configured with one or more methods, the gateway must return the `Access-Control-Allow-Methods` response header which value is present in the `AllowMethods` field.\n\nIf the HTTP method of the `Access-Control-Request-Method` request header is not included in the list of methods specified by the response header `Access-Control-Allow-Methods`, it will present an error on the client side.\n\nThe `Access-Control-Allow-Methods` response header can only use `*` wildcard as value when the `AllowCredentials` field is unspecified.\n\nWhen the `AllowCredentials` field is specified and `AllowMethods` field specified with the `*` wildcard, the gateway must specify one HTTP method in the value of the Access-Control-Allow-Methods response header. The value of the header `Access-Control-Allow-Methods` is same as the `Access-Control-Request-Method` header provided by the client. If the header `Access-Control-Request-Method` is not included in the request, the gateway will omit the `Access-Control-Allow-Methods` response header, instead of specifying the `*` wildcard. A Gateway implementation may choose to add implementation-specific default methods.\n\nSupport: Extended",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: "",
+										Type:    []string{"string"},
+										Format:  "",
+									},
+								},
+							},
+						},
+					},
+					"allowHeaders": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "set",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "AllowHeaders indicates which HTTP request headers are supported for accessing the requested resource.\n\nHeader names are not case sensitive.\n\nMultiple header names in the value of the `Access-Control-Allow-Headers` response header are separated by a comma (\",\").\n\nWhen the `AllowHeaders` field is configured with one or more headers, the gateway must return the `Access-Control-Allow-Headers` response header which value is present in the `AllowHeaders` field.\n\nIf any header name in the `Access-Control-Request-Headers` request header is not included in the list of header names specified by the response header `Access-Control-Allow-Headers`, it will present an error on the client side.\n\nIf any header name in the `Access-Control-Allow-Headers` response header does not recognize by the client, it will also occur an error on the client side.\n\nA wildcard indicates that the requests with all HTTP headers are allowed. The `Access-Control-Allow-Headers` response header can only use `*` wildcard as value when the `AllowCredentials` field is unspecified.\n\nWhen the `AllowCredentials` field is specified and `AllowHeaders` field specified with the `*` wildcard, the gateway must specify one or more HTTP headers in the value of the `Access-Control-Allow-Headers` response header. The value of the header `Access-Control-Allow-Headers` is same as the `Access-Control-Request-Headers` header provided by the client. If the header `Access-Control-Request-Headers` is not included in the request, the gateway will omit the `Access-Control-Allow-Headers` response header, instead of specifying the `*` wildcard. A Gateway implementation may choose to add implementation-specific default headers.\n\nSupport: Extended",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: "",
+										Type:    []string{"string"},
+										Format:  "",
+									},
+								},
+							},
+						},
+					},
+					"exposeHeaders": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "set",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "ExposeHeaders indicates which HTTP response headers can be exposed to client-side scripts in response to a cross-origin request.\n\nA CORS-safelisted response header is an HTTP header in a CORS response that it is considered safe to expose to the client scripts. The CORS-safelisted response headers include the following headers: `Cache-Control` `Content-Language` `Content-Length` `Content-Type` `Expires` `Last-Modified` `Pragma` (See https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name) The CORS-safelisted response headers are exposed to client by default.\n\nWhen an HTTP header name is specified using the `ExposeHeaders` field, this additional header will be exposed as part of the response to the client.\n\nHeader names are not case sensitive.\n\nMultiple header names in the value of the `Access-Control-Expose-Headers` response header are separated by a comma (\",\").\n\nA wildcard indicates that the responses with all HTTP headers are exposed to clients. The `Access-Control-Expose-Headers` response header can only use `*` wildcard as value when the `AllowCredentials` field is unspecified.\n\nSupport: Extended",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: "",
+										Type:    []string{"string"},
+										Format:  "",
+									},
+								},
+							},
+						},
+					},
+					"maxAge": {
+						SchemaProps: spec.SchemaProps{
+							Description: "MaxAge indicates the duration (in seconds) for the client to cache the results of a \"preflight\" request.\n\nThe information provided by the `Access-Control-Allow-Methods` and `Access-Control-Allow-Headers` response headers can be cached by the client until the time specified by `Access-Control-Max-Age` elapses.\n\nThe default value of `Access-Control-Max-Age` response header is 5 (seconds).",
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
 func schema_sigsk8sio_gateway_api_apis_v1_HTTPHeader(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -4228,7 +4375,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPHeader(ref common.ReferenceCallbac
 				Properties: map[string]spec.Schema{
 					"name": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent.",
+							Description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent.",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
@@ -4344,7 +4491,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPHeaderMatch(ref common.ReferenceCa
 					},
 					"name": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, only the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent.\n\nWhen a header is repeated in an HTTP request, it is implementation-specific behavior as to how this is represented. Generally, proxies should follow the guidance from the RFC: https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding processing a repeated header, with special handling for \"Set-Cookie\".",
+							Description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, only the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent.\n\nWhen a header is repeated in an HTTP request, it is implementation-specific behavior as to how this is represented. Generally, proxies should follow the guidance from the RFC: https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding processing a repeated header, with special handling for \"Set-Cookie\".",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
@@ -4481,14 +4628,14 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRequestMirrorFilter(ref common.Ref
 					},
 					"percent": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Percent represents the percentage of requests that should be mirrored to BackendRef. Its minimum value is 0 (indicating 0% of requests) and its maximum value is 100 (indicating 100% of requests).\n\nOnly one of Fraction or Percent may be specified. If neither field is specified, 100% of requests will be mirrored.\n\n<gateway:experimental>",
+							Description: "Percent represents the percentage of requests that should be mirrored to BackendRef. Its minimum value is 0 (indicating 0% of requests) and its maximum value is 100 (indicating 100% of requests).\n\nOnly one of Fraction or Percent may be specified. If neither field is specified, 100% of requests will be mirrored.",
 							Type:        []string{"integer"},
 							Format:      "int32",
 						},
 					},
 					"fraction": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Fraction represents the fraction of requests that should be mirrored to BackendRef.\n\nOnly one of Fraction or Percent may be specified. If neither field is specified, 100% of requests will be mirrored.\n\n<gateway:experimental>",
+							Description: "Fraction represents the fraction of requests that should be mirrored to BackendRef.\n\nOnly one of Fraction or Percent may be specified. If neither field is specified, 100% of requests will be mirrored.",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.Fraction"),
 						},
 					},
@@ -4609,7 +4756,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteFilter(ref common.ReferenceCa
 				Properties: map[string]spec.Schema{
 					"type": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Type identifies the type of filter to apply. As with other API fields, types are classified into three conformance levels:\n\n- Core: Filter types and their corresponding configuration defined by\n  \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n  implementations must support core filters.\n\n- Extended: Filter types and their corresponding configuration defined by\n  \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n  are encouraged to support extended filters.\n\n- Implementation-specific: Filters that are defined and supported by\n  specific vendors.\n  In the future, filters showing convergence in behavior across multiple\n  implementations will be considered for inclusion in extended or core\n  conformance levels. Filter-specific configuration for such filters\n  is specified using the ExtensionRef field. `Type` should be set to\n  \"ExtensionRef\" for custom filters.\n\nImplementers are encouraged to define custom implementation types to extend the core API with implementation-specific behavior.\n\nIf a reference to a custom filter type cannot be resolved, the filter MUST NOT be skipped. Instead, requests that would have been processed by that filter MUST receive a HTTP error response.\n\nNote that values may be added to this enum, implementations must ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`.",
+							Description: "Type identifies the type of filter to apply. As with other API fields, types are classified into three conformance levels:\n\n- Core: Filter types and their corresponding configuration defined by\n  \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n  implementations must support core filters.\n\n- Extended: Filter types and their corresponding configuration defined by\n  \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n  are encouraged to support extended filters.\n\n- Implementation-specific: Filters that are defined and supported by\n  specific vendors.\n  In the future, filters showing convergence in behavior across multiple\n  implementations will be considered for inclusion in extended or core\n  conformance levels. Filter-specific configuration for such filters\n  is specified using the ExtensionRef field. `Type` should be set to\n  \"ExtensionRef\" for custom filters.\n\nImplementers are encouraged to define custom implementation types to extend the core API with implementation-specific behavior.\n\nIf a reference to a custom filter type cannot be resolved, the filter MUST NOT be skipped. Instead, requests that would have been processed by that filter MUST receive a HTTP error response.\n\nNote that values may be added to this enum, implementations must ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`.\n\n<gateway:experimental:validation:Enum=RequestHeaderModifier;ResponseHeaderModifier;RequestMirror;RequestRedirect;URLRewrite;ExtensionRef;CORS>",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
@@ -4629,7 +4776,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteFilter(ref common.ReferenceCa
 					},
 					"requestMirror": {
 						SchemaProps: spec.SchemaProps{
-							Description: "RequestMirror defines a schema for a filter that mirrors requests. Requests are sent to the specified destination, but responses from that destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that not all implementations will be able to support mirroring to multiple backends.\n\nSupport: Extended\n\n\n<gateway:experimental:validation:XValidation:message=\"Only one of percent or fraction may be specified in HTTPRequestMirrorFilter\",rule=\"!(has(self.percent) && has(self.fraction))\">",
+							Description: "RequestMirror defines a schema for a filter that mirrors requests. Requests are sent to the specified destination, but responses from that destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that not all implementations will be able to support mirroring to multiple backends.\n\nSupport: Extended",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.HTTPRequestMirrorFilter"),
 						},
 					},
@@ -4645,6 +4792,12 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteFilter(ref common.ReferenceCa
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.HTTPURLRewriteFilter"),
 						},
 					},
+					"cors": {
+						SchemaProps: spec.SchemaProps{
+							Description: "CORS defines a schema for a filter that responds to the cross-origin request based on HTTP response header.\n\nSupport: Extended\n\n<gateway:experimental>",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.HTTPCORSFilter"),
+						},
+					},
 					"extensionRef": {
 						SchemaProps: spec.SchemaProps{
 							Description: "ExtensionRef is an optional, implementation-specific extension to the \"filter\" behavior.  For example, resource \"myroutefilter\" in group \"networking.example.net\"). ExtensionRef MUST NOT be used for core and extended filters.\n\nThis filter can be used multiple times within the same rule.\n\nSupport: Implementation-specific",
@@ -4656,7 +4809,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteFilter(ref common.ReferenceCa
 			},
 		},
 		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1.HTTPHeaderFilter", "sigs.k8s.io/gateway-api/apis/v1.HTTPRequestMirrorFilter", "sigs.k8s.io/gateway-api/apis/v1.HTTPRequestRedirectFilter", "sigs.k8s.io/gateway-api/apis/v1.HTTPURLRewriteFilter", "sigs.k8s.io/gateway-api/apis/v1.LocalObjectReference"},
+			"sigs.k8s.io/gateway-api/apis/v1.HTTPCORSFilter", "sigs.k8s.io/gateway-api/apis/v1.HTTPHeaderFilter", "sigs.k8s.io/gateway-api/apis/v1.HTTPRequestMirrorFilter", "sigs.k8s.io/gateway-api/apis/v1.HTTPRequestRedirectFilter", "sigs.k8s.io/gateway-api/apis/v1.HTTPURLRewriteFilter", "sigs.k8s.io/gateway-api/apis/v1.LocalObjectReference"},
 	}
 }
 
@@ -4853,7 +5006,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteRule(ref common.ReferenceCall
 					},
 					"filters": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Filters define the filters that are applied to requests that match this rule.\n\nWherever possible, implementations SHOULD implement filters in the order they are specified.\n\nImplementations MAY choose to implement this ordering strictly, rejecting any combination or order of filters that can not be supported. If implementations choose a strict interpretation of filter ordering, they MUST clearly document that behavior.\n\nTo reject an invalid combination or order of filters, implementations SHOULD consider the Route Rules with this configuration invalid. If all Route Rules in a Route are invalid, the entire Route would be considered invalid. If only a portion of Route Rules are invalid, implementations MUST set the \"PartiallyInvalid\" condition for the Route.\n\nConformance-levels at this level are defined based on the type of filter:\n\n- ALL core filters MUST be supported by all implementations. - Implementers are encouraged to support extended filters. - Implementation-specific custom filters have no API guarantees across\n  implementations.\n\nSpecifying the same filter multiple times is not supported unless explicitly indicated in the filter.\n\nAll filters are expected to be compatible with each other except for the URLRewrite and RequestRedirect filters, which may not be combined. If an implementation can not support other combinations of filters, they must clearly document that limitation. In cases where incompatible or unsupported filters are specified and cause the `Accepted` condition to be set to status `False`, implementations may use the `IncompatibleFilters` reason to specify this configuration error.\n\nSupport: Core",
+							Description: "Filters define the filters that are applied to requests that match this rule.\n\nWherever possible, implementations SHOULD implement filters in the order they are specified.\n\nImplementations MAY choose to implement this ordering strictly, rejecting any combination or order of filters that cannot be supported. If implementations choose a strict interpretation of filter ordering, they MUST clearly document that behavior.\n\nTo reject an invalid combination or order of filters, implementations SHOULD consider the Route Rules with this configuration invalid. If all Route Rules in a Route are invalid, the entire Route would be considered invalid. If only a portion of Route Rules are invalid, implementations MUST set the \"PartiallyInvalid\" condition for the Route.\n\nConformance-levels at this level are defined based on the type of filter:\n\n- ALL core filters MUST be supported by all implementations. - Implementers are encouraged to support extended filters. - Implementation-specific custom filters have no API guarantees across\n  implementations.\n\nSpecifying the same filter multiple times is not supported unless explicitly indicated in the filter.\n\nAll filters are expected to be compatible with each other except for the URLRewrite and RequestRedirect filters, which may not be combined. If an implementation cannot support other combinations of filters, they must clearly document that limitation. In cases where incompatible or unsupported filters are specified and cause the `Accepted` condition to be set to status `False`, implementations may use the `IncompatibleFilters` reason to specify this configuration error.\n\nSupport: Core",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -5065,7 +5218,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_Listener(ref common.ReferenceCallback)
 					},
 					"hostname": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, all hostnames are matched. This field is ignored for protocols that don't require hostname based matching.\n\nImplementations MUST apply Hostname matching appropriately for each of the following protocols:\n\n* TLS: The Listener Hostname MUST match the SNI. * HTTP: The Listener Hostname MUST match the Host header of the request. * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP\n  protocol layers as described above. If an implementation does not\n  ensure that both the SNI and Host header match the Listener hostname,\n  it MUST clearly document that.\n\nFor HTTPRoute and TLSRoute resources, there is an interaction with the `spec.hostnames` array. When both listener and route specify hostnames, there MUST be an intersection between the values for a Route to be accepted. For more information, refer to the Route specific Hostnames documentation.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\nSupport: Core",
+							Description: "Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, all hostnames are matched. This field is ignored for protocols that don't require hostname based matching.\n\nImplementations MUST apply Hostname matching appropriately for each of the following protocols:\n\n* TLS: The Listener Hostname MUST match the SNI. * HTTP: The Listener Hostname MUST match the Host header of the request. * HTTPS: The Listener Hostname SHOULD match both the SNI and Host header.\n  Note that this does not require the SNI and Host header to be the same.\n  The semantics of this are described in more detail below.\n\nTo ensure security, Section 11.1 of RFC-6066 emphasizes that server implementations that rely on SNI hostname matching MUST also verify hostnames within the application protocol.\n\nSection 9.1.2 of RFC-7540 provides a mechanism for servers to reject the reuse of a connection by responding with the HTTP 421 Misdirected Request status code. This indicates that the origin server has rejected the request because it appears to have been misdirected.\n\nTo detect misdirected requests, Gateways SHOULD match the authority of the requests with all the SNI hostname(s) configured across all the Gateway Listeners on the same port and protocol:\n\n* If another Listener has an exact match or more specific wildcard entry,\n  the Gateway SHOULD return a 421.\n* If the current Listener (selected by SNI matching during ClientHello)\n  does not match the Host:\n    * If another Listener does match the Host the Gateway SHOULD return a\n      421.\n    * If no other Listener matches the Host, the Gateway MUST return a\n      404.\n\nFor HTTPRoute and TLSRoute resources, there is an interaction with the `spec.hostnames` array. When both listener and route specify hostnames, there MUST be an intersection between the values for a Route to be accepted. For more information, refer to the Route specific Hostnames documentation.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\nSupport: Core",
 							Type:        []string{"string"},
 							Format:      "",
 						},
@@ -5107,6 +5260,34 @@ func schema_sigsk8sio_gateway_api_apis_v1_Listener(ref common.ReferenceCallback)
 	}
 }
 
+func schema_sigsk8sio_gateway_api_apis_v1_ListenerNamespaces(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ListenerNamespaces indicate which namespaces ListenerSets should be selected from.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"from": {
+						SchemaProps: spec.SchemaProps{
+							Description: "From indicates where ListenerSets can attach to this Gateway. Possible values are:\n\n* Same: Only ListenerSets in the same namespace may be attached to this Gateway. * Selector: ListenerSets in namespaces selected by the selector may be attached to this Gateway. * All: ListenerSets in all namespaces may be attached to this Gateway. * None: Only listeners defined in the Gateway's spec are allowed\n\nWhile this feature is experimental, the default value None",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"selector": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Selector must be specified when From is set to \"Selector\". In that case, only ListenerSets in Namespaces matching this Selector will be selected by this Gateway. This field is ignored for other values of \"From\".",
+							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector"),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector"},
+	}
+}
+
 func schema_sigsk8sio_gateway_api_apis_v1_ListenerStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -5260,7 +5441,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_ObjectReference(ref common.ReferenceCa
 				Properties: map[string]spec.Schema{
 					"group": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\". When unspecified or empty string, core API group is inferred.",
+							Description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\". When set to the empty string, core API group is inferred.",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
@@ -5402,8 +5583,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_RouteGroupKind(ref common.ReferenceCal
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "RouteGroupKind indicates the group and kind of a Route resource.",
-				Type:        []string{"object"},
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
 						SchemaProps: spec.SchemaProps{
@@ -5487,7 +5667,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_RouteParentStatus(ref common.Reference
 							},
 						},
 						SchemaProps: spec.SchemaProps{
-							Description: "Conditions describes the status of the route with respect to the Gateway. Note that the route's availability is also subject to the Gateway's own status conditions and listener status.\n\nIf the Route's ParentRef specifies an existing Gateway that supports Routes of this kind AND that Gateway's controller has sufficient access, then that Gateway's controller MUST set the \"Accepted\" condition on the Route, to indicate whether the route has been accepted or rejected by the Gateway, and why.\n\nA Route MUST be considered \"Accepted\" if at least one of the Route's rules is implemented by the Gateway.\n\nThere are a number of cases where the \"Accepted\" condition may not be set due to lack of controller visibility, that includes when:\n\n* The Route refers to a non-existent parent. * The Route is of a type that the controller does not support. * The Route is in a namespace the controller does not have access to.",
+							Description: "Conditions describes the status of the route with respect to the Gateway. Note that the route's availability is also subject to the Gateway's own status conditions and listener status.\n\nIf the Route's ParentRef specifies an existing Gateway that supports Routes of this kind AND that Gateway's controller has sufficient access, then that Gateway's controller MUST set the \"Accepted\" condition on the Route, to indicate whether the route has been accepted or rejected by the Gateway, and why.\n\nA Route MUST be considered \"Accepted\" if at least one of the Route's rules is implemented by the Gateway.\n\nThere are a number of cases where the \"Accepted\" condition may not be set due to lack of controller visibility, that includes when:\n\n* The Route refers to a nonexistent parent. * The Route is of a type that the controller does not support. * The Route is in a namespace the controller does not have access to.",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -5585,8 +5765,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_SessionPersistence(ref common.Referenc
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "SessionPersistence defines the desired state of SessionPersistence.",
-				Type:        []string{"object"},
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
 					"sessionName": {
 						SchemaProps: spec.SchemaProps{
@@ -5916,8 +6095,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_LocalPolicyTargetReference(ref c
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "LocalPolicyTargetReference identifies an API object to apply a direct or inherited policy to. This should be used as part of Policy resources that can target Gateway API resources. For more information on how this policy attachment model works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API.",
-				Type:        []string{"object"},
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
 						SchemaProps: spec.SchemaProps{
@@ -6097,8 +6275,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_PolicyStatus(ref common.Referenc
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "PolicyStatus defines the common attributes that all Policies should include within their status.",
-				Type:        []string{"object"},
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
 					"ancestors": {
 						SchemaProps: spec.SchemaProps{
@@ -6329,7 +6506,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_TCPRouteRule(ref common.Referenc
 					},
 					"backendRefs": {
 						SchemaProps: spec.SchemaProps{
-							Description: "BackendRefs defines the backend(s) where matching requests should be sent. If unspecified or invalid (refers to a non-existent resource or a Service with no endpoints), the underlying implementation MUST actively reject connection attempts to this backend. Connection rejections must respect weight; if an invalid backend is requested to have 80% of connections, then 80% of connections must be rejected instead.\n\nSupport: Core for Kubernetes Service\n\nSupport: Extended for Kubernetes ServiceImport\n\nSupport: Implementation-specific for any other resource\n\nSupport for weight: Extended",
+							Description: "BackendRefs defines the backend(s) where matching requests should be sent. If unspecified or invalid (refers to a nonexistent resource or a Service with no endpoints), the underlying implementation MUST actively reject connection attempts to this backend. Connection rejections must respect weight; if an invalid backend is requested to have 80% of connections, then 80% of connections must be rejected instead.\n\nSupport: Core for Kubernetes Service\n\nSupport: Extended for Kubernetes ServiceImport\n\nSupport: Implementation-specific for any other resource\n\nSupport for weight: Extended",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -6538,7 +6715,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_TLSRouteRule(ref common.Referenc
 					},
 					"backendRefs": {
 						SchemaProps: spec.SchemaProps{
-							Description: "BackendRefs defines the backend(s) where matching requests should be sent. If unspecified or invalid (refers to a non-existent resource or a Service with no endpoints), the rule performs no forwarding; if no filters are specified that would result in a response being sent, the underlying implementation must actively reject request attempts to this backend, by rejecting the connection or returning a 500 status code. Request rejections must respect weight; if an invalid backend is requested to have 80% of requests, then 80% of requests must be rejected instead.\n\nSupport: Core for Kubernetes Service\n\nSupport: Extended for Kubernetes ServiceImport\n\nSupport: Implementation-specific for any other resource\n\nSupport for weight: Extended",
+							Description: "BackendRefs defines the backend(s) where matching requests should be sent. If unspecified or invalid (refers to a nonexistent resource or a Service with no endpoints), the rule performs no forwarding; if no filters are specified that would result in a response being sent, the underlying implementation must actively reject request attempts to this backend, by rejecting the connection or returning a 500 status code. Request rejections must respect weight; if an invalid backend is requested to have 80% of requests, then 80% of requests must be rejected instead.\n\nSupport: Core for Kubernetes Service\n\nSupport: Extended for Kubernetes ServiceImport\n\nSupport: Implementation-specific for any other resource\n\nSupport for weight: Extended",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -6762,7 +6939,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_UDPRouteRule(ref common.Referenc
 					},
 					"backendRefs": {
 						SchemaProps: spec.SchemaProps{
-							Description: "BackendRefs defines the backend(s) where matching requests should be sent. If unspecified or invalid (refers to a non-existent resource or a Service with no endpoints), the underlying implementation MUST actively reject connection attempts to this backend. Packet drops must respect weight; if an invalid backend is requested to have 80% of the packets, then 80% of packets must be dropped instead.\n\nSupport: Core for Kubernetes Service\n\nSupport: Extended for Kubernetes ServiceImport\n\nSupport: Implementation-specific for any other resource\n\nSupport for weight: Extended",
+							Description: "BackendRefs defines the backend(s) where matching requests should be sent. If unspecified or invalid (refers to a nonexistent resource or a Service with no endpoints), the underlying implementation MUST actively reject connection attempts to this backend. Packet drops must respect weight; if an invalid backend is requested to have 80% of the packets, then 80% of packets must be dropped instead.\n\nSupport: Core for Kubernetes Service\n\nSupport: Extended for Kubernetes ServiceImport\n\nSupport: Implementation-specific for any other resource\n\nSupport for weight: Extended",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -7017,7 +7194,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicyValidation(ref c
 				Properties: map[string]spec.Schema{
 					"caCertificateRefs": {
 						SchemaProps: spec.SchemaProps{
-							Description: "CACertificateRefs contains one or more references to Kubernetes objects that contain a PEM-encoded TLS CA certificate bundle, which is used to validate a TLS handshake between the Gateway and backend Pod.\n\nIf CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified, not both. If CACertifcateRefs is empty or unspecified, the configuration for WellKnownCACertificates MUST be honored instead if supported by the implementation.\n\nReferences to a resource in a different namespace are invalid for the moment, although we will revisit this in the future.\n\nA single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support. Implementations MAY choose to support attaching multiple certificates to a backend, but this behavior is implementation-specific.\n\nSupport: Core - An optional single reference to a Kubernetes ConfigMap, with the CA certificate in a key named `ca.crt`.\n\nSupport: Implementation-specific (More than one reference, or other kinds of resources).",
+							Description: "CACertificateRefs contains one or more references to Kubernetes objects that contain a PEM-encoded TLS CA certificate bundle, which is used to validate a TLS handshake between the Gateway and backend Pod.\n\nIf CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified, not both. If CACertificateRefs is empty or unspecified, the configuration for WellKnownCACertificates MUST be honored instead if supported by the implementation.\n\nReferences to a resource in a different namespace are invalid for the moment, although we will revisit this in the future.\n\nA single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support. Implementations MAY choose to support attaching multiple certificates to a backend, but this behavior is implementation-specific.\n\nSupport: Core - An optional single reference to a Kubernetes ConfigMap, with the CA certificate in a key named `ca.crt`.\n\nSupport: Implementation-specific (More than one reference, or other kinds of resources).",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -7038,7 +7215,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicyValidation(ref c
 					},
 					"hostname": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Hostname is used for two purposes in the connection between Gateways and backends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066). 2. If SubjectAltNames is not specified, Hostname MUST be used for\n   authentication and MUST match the certificate served by the matching\n   backend.\n\nSupport: Core",
+							Description: "Hostname is used for two purposes in the connection between Gateways and backends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066). 2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.\n   authentication and MUST match the certificate served by the matching\n   backend.\n\nSupport: Core",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
@@ -7046,7 +7223,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicyValidation(ref c
 					},
 					"subjectAltNames": {
 						SchemaProps: spec.SchemaProps{
-							Description: "SubjectAltNames contains one or more Subject Alternative Names. When specified, the certificate served from the backend MUST have at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\nSupport: Core",
+							Description: "SubjectAltNames contains one or more Subject Alternative Names. When specified the certificate served from the backend MUST have at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\nSupport: Extended",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -7609,3 +7786,593 @@ func schema_sigsk8sio_gateway_api_apis_v1beta1_ReferenceGrantTo(ref common.Refer
 		},
 	}
 }
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_BackendTrafficPolicy(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "BackendTrafficPolicy defines the configuration for how traffic to a target backend should be handled.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec defines the desired state of BackendTrafficPolicy.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.BackendTrafficPolicySpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status defines the current state of BackendTrafficPolicy.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyStatus"),
+						},
+					},
+				},
+				Required: []string{"spec"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta", "sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyStatus", "sigs.k8s.io/gateway-api/apisx/v1alpha1.BackendTrafficPolicySpec"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_BackendTrafficPolicyList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "BackendTrafficPolicyList contains a list of BackendTrafficPolicies",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.BackendTrafficPolicy"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta", "sigs.k8s.io/gateway-api/apisx/v1alpha1.BackendTrafficPolicy"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_BackendTrafficPolicySpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "BackendTrafficPolicySpec define the desired state of BackendTrafficPolicy Note: there is no Override or Default policy configuration.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"targetRefs": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"group",
+									"kind",
+									"name",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "TargetRefs identifies API object(s) to apply this policy to. Currently, Backends (A grouping of like endpoints such as Service, ServiceImport, or any implementation-specific backendRef) are the only valid API target references.\n\nCurrently, a TargetRef can not be scoped to a specific port on a Service.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1alpha2.LocalPolicyTargetReference"),
+									},
+								},
+							},
+						},
+					},
+					"retryConstraint": {
+						SchemaProps: spec.SchemaProps{
+							Description: "RetryConstraint defines the configuration for when to allow or prevent further retries to a target backend, by dynamically calculating a 'retry budget'. This budget is calculated based on the percentage of incoming traffic composed of retries over a given time interval. Once the budget is exceeded, additional retries will be rejected.\n\nFor example, if the retry budget interval is 10 seconds, there have been 1000 active requests in the past 10 seconds, and the allowed percentage of requests that can be retried is 20% (the default), then 200 of those requests may be composed of retries. Active requests will only be considered for the duration of the interval when calculating the retry budget. Retrying the same original request multiple times within the retry budget interval will lead to each retry being counted towards calculating the budget.\n\nConfiguring a RetryConstraint in BackendTrafficPolicy is compatible with HTTPRoute Retry settings for each HTTPRouteRule that targets the same backend. While the HTTPRouteRule Retry stanza can specify whether a request will be retried, and the number of retry attempts each client may perform, RetryConstraint helps prevent cascading failures such as retry storms during periods of consistent failures.\n\nAfter the retry budget has been exceeded, additional retries to the backend MUST return a 503 response to the client.\n\nAdditional configurations for defining a constraint on retries MAY be defined in the future.\n\nSupport: Extended\n\n<gateway:experimental>",
+							Ref:         ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.RetryConstraint"),
+						},
+					},
+					"sessionPersistence": {
+						SchemaProps: spec.SchemaProps{
+							Description: "SessionPersistence defines and configures session persistence for the backend.\n\nSupport: Extended",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.SessionPersistence"),
+						},
+					},
+				},
+				Required: []string{"targetRefs"},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apis/v1.SessionPersistence", "sigs.k8s.io/gateway-api/apis/v1alpha2.LocalPolicyTargetReference", "sigs.k8s.io/gateway-api/apisx/v1alpha1.RetryConstraint"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerEntry(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name is the name of the Listener. This name MUST be unique within a ListenerSet.\n\nName is not required to be unique across a Gateway and ListenerSets. Routes can attach to a Listener by having a ListenerSet as a parentRef and setting the SectionName",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"hostname": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, all hostnames are matched. This field is ignored for protocols that don't require hostname based matching.\n\nImplementations MUST apply Hostname matching appropriately for each of the following protocols:\n\n* TLS: The Listener Hostname MUST match the SNI. * HTTP: The Listener Hostname MUST match the Host header of the request. * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP\n  protocol layers as described above. If an implementation does not\n  ensure that both the SNI and Host header match the Listener hostname,\n  it MUST clearly document that.\n\nFor HTTPRoute and TLSRoute resources, there is an interaction with the `spec.hostnames` array. When both listener and route specify hostnames, there MUST be an intersection between the values for a Route to be accepted. For more information, refer to the Route specific Hostnames documentation.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"port": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules.",
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+					"protocol": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Protocol specifies the network protocol this listener expects to receive.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"tls": {
+						SchemaProps: spec.SchemaProps{
+							Description: "TLS is the TLS configuration for the Listener. This field is required if the Protocol field is \"HTTPS\" or \"TLS\". It is invalid to set this field if the Protocol field is \"HTTP\", \"TCP\", or \"UDP\".\n\nThe association of SNIs to Certificate defined in GatewayTLSConfig is defined based on the Hostname field for this listener.\n\nThe GatewayClass MUST use the longest matching SNI out of all available certificates for any TLS handshake.",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig"),
+						},
+					},
+					"allowedRoutes": {
+						SchemaProps: spec.SchemaProps{
+							Description: "AllowedRoutes defines the types of routes that MAY be attached to a Listener and the trusted namespaces where those Route resources MAY be present.\n\nAlthough a client request may match multiple route rules, only one rule may ultimately receive the request. Matching precedence MUST be determined in order of the following criteria:\n\n* The most specific match as defined by the Route type. * The oldest Route based on creation timestamp. For example, a Route with\n  a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over\n  a Route with a creation timestamp of \"2020-09-08 01:02:04\".\n* If everything else is equivalent, the Route appearing first in\n  alphabetical order (namespace/name) should be given precedence. For\n  example, foo/bar is given precedence over foo/baz.\n\nAll valid rules within a Route attached to this Listener should be implemented. Invalid Route rules can be ignored (sometimes that will mean the full Route). If a Route rule transitions from valid to invalid, support for that Route rule should be dropped to ensure consistency. For example, even if a filter specified by a Route rule is invalid, the rest of the rules within that Route should still be supported.",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.AllowedRoutes"),
+						},
+					},
+				},
+				Required: []string{"name", "protocol"},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apis/v1.AllowedRoutes", "sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerEntryStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ListenerStatus is the status associated with a Listener.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name is the name of the Listener that this status corresponds to.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"port": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Port is the network port the listener is configured to listen on.",
+							Default:     0,
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+					"supportedKinds": {
+						SchemaProps: spec.SchemaProps{
+							Description: "SupportedKinds is the list indicating the Kinds supported by this listener. This MUST represent the kinds an implementation supports for that Listener configuration.\n\nIf kinds are specified in Spec that are not supported, they MUST NOT appear in this list and an implementation MUST set the \"ResolvedRefs\" condition to \"False\" with the \"InvalidRouteKinds\" reason. If both valid and invalid Route kinds are specified, the implementation MUST reference the valid Route kinds that have been specified.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.RouteGroupKind"),
+									},
+								},
+							},
+						},
+					},
+					"attachedRoutes": {
+						SchemaProps: spec.SchemaProps{
+							Description: "AttachedRoutes represents the total number of Routes that have been successfully attached to this Listener.\n\nSuccessful attachment of a Route to a Listener is based solely on the combination of the AllowedRoutes field on the corresponding Listener and the Route's ParentRefs field. A Route is successfully attached to a Listener when it is selected by the Listener's AllowedRoutes field AND the Route has a valid ParentRef selecting the whole Gateway resource or a specific Listener as a parent resource (more detail on attachment semantics can be found in the documentation on the various Route kinds ParentRefs fields). Listener or Route status does not impact successful attachment, i.e. the AttachedRoutes field count MUST be set for Listeners with condition Accepted: false and MUST count successfully attached Routes that may themselves have Accepted: false conditions.\n\nUses for this field include troubleshooting Route attachment and measuring blast radius/impact of changes to a Listener.",
+							Default:     0,
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+					"conditions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"type",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Conditions describe the current condition of this listener.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.Condition"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"name", "port", "supportedKinds", "attachedRoutes", "conditions"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.Condition", "sigs.k8s.io/gateway-api/apis/v1.RouteGroupKind"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSet(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ListenerSet defines a set of additional listeners to attach to an existing Gateway.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec defines the desired state of ListenerSet.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSetSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status defines the current state of ListenerSet.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSetStatus"),
+						},
+					},
+				},
+				Required: []string{"spec"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta", "sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSetSpec", "sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSetStatus"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSetList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSet"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta", "sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSet"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSetSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ListenerSetSpec defines the desired state of a ListenerSet.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"parentRef": {
+						SchemaProps: spec.SchemaProps{
+							Description: "ParentRef references the Gateway that the listeners are attached to.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.ParentGatewayReference"),
+						},
+					},
+					"listeners": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"name",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Listeners associated with this ListenerSet. Listeners define logical endpoints that are bound on this referenced parent Gateway's addresses.\n\nListeners in a `Gateway` and their attached `ListenerSets` are concatenated as a list when programming the underlying infrastructure. Each listener name does not need to be unique across the Gateway and ListenerSets. See ListenerEntry.Name for more details.\n\nImplementations MUST treat the parent Gateway as having the merged list of all listeners from itself and attached ListenerSets using the following precedence:\n\n1. \"parent\" Gateway 2. ListenerSet ordered by creation time (oldest first) 3. ListenerSet ordered alphabetically by “{namespace}/{name}”.\n\nAn implementation MAY reject listeners by setting the ListenerEntryStatus `Accepted`` condition to False with the Reason `TooManyListeners`\n\nIf a listener has a conflict, this will be reported in the Status.ListenerEntryStatus setting the `Conflicted` condition to True.\n\nImplementations SHOULD be cautious about what information from the parent or siblings are reported to avoid accidentally leaking sensitive information that the child would not otherwise have access to. This can include contents of secrets etc.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerEntry"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"parentRef", "listeners"},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerEntry", "sigs.k8s.io/gateway-api/apisx/v1alpha1.ParentGatewayReference"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSetStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"conditions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"type",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Conditions describe the current conditions of the ListenerSet.\n\nImplementations MUST express ListenerSet conditions using the `ListenerSetConditionType` and `ListenerSetConditionReason` constants so that operators and tools can converge on a common vocabulary to describe ListenerSet state.\n\nKnown condition types are:\n\n* \"Accepted\" * \"Programmed\"",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.Condition"),
+									},
+								},
+							},
+						},
+					},
+					"listeners": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"name",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Listeners provide status for each unique listener port defined in the Spec.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerEntryStatus"),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.Condition", "sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerEntryStatus"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_ParentGatewayReference(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ParentGatewayReference identifies an API object including its namespace, defaulting to Gateway.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Group is the group of the referent.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is kind of the referent. For example \"Gateway\".",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name is the name of the referent.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"namespace": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Namespace is the namespace of the referent.  If not present, the namespace of the referent is assumed to be the same as the namespace of the referring object.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"name"},
+			},
+		},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_RequestRate(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "RequestRate expresses a rate of requests over a given period of time.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"count": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Count specifies the number of requests per time interval.\n\nSupport: Extended",
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+					"interval": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Interval specifies the divisor of the rate of requests, the amount of time during which the given count of requests occur.\n\nSupport: Extended",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_RetryConstraint(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "RetryConstraint defines the configuration for when to retry a request.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"budgetPercent": {
+						SchemaProps: spec.SchemaProps{
+							Description: "BudgetPercent defines the maximum percentage of active requests that may be made up of retries.\n\nSupport: Extended",
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+					"budgetInterval": {
+						SchemaProps: spec.SchemaProps{
+							Description: "BudgetInterval defines the duration in which requests will be considered for calculating the budget for retries.\n\nSupport: Extended",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"minRetryRate": {
+						SchemaProps: spec.SchemaProps{
+							Description: "MinRetryRate defines the minimum rate of retries that will be allowable over a specified duration of time.\n\nThe effective overall minimum rate of retries targeting the backend service may be much higher, as there can be any number of clients which are applying this setting locally.\n\nThis ensures that requests can still be retried during periods of low traffic, where the budget for retries may be calculated as a very low value.\n\nSupport: Extended",
+							Ref:         ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.RequestRate"),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apisx/v1alpha1.RequestRate"},
+	}
+}
diff --git a/pkg/generator/main.go b/pkg/generator/main.go
index d178f919..dc170b88 100644
--- a/pkg/generator/main.go
+++ b/pkg/generator/main.go
@@ -49,6 +49,7 @@ func main() {
 		"sigs.k8s.io/gateway-api/apis/v1alpha2",
 		"sigs.k8s.io/gateway-api/apis/v1beta1",
 		"sigs.k8s.io/gateway-api/apis/v1",
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1",
 	)
 	if err != nil {
 		log.Fatalf("failed to load package roots: %s", err)
@@ -111,7 +112,7 @@ func main() {
 				if channel == "standard" && strings.Contains(version.Name, "alpha") {
 					channelCrd.Spec.Versions[i].Served = false
 				}
-				version.Schema.OpenAPIV3Schema.Properties = gatewayTweaks(channel, version.Schema.OpenAPIV3Schema.Properties)
+				version.Schema.OpenAPIV3Schema.Properties = gatewayTweaksMap(channel, version.Schema.OpenAPIV3Schema.Properties)
 			}
 
 			conv, err := crd.AsVersion(*channelCrd, apiext.SchemeGroupVersion)
@@ -133,97 +134,105 @@ func main() {
 	}
 }
 
-// Custom Gateway API Tweaks for tags prefixed with `<gateway:` that get past
-// the limitations of Kubebuilder annotations.
-func gatewayTweaks(channel string, props map[string]apiext.JSONSchemaProps) map[string]apiext.JSONSchemaProps {
+func gatewayTweaksMap(channel string, props map[string]apiext.JSONSchemaProps) map[string]apiext.JSONSchemaProps {
 	for name := range props {
 		jsonProps, _ := props[name]
+		p := gatewayTweaks(channel, name, jsonProps)
+		if p == nil {
+			delete(props, name)
+		} else {
+			props[name] = *p
+		}
+	}
+	return props
+}
 
-		if strings.Contains(jsonProps.Description, "<gateway:validateIPAddress>") {
-			jsonProps.Items.Schema.OneOf = []apiext.JSONSchemaProps{{
-				Properties: map[string]apiext.JSONSchemaProps{
-					"type": {
-						Enum: []apiext.JSON{{Raw: []byte("\"IPAddress\"")}},
-					},
-					"value": {
-						AnyOf: []apiext.JSONSchemaProps{{
-							Format: "ipv4",
-						}, {
-							Format: "ipv6",
-						}},
-					},
+// Custom Gateway API Tweaks for tags prefixed with `<gateway:` that get past
+// the limitations of Kubebuilder annotations.
+func gatewayTweaks(channel string, name string, jsonProps apiext.JSONSchemaProps) *apiext.JSONSchemaProps {
+	if strings.Contains(jsonProps.Description, "<gateway:validateIPAddress>") {
+		jsonProps.Items.Schema.OneOf = []apiext.JSONSchemaProps{{
+			Properties: map[string]apiext.JSONSchemaProps{
+				"type": {
+					Enum: []apiext.JSON{{Raw: []byte("\"IPAddress\"")}},
 				},
-			}, {
-				Properties: map[string]apiext.JSONSchemaProps{
-					"type": {
-						Not: &apiext.JSONSchemaProps{
-							Enum: []apiext.JSON{{Raw: []byte("\"IPAddress\"")}},
-						},
+				"value": {
+					AnyOf: []apiext.JSONSchemaProps{{
+						Format: "ipv4",
+					}, {
+						Format: "ipv6",
+					}},
+				},
+			},
+		}, {
+			Properties: map[string]apiext.JSONSchemaProps{
+				"type": {
+					Not: &apiext.JSONSchemaProps{
+						Enum: []apiext.JSON{{Raw: []byte("\"IPAddress\"")}},
 					},
 				},
-			}}
-		}
-
-		if channel == "standard" && strings.Contains(jsonProps.Description, "<gateway:experimental>") {
-			delete(props, name)
-			continue
-		}
+			},
+		}}
+	}
 
-		// TODO(robscott): Figure out why crdgen switched this to "object"
-		if jsonProps.Format == "date-time" {
-			jsonProps.Type = "string"
+	if channel == "standard" {
+		if strings.Contains(jsonProps.Description, "<gateway:experimental>") {
+			return nil
 		}
+	}
 
-		validationPrefix := fmt.Sprintf("<gateway:%s:validation:", channel)
-		numExpressions := strings.Count(jsonProps.Description, validationPrefix)
-		numValid := 0
-		if numExpressions > 0 {
-			enumRe := regexp.MustCompile(validationPrefix + "Enum=([A-Za-z;]*)>")
-			enumMatches := enumRe.FindAllStringSubmatch(jsonProps.Description, 64)
-			for _, enumMatch := range enumMatches {
-				if len(enumMatch) != 2 {
-					log.Fatalf("Invalid %s Enum tag for %s", validationPrefix, name)
-				}
+	// TODO(robscott): Figure out why crdgen switched this to "object"
+	if jsonProps.Format == "date-time" {
+		jsonProps.Type = "string"
+	}
 
-				numValid++
-				jsonProps.Enum = []apiext.JSON{}
-				for _, val := range strings.Split(enumMatch[1], ";") {
-					jsonProps.Enum = append(jsonProps.Enum, apiext.JSON{Raw: []byte("\"" + val + "\"")})
-				}
+	validationPrefix := fmt.Sprintf("<gateway:%s:validation:", channel)
+	numExpressions := strings.Count(jsonProps.Description, validationPrefix)
+	numValid := 0
+	if numExpressions > 0 {
+		enumRe := regexp.MustCompile(validationPrefix + "Enum=([A-Za-z;]*)>")
+		enumMatches := enumRe.FindAllStringSubmatch(jsonProps.Description, 64)
+		for _, enumMatch := range enumMatches {
+			if len(enumMatch) != 2 {
+				log.Fatalf("Invalid %s Enum tag for %s", validationPrefix, name)
 			}
 
-			celRe := regexp.MustCompile(validationPrefix + "XValidation:message=\"([^\"]*)\",rule=\"([^\"]*)\">")
-			celMatches := celRe.FindAllStringSubmatch(jsonProps.Description, 64)
-			for _, celMatch := range celMatches {
-				if len(celMatch) != 3 {
-					log.Fatalf("Invalid %s CEL tag for %s", validationPrefix, name)
-				}
-
-				numValid++
-				jsonProps.XValidations = append(jsonProps.XValidations, apiext.ValidationRule{
-					Message: celMatch[1],
-					Rule:    celMatch[2],
-				})
+			numValid++
+			jsonProps.Enum = []apiext.JSON{}
+			for _, val := range strings.Split(enumMatch[1], ";") {
+				jsonProps.Enum = append(jsonProps.Enum, apiext.JSON{Raw: []byte("\"" + val + "\"")})
 			}
 		}
 
-		if numValid < numExpressions {
-			fmt.Printf("Description: %s\n", jsonProps.Description)
-			log.Fatalf("Found %d Gateway validation expressions, but only %d were valid", numExpressions, numValid)
+		celRe := regexp.MustCompile(validationPrefix + "XValidation:message=\"([^\"]*)\",rule=\"([^\"]*)\">")
+		celMatches := celRe.FindAllStringSubmatch(jsonProps.Description, 64)
+		for _, celMatch := range celMatches {
+			if len(celMatch) != 3 {
+				log.Fatalf("Invalid %s CEL tag for %s", validationPrefix, name)
+			}
+
+			numValid++
+			jsonProps.XValidations = append(jsonProps.XValidations, apiext.ValidationRule{
+				Message: celMatch[1],
+				Rule:    celMatch[2],
+			})
 		}
+	}
 
-		jsonProps.Description = formatDescription(jsonProps.Description, channel, name)
+	if numValid < numExpressions {
+		fmt.Printf("Description: %s\n", jsonProps.Description)
+		log.Fatalf("Found %d Gateway validation expressions, but only %d were valid", numExpressions, numValid)
+	}
 
-		if len(jsonProps.Properties) > 0 {
-			jsonProps.Properties = gatewayTweaks(channel, jsonProps.Properties)
-		} else if jsonProps.Items != nil && jsonProps.Items.Schema != nil {
-			jsonProps.Items.Schema.Description = formatDescription(jsonProps.Items.Schema.Description, channel, name)
-			jsonProps.Items.Schema.Properties = gatewayTweaks(channel, jsonProps.Items.Schema.Properties)
-		}
+	jsonProps.Description = formatDescription(jsonProps.Description, channel, name)
 
-		props[name] = jsonProps
+	if len(jsonProps.Properties) > 0 {
+		jsonProps.Properties = gatewayTweaksMap(channel, jsonProps.Properties)
+	} else if jsonProps.Items != nil && jsonProps.Items.Schema != nil {
+		jsonProps.Items.Schema = gatewayTweaks(channel, name, *jsonProps.Items.Schema)
 	}
-	return props
+
+	return &jsonProps
 }
 
 func formatDescription(description string, channel string, name string) string {
diff --git a/pkg/gep/gepdetail.go b/pkg/gep/gepdetail.go
index dd793029..a8c2d1c7 100644
--- a/pkg/gep/gepdetail.go
+++ b/pkg/gep/gepdetail.go
@@ -56,7 +56,7 @@ type GEPDetail struct {
 	// Valid values are provided in the constants for the GEPStatus type.
 	Status GEPStatus `json:"status"`
 
-	// The GEP's authors, listed as their Github handles.
+	// The GEP's authors, listed as their GitHub handles.
 	Authors []string `json:"authors"`
 
 	// Relationships describes the possible relationships between this GEP and
diff --git a/requirements.txt b/requirements.txt
index ccd28200..a60c2396 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,6 @@
 Click==8.1.8
 htmlmin==0.1.12
-Jinja2==3.1.5
+Jinja2==3.1.6
 jsmin==3.0.1
 livereload==2.7.1
 # mkdocs 2.4.1 requires Markdown < 3.4.0
@@ -10,8 +10,7 @@ MarkupSafe==3.0.2
 mkdocs==1.6.1
 mkdocs-awesome-pages-plugin==2.10.1
 mkdocs-macros-plugin==1.3.7
-mkdocs-material==9.6.1
-mkdocs-material-extensions==1.3.1
+mkdocs-material==9.6.7
 mkdocs-redirects==1.2.2
 mkdocs-mermaid2-plugin==1.2.1
 pandas>=2.0.3
diff --git a/site-src/api-types/backendtlspolicy.md b/site-src/api-types/backendtlspolicy.md
index 7a2e5683..c0645d44 100644
--- a/site-src/api-types/backendtlspolicy.md
+++ b/site-src/api-types/backendtlspolicy.md
@@ -4,7 +4,7 @@
 
     The `BackendTLSPolicy` resource is Alpha and has been part of
     the Experimental Channel since `v1.0.0`. For more information on release
-    channels, refer to our [versioning guide](/concepts/versioning).
+    channels, refer to our [versioning guide](../concepts/versioning.md).
 
 [BackendTLSPolicy][backendtlspolicy] is a Gateway API type for specifying the TLS configuration
 of the connection from the Gateway to a backend pod/s via the Service API object.
@@ -13,18 +13,18 @@ of the connection from the Gateway to a backend pod/s via the Service API object
 
 `BackendTLSPolicy` specifically addresses the configuration of TLS in order to convey HTTPS from the Gateway
 dataplane to the backend.  This is referred to as "backend TLS termination" and enables the Gateway to know
-how to connect to a backend pod that has its own certificate.  
+how to connect to a backend pod that has its own certificate.
 
 While there are other API objects provided for TLS to be configured for **passthrough** and **edge** termination,
 this API object allows users to specifically configure **backend** TLS termination.  For more information on TLS
-configuration in Gateway API, see [TLS Configuration](/guides/tls/).
+configuration in Gateway API, see [TLS Configuration](../guides/tls.md).
 
-![Image showing three TLS Termination Types](/images/tls-termination-types.png)
+![Image showing three TLS Termination Types](../images/tls-termination-types.png)
 
-BackendTLSPolicy is a Direct [PolicyAttachment](/reference/policy-attachment/) without defaults or overrides,
+BackendTLSPolicy is a Direct [PolicyAttachment](../reference/policy-attachment.md) without defaults or overrides,
 applied to a Service that accesses a backend, where the BackendTLSPolicy resides in the same namespace as the
 Service to which it is applied. The BackendTLSPolicy and the Service must reside in the same namespace in order
-to prevent the complications involved with sharing trust across namespace boundaries.  
+to prevent the complications involved with sharing trust across namespace boundaries.
 
 All Gateway API Routes that point to a referenced Service should respect a configured BackendTLSPolicy.
 
@@ -37,10 +37,10 @@ The specification of a [BackendTLSPolicy][backendtlspolicy] consists of:
 WellKnownCACertificates.
 - [Hostname][hostname] - Defines the Server Name Indication (SNI) that the Gateway uses to connect to the backend.
 - [CACertificateRefs][caCertificateRefs] - Defines one or more references to objects that contain PEM-encoded TLS certificates,
-which are used to establish a TLS handshake between the Gateway and backend Pod.  Either CACertficateRefs or
+which are used to establish a TLS handshake between the Gateway and backend Pod.  Either CACertificateRefs or
 WellKnownCACertificates may be specified, but not both.
 - [WellKnownCACertificates][wellKnownCACertificates] - Specifies whether system CA certificates may be used in the TLS
-handshake between the Gateway and backend Pod.  Either CACertficateRefs or WellKnownCACertificates may be specified, but not both.
+handshake between the Gateway and backend Pod.  Either CACertificateRefs or WellKnownCACertificates may be specified, but not both.
 
 The following chart outlines the object definitions and relationship:
 ```mermaid
@@ -57,7 +57,7 @@ flowchart LR
     spec -->targetRefs & validation
     status -->ancestorStatus
     targetRefs -->service
-    note[<em>choose only one<hr> caCerticateRefs OR wellKnownCACertificates</em>]
+    note[<em>choose only one<hr> caCertificateRefs OR wellKnownCACertificates</em>]
     style note fill:#fff
     validation -.- note
 ```
@@ -117,7 +117,7 @@ The BackendTLSPolicyValidation must contain a certificate reference of some kind
 certificate to use for backend TLS, CACertificateRefs and WellKnownCACertificates.  Only one of these may be used per
 BackendTLSPolicyValidation.
 
-##### CACertficateRefs
+##### CACertificateRefs
 
 CACertificateRefs refer to one or more PEM-encoded TLS certificates.
 
diff --git a/site-src/api-types/gateway.md b/site-src/api-types/gateway.md
index d670cf56..372eab5a 100644
--- a/site-src/api-types/gateway.md
+++ b/site-src/api-types/gateway.md
@@ -4,7 +4,7 @@
 
     The `Gateway` resource is GA and has been part of the Standard Channel since
     `v0.5.0`. For more information on release channels, refer to our [versioning
-    guide](/concepts/versioning).
+    guide](../concepts/versioning.md).
 
 A `Gateway` is 1:1 with the lifecycle of the configuration of infrastructure.
 When a user creates a `Gateway`, some load balancing infrastructure is
diff --git a/site-src/api-types/gatewayclass.md b/site-src/api-types/gatewayclass.md
index ab88bed3..9eb2fd67 100644
--- a/site-src/api-types/gatewayclass.md
+++ b/site-src/api-types/gatewayclass.md
@@ -1,10 +1,10 @@
 # GatewayClass
 
 ??? success "Standard Channel since v0.5.0"
-    
+
     The `GatewayClass` resource is GA and has been part of the Standard Channel since
     `v0.5.0`. For more information on release channels, refer to our [versioning
-    guide](/concepts/versioning).
+    guide](../concepts/versioning.md).
 
 [GatewayClass][gatewayclass] is cluster-scoped resource defined by the
 infrastructure provider. This resource represents a class of Gateways that can
@@ -141,5 +141,5 @@ example.net/gateway/v2.1 // Use version 2.1
 example.net/gateway      // Use the default version
 ```
 
-[gatewayclass]: /reference/spec/#gateway.networking.k8s.io/v1.GatewayClass
+[gatewayclass]: ../reference/spec.md#gateway.networking.k8s.io/v1.GatewayClass
 [ingress-class-api]: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class
diff --git a/site-src/api-types/grpcroute.md b/site-src/api-types/grpcroute.md
index 0bb4a9b5..69dcfb40 100644
--- a/site-src/api-types/grpcroute.md
+++ b/site-src/api-types/grpcroute.md
@@ -4,7 +4,7 @@
 
     The `GRPCRoute` resource is GA and has been part of the Standard Channel since
     `v1.1.0`. For more information on release channels, refer to our [versioning
-    guide](/concepts/versioning).
+    guide](../concepts/versioning.md).
 
 [GRPCRoute][grpcroute] is a Gateway API type for specifying routing behavior
 of gRPC requests from a Gateway listener to an API object, i.e. Service.
@@ -33,7 +33,7 @@ level, it is acceptable to introduce a route resource at the higher layer when
 the following criteria are met:
 
 - Users of the encapsulated protocol would miss out on significant conventional features from their ecosystem if forced to route at a lower layer.
-- Users of the enapsulated protocol would experience a degraded user experience if forced to route at a lower layer.
+- Users of the encapsulated protocol would experience a degraded user experience if forced to route at a lower layer.
 - The encapsulated protocol has a significant user base, particularly in the Kubernetes community.
 
 gRPC meets all of these criteria, so the decision was made to include `GRPCRoute`in Gateway API.
@@ -70,7 +70,7 @@ The specification of a GRPCRoute consists of:
 
 <!--- Editable SVG available at site-src/images/grpcroute-basic-example.svg -->
 The following illustrates a GRPCRoute that sends all traffic to one Service:
-![grpcroute-basic-example](/images/grpcroute-basic-example.png)
+![grpcroute-basic-example](../images/grpcroute-basic-example.png)
 
 ### Attaching to Gateways
 
@@ -142,8 +142,8 @@ matches:
       service: com.example.User
       method: Login
     headers:
-      values:
-        version: "2"
+    - name: version
+      value: "2"
   - method:
       service: com.example.v2.User
       method: Login
@@ -185,7 +185,7 @@ Conformance levels are defined by the filter type:
 
 Specifying a core filter multiple times has unspecified or custom conformance.
 
-If an implementation can not support a combinations of filters, they must clearly
+If an implementation cannot support a combinations of filters, they must clearly
 document that limitation. In cases where incompatible or unsupported
 filters are specified and cause the `Accepted` condition to be set to status
 `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -223,9 +223,9 @@ on `weight` and other fields.
 
     This concept has been part of the Experimental Channel since `v1.2.0`.
     For more information on release channels, refer to our
-    [versioning guide](/concepts/versioning).
+    [versioning guide](../concepts/versioning.md).
 
-GRPCRoute Rules include an optional `name` field. The applications for the name of a route rule are implementation-specific. It can be used to reference individual route rules by name from other resources, such as in the `sectionName` field of metaresources ([GEP-2648](https://gateway-api.sigs.k8s.io/geps/gep-2648/#apply-policies-to-sections-of-a-resource)), in the status stanzas of resources related to the route object, to identify internal configuration objects generated by the implementation from GRPCRoute Rule, etc.
+GRPCRoute Rules include an optional `name` field. The applications for the name of a route rule are implementation-specific. It can be used to reference individual route rules by name from other resources, such as in the `sectionName` field of metaresources ([GEP-2648](../geps/gep-2648/index.md#apply-policies-to-sections-of-a-resource)), in the status stanzas of resources related to the route object, to identify internal configuration objects generated by the implementation from GRPCRoute Rule, etc.
 
 If specified, the value of the name field must comply with the [`SectionName`](https://github.com/kubernetes-sigs/gateway-api/blob/v1.0.0/apis/v1/shared_types.go#L607-L624) type.
 
@@ -272,11 +272,12 @@ Multiple GRPCRoutes can be attached to a single Gateway resource. Importantly,
 only one Route rule may match each request. For more information on how conflict
 resolution applies to merging, refer to the [API specification][grpcrouterule].
 
-[grpcroute]: /reference/spec/#gateway.networking.k8s.io/v1.GRPCPRoute
-[grpcrouterule]: /reference/spec/#gateway.networking.k8s.io/v1.GRPCRouteRule
-[hostname]: /reference/spec/#gateway.networking.k8s.io/v1.Hostname
+[grpcroute]: ../reference/spec.md#gateway.networking.k8s.io/v1.GRPCRoute
+[grpcrouterule]: ../reference/spec.md#gateway.networking.k8s.io/v1.GRPCRouteRule
+[hostname]: ../reference/spec.md#gateway.networking.k8s.io/v1.Hostname
 [rfc-3986]: https://tools.ietf.org/html/rfc3986
-[matches]: /reference/spec/#gateway.networking.k8s.io/v1.GRPCRouteMatch
-[filters]: /reference/spec/#gateway.networking.k8s.io/v1.GRPCRouteFilter
-[backendRef]: /reference/spec/#gateway.networking.k8s.io/v1.GRPCBackendRef
-[parentRef]: /reference/spec/#gateway.networking.k8s.io/v1.ParentRef
+[matches]: ../reference/spec.md#gateway.networking.k8s.io/v1.GRPCRouteMatch
+[filters]: ../reference/spec.md#gateway.networking.k8s.io/v1.GRPCRouteFilter
+[backendRef]: ../reference/spec.md#gateway.networking.k8s.io/v1.GRPCBackendRef
+[parentRef]: ../reference/spec.md#gateway.networking.k8s.io/v1.ParentRef
+[name]: ../reference/spec.md#gateway.networking.k8s.io/v1.SectionName
diff --git a/site-src/api-types/httproute.md b/site-src/api-types/httproute.md
index 1bdade68..e0a4ea33 100644
--- a/site-src/api-types/httproute.md
+++ b/site-src/api-types/httproute.md
@@ -4,7 +4,7 @@
 
     The `HTTPRoute` resource is GA and has been part of the Standard Channel since
     `v0.5.0`. For more information on release channels, refer to our [versioning
-    guide](/concepts/versioning).
+    guide](../concepts/versioning.md).
 
 [HTTPRoute][httproute] is a Gateway API type for specifying routing behavior
 of HTTP requests from a Gateway listener to an API object, i.e. Service.
@@ -23,7 +23,7 @@ The specification of an HTTPRoute consists of:
   [timeouts][timeouts] (optional), and [name][sectionName] (optional) fields.
 
 The following illustrates an HTTPRoute that sends all traffic to one Service:
-![httproute-basic-example](/images/httproute-basic-example.svg)
+![httproute-basic-example](../images/httproute-basic-example.svg)
 
 ### Attaching to Gateways
 
@@ -198,7 +198,7 @@ implementation-specific conformance.
 
 All filters are expected to be compatible with each other except for the
 URLRewrite and RequestRedirect filters, which may not be combined. If an
-implementation can not support other combinations of filters, they must clearly
+implementation cannot support other combinations of filters, they must clearly
 document that limitation. In cases where incompatible or unsupported
 filters are specified and cause the `Accepted` condition to be set to status
 `False`, implementations may use the `IncompatibleFilters` reason to specify
@@ -234,7 +234,7 @@ on `weight` and other fields.
 
     HTTPRoute timeouts have been part of the Experimental Channel since `v1.0.0`.
     For more information on release channels, refer to our
-    [versioning guide](/concepts/versioning).
+    [versioning guide](../concepts/versioning.md).
 
 HTTPRoute Rules include a `Timeouts` field. If unspecified, timeout behavior is implementation-specific.
 
@@ -246,7 +246,7 @@ There are 2 kinds of timeouts that can be configured in an HTTPRoute Rule:
 
 Because the `request` timeout encompasses the `backendRequest` timeout, the value of `backendRequest` must not be greater than the value of `request` timeout.
 
-Timeouts are optional, and their fields are of type [Duration](/geps/gep-2257/). A zero-valued timeout ("0s") MUST be interpreted as disabling the timeout. A valid non-zero-valued timeout MUST be >= 1ms.
+Timeouts are optional, and their fields are of type [Duration](../geps/gep-2257/index.md). A zero-valued timeout ("0s") MUST be interpreted as disabling the timeout. A valid non-zero-valued timeout MUST be >= 1ms.
 
 The following example uses the `request` field which will cause a timeout if a client request is taking longer than 10 seconds to complete. The example also defines a 2s `backendRequest` which specifies a timeout for an individual request from the gateway to a backend service `timeout-svc`:
 
@@ -262,9 +262,9 @@ Reference the [timeouts][timeouts] API documentation for additional details.
 
     This concept has been part of the Experimental Channel since `v1.2.0`.
     For more information on release channels, refer to our
-    [versioning guide](/concepts/versioning).
+    [versioning guide](../concepts/versioning.md).
 
-HTTPRoute Rules include an optional `name` field. The applications for the name of a route rule are implementation-specific. It can be used to reference individual route rules by name from other resources, such as in the `sectionName` field of metaresources ([GEP-2648](https://gateway-api.sigs.k8s.io/geps/gep-2648/#apply-policies-to-sections-of-a-resource)), in the status stanzas of resources related to the route object, to identify internal configuration objects generated by the implementation from HTTPRoute Rule, etc.
+HTTPRoute Rules include an optional `name` field. The applications for the name of a route rule are implementation-specific. It can be used to reference individual route rules by name from other resources, such as in the `sectionName` field of metaresources ([GEP-2648](../geps/gep-2648/index.md#apply-policies-to-sections-of-a-resource)), in the status stanzas of resources related to the route object, to identify internal configuration objects generated by the implementation from HTTPRoute Rule, etc.
 
 If specified, the value of the name field must comply with the [`SectionName`](https://github.com/kubernetes-sigs/gateway-api/blob/v1.0.0/apis/v1/shared_types.go#L607-L624) type.
 
@@ -280,7 +280,7 @@ The following example specifies the `name` field to identify HTTPRoute Rules use
 
     This concept has been part of the Experimental Channel since `v1.0.0`.
     For more information on release channels, refer to our
-    [versioning guide](/concepts/versioning).
+    [versioning guide](../concepts/versioning.md).
 
 Some implementations may require the [backendRef][backendRef] to be labeled
 explicitly in order to route traffic using a certain protocol. For Kubernetes
@@ -329,14 +329,14 @@ only one Route rule may match each request. For more information on how conflict
 resolution applies to merging, refer to the [API specification][httprouterule].
 
 
-[httproute]: /reference/spec/#gateway.networking.k8s.io/v1.HTTPRoute
-[httprouterule]: /reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteRule
-[hostname]: /reference/spec/#gateway.networking.k8s.io/v1.Hostname
+[httproute]: ../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRoute
+[httprouterule]: ../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteRule
+[hostname]: ../reference/spec.md#gateway.networking.k8s.io/v1.Hostname
 [rfc-3986]: https://tools.ietf.org/html/rfc3986
-[matches]: /reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteMatch
-[filters]: /reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteFilter
-[backendRef]: /reference/spec/#gateway.networking.k8s.io/v1.HTTPBackendRef
-[parentRef]: /reference/spec/#gateway.networking.k8s.io/v1.ParentRef
-[timeouts]: /reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteTimeouts
+[matches]: ../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteMatch
+[filters]: ../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteFilter
+[backendRef]: ../reference/spec.md#gateway.networking.k8s.io/v1.HTTPBackendRef
+[parentRef]: ../reference/spec.md#gateway.networking.k8s.io/v1.ParentRef
+[timeouts]: ../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteTimeouts
 [appProtocol]: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol
-[sectionName]: /reference/spec/#gateway.networking.k8s.io/v1.SectionName
+[sectionName]: ../reference/spec.md#gateway.networking.k8s.io/v1.SectionName
diff --git a/site-src/api-types/referencegrant.md b/site-src/api-types/referencegrant.md
index afe23652..9ac9964a 100644
--- a/site-src/api-types/referencegrant.md
+++ b/site-src/api-types/referencegrant.md
@@ -2,9 +2,9 @@
 
 ??? success "Standard Channel since v0.6.0"
 
-    The `ReferenceGrant` resource is Beta and part of the 
+    The `ReferenceGrant` resource is Beta and part of the
     Standard Channel since `v0.6.0`. For more information on release
-    channels, refer to our [versioning guide](/concepts/versioning).
+    channels, refer to our [versioning guide](../concepts/versioning.md).
 
 !!! note
     This resource was originally named "ReferencePolicy". It was renamed
@@ -14,7 +14,7 @@ A ReferenceGrant can be used to enable cross namespace references within
 Gateway API. In particular, Routes may forward traffic to backends in other
 namespaces, or Gateways may refer to Secrets in another namespace.
 
-![Reference Grant](/images/referencegrant-simple.svg)
+![Reference Grant](../images/referencegrant-simple.svg)
 <!-- Source: https://docs.google.com/presentation/d/11HEYCgFi-aya7FS91JvAfllHiIlvfgcp7qpi_Azjk4E/edit#slide=id.g13c18e3a7ab_0_171 -->
 
 In the past, we've seen that forwarding traffic across namespace boundaries is a
@@ -90,7 +90,7 @@ While the API is simplistic in nature, it comes with a few notable decisions:
    other. This makes it impossible for them to conflict with each other.
 
 Please see the [API
-Specification](/reference/spec#gateway.networking.k8s.io/v1alpha2.ReferenceGrant)
+Specification](../reference/spec.md#gateway.networking.k8s.io/v1alpha2.ReferenceGrant)
 for more details on how specific ReferenceGrant fields are interpreted.
 
 ## Implementation Guidelines
@@ -110,7 +110,7 @@ No hints should be provided about whether or not the referenced resource exists.
 Cross namespace Route -> Gateway binding follows a slightly different pattern
 where the handshake mechanism is built into the Gateway resource. For more
 information on that approach, refer to the relevant [Security Model
-documentation](/concepts/security-model). Although conceptually similar to
+documentation](../concepts/security-model.md). Although conceptually similar to
 ReferenceGrant, this configuration is built directly into Gateway Listeners,
 and allows for fine-grained per Listener configuration that would not be
 possible with ReferenceGrant.
diff --git a/site-src/blog/2021/introducing-v1alpha2.md b/site-src/blog/2021/introducing-v1alpha2.md
index e623f5e5..fe231f9f 100644
--- a/site-src/blog/2021/introducing-v1alpha2.md
+++ b/site-src/blog/2021/introducing-v1alpha2.md
@@ -25,7 +25,7 @@ an experimental API group (`networking.x-k8s.io`) to the new
 is concerned, this version is wholly distinct from v1alpha1, and automatic
 conversion is not possible.
 
-![New API group for v1alpha2](/images/v1alpha2-group.png)
+![New API group for v1alpha2](../../images/v1alpha2-group.png)
 
 ### Simpler Route-Gateway Binding
 In v1alpha1 we provided many ways to connect Gateways and Routes. This was a bit
@@ -55,7 +55,7 @@ spec:
       port: 8080
 ```
 
-This is covered in more detail in [GEP 724](/geps/gep-709/).
+This is covered in more detail in [GEP 724](../../geps/gep-709/index.md).
 
 ### Safe Cross Namespace References
 
@@ -63,7 +63,7 @@ This is covered in more detail in [GEP 724](/geps/gep-709/).
 
     The `ReferenceGrant` resource described below is currently only included in the
     "Experimental" channel of Gateway API. For more information on release
-    channels, refer to our [versioning guide](/concepts/versioning).
+    channels, refer to our [versioning guide](../../concepts/versioning.md).
 
 It is quite challenging to cross namespace boundaries in a safe manner. With
 Gateway API, we had several key feature requests that required this capability.
@@ -97,7 +97,7 @@ spec:
     kind: Service
 ```
 
-This is covered in more detail in [GEP 709](/geps/gep-709/).
+This is covered in more detail in [GEP 709](../../geps/gep-709/index.md).
 
 ### Policy Attachment
 One of the key goals of this API is to provide meaningful and consistent
@@ -125,16 +125,16 @@ This is intended to allow things like:
 As a simple example, a TimeoutPolicy may be attached to a Gateway. The effects
 of that policy would cascade down to Routes attached to that policy:
 
-![Simple Ingress Example](/images/policy/ingress-simple.png)
+![Simple Ingress Example](../../images/policy/ingress-simple.png)
 
-This is covered in more detail in [GEP 713](/geps/gep-713/).
+This is covered in more detail in [GEP 713](../../geps/gep-713/index.md).
 
 ## Next Steps
 There are a lot of changes in v1alpha2 that we haven't covered here. For the
 full changelog, refer to our [v0.4.0 release
 notes](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.4.0).
 
-Many of our [implementations](/implementations) are planning to release support
+Many of our [implementations](../../implementations.md) are planning to release support
 for the v1alpha2 API in the coming weeks. We'll update our documentation as
 v1alpha2 implementations become available.
 
diff --git a/site-src/blog/2022/graduating-to-beta.md b/site-src/blog/2022/graduating-to-beta.md
index 1dd41e25..70064b7f 100644
--- a/site-src/blog/2022/graduating-to-beta.md
+++ b/site-src/blog/2022/graduating-to-beta.md
@@ -40,9 +40,9 @@ invite you to jump in and find an implementation that suits you. At the time of
 this release there are over a dozen [implementations][impl] for popular API
 gateways and service meshes and guides are available to start exploring quickly.
 
-[gw]:/api-types/gateway/
+[gw]:../../api-types/gateway.md
 [ing]:https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/
-[impl]:/implementations/
+[impl]:../../implementations.md
 
 ### Getting started
 
@@ -69,9 +69,9 @@ repository, or join in the [discussions][disc]. Also check out the [community
 page][community] which includes links to the Slack channel and community meetings.
 
 [crd]:https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/
-[concepts]:/concepts/api-overview/
+[concepts]:../../concepts/api-overview.md
 [guides]:/guides/getting-started/
-[impl]:/implementations/
+[impl]:../../implementations.md
 [install-crds]:/guides/getting-started/#install-the-crds
 [issue]:https://github.com/kubernetes-sigs/gateway-api/issues/new/choose
 [disc]:https://github.com/kubernetes-sigs/gateway-api/discussions
@@ -84,9 +84,9 @@ page][community] which includes links to the Slack channel and community meeting
 The `v0.5.0` release is particularly historic because it marks the growth in
 maturity to a beta API version (`v1beta1`) release for some of the key APIs:
 
-- [GatewayClass](/api-types/gatewayclass/)
-- [Gateway](/api-types/gateway/)
-- [HTTPRoute](/api-types/httproute/)
+- [GatewayClass](../../api-types/gatewayclass.md)
+- [Gateway](../../api-types/gateway.md)
+- [HTTPRoute](../../api-types/httproute.md)
 
 This achievement was marked by the completion of several graduation criteria:
 
@@ -96,11 +96,11 @@ This achievement was marked by the completion of several graduation criteria:
 - Kubernetes SIG Network API reviewers have approved graduation to beta.
 
 For more information on Gateway API versioning, refer to the [official
-documentation](/concepts/versioning/). To see
+documentation](../../concepts/versioning.md). To see
 what's in store for future releases check out the [next steps](#next-steps)
 section.
 
-[impl]:/implementations/
+[impl]:../../implementations.md
 
 ### Release channels
 
@@ -125,10 +125,10 @@ and end-users.
 
 For this release we've added the following experimental features:
 
-- [Routes can attach to Gateways by specifying port numbers](/geps/gep-957/)
-- [URL rewrites and path redirects](/geps/gep-726/)
+- [Routes can attach to Gateways by specifying port numbers](../../geps/gep-957/index.md)
+- [URL rewrites and path redirects](../../geps/gep-726/index.md)
 
-[ch]:/concepts/versioning/#release-channels-eg-experimental-standard
+[ch]:../../concepts/versioning.md#release-channels-eg-experimental-standard
 
 ### Other improvements
 
@@ -137,7 +137,7 @@ the [v0.5.0 release notes](https://github.com/kubernetes-sigs/gateway-api/releas
 
 ## Gateway API for service mesh: the GAMMA Initiative
 Some service mesh projects have [already implemented support for the Gateway
-API](/implementations/). Significant overlap
+API](../../implementations.md). Significant overlap
 between the Service Mesh Interface (SMI) APIs and the Gateway API has [inspired
 discussion in the SMI
 community](https://github.com/servicemeshinterface/smi-spec/issues/249) about
diff --git a/site-src/blog/2023/0829-mesh-support.md b/site-src/blog/2023/0829-mesh-support.md
index 3b8b7741..6b79dc63 100644
--- a/site-src/blog/2023/0829-mesh-support.md
+++ b/site-src/blog/2023/0829-mesh-support.md
@@ -1,7 +1,7 @@
 ---
 description: >
   We are excited to announce the v0.8.0 release of Gateway API, where service
-  mesh support has has now reached Experimental status, we've introduced CEL
+  mesh support has now reached Experimental status, we've introduced CEL
   validation and a Mesh conformance profile, and more!
 ---
 
@@ -186,24 +186,24 @@ available in the [`standard` release channel][ch], since the GAMMA initiative
 has not needed to introduce new resources or fields to date.
 
 [gamma]:/concepts/gamma/
-[status]:/geps/overview/#status
-[ch]:/concepts/versioning/#release-channels-eg-experimental-standard
+[status]:../../geps/overview.md#status
+[ch]:../../concepts/versioning.md#release-channels-eg-experimental-standard
 [cel]:https://kubernetes.io/docs/reference/using-api/cel/
 [crd]:https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/
-[concepts]:/concepts/api-overview/
-[geps]:/contributing/enhancement-requests/
+[concepts]:../../concepts/api-overview.md
+[geps]:../../contributing/enhancement-requests.md
 [guides]:/guides/getting-started/
-[impl]:/implementations/
+[impl]:../../implementations.md
 [install-crds]:/guides/getting-started/#install-the-crds
 [issue]:https://github.com/kubernetes-sigs/gateway-api/issues/new/choose
 [disc]:https://github.com/kubernetes-sigs/gateway-api/discussions
 [community]:/contributing/community/
 [mesh-routing]:/concepts/gamma/#how-the-gateway-api-works-for-service-mesh
 [GEP-1426]:/geps/gep-1426/
-[GEP-1324]:/geps/gep-1324/
-[GEP-1686]:/geps/gep-1686/
-[GEP-1709]:/geps/gep-1709/
+[GEP-1324]:../../geps/gep-1324/index.md
+[GEP-1686]:../../geps/gep-1686/index.md
+[GEP-1709]:../../geps/gep-1709/index.md
 [issue 2277]:https://github.com/kubernetes-sigs/gateway-api/issues/2277
-[supported-versions]:/concepts/versioning/#supported-versions
+[supported-versions]:../../concepts/versioning.md#supported-versions
 [v0.8.0 release notes]:https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.8.0
-[versioning docs]:/concepts/versioning/
+[versioning docs]:../../concepts/versioning.md
diff --git a/site-src/blog/index.md b/site-src/blog/index.md
index 601d7eaf..98f4bcb1 100644
--- a/site-src/blog/index.md
+++ b/site-src/blog/index.md
@@ -17,8 +17,8 @@ your feedback!
 
 [:octicons-arrow-right-24: Continue reading][Gateway API: Introducing Service Mesh Support!]
 
-[status]:/geps/overview/#status
-[Gateway API: Introducing Service Mesh Support!]:/blog/2023/0829-mesh-support
+[status]:../geps/overview.md#status
+[Gateway API: Introducing Service Mesh Support!]:2023/0829-mesh-support.md
 
 ## [Gateway API Graduates to Beta]
 
@@ -35,7 +35,7 @@ rewrites.
 
 [:octicons-arrow-right-24: Continue reading][Gateway API Graduates to Beta]
 
-[Gateway API Graduates to Beta]:/blog/2022/graduating-to-beta
+[Gateway API Graduates to Beta]:2022/graduating-to-beta.md
 
 ## [Introducing Gateway API v1alpha2]
 
@@ -50,4 +50,4 @@ the highlights.
 
 [:octicons-arrow-right-24: Continue reading][Introducing Gateway API v1alpha2]
 
-[Introducing Gateway API v1alpha2]: /blog/2021/introducing-v1alpha2
+[Introducing Gateway API v1alpha2]: 2021/introducing-v1alpha2.md
diff --git a/site-src/concepts/api-overview.md b/site-src/concepts/api-overview.md
index 896961d4..d04f893b 100644
--- a/site-src/concepts/api-overview.md
+++ b/site-src/concepts/api-overview.md
@@ -10,7 +10,7 @@ There are 3 primary roles in Gateway API, as described in [roles and personas]:
 - **Chihiro** (they/them): Cluster Operator
 - **Ana** (she/her): Application Developer
 
-[roles and personas]:/concepts/roles-and-personas
+[roles and personas]:roles-and-personas.md
 
 ## Resource model
 
@@ -35,7 +35,7 @@ the cluster.
 
     The `GatewayClass` resource is GA and has been part of the Standard Channel since
     `v0.5.0`. For more information on release channels, refer to our [versioning
-    guide](/concepts/versioning).
+    guide](versioning.md).
 
 GatewayClass defines a set of Gateways that share a common configuration and
 behaviour. Each GatewayClass will be handled by a single controller, although
@@ -60,7 +60,7 @@ IngressClass object.
 
     The `Gateway` resource is GA and has been part of the Standard Channel since
     `v0.5.0`. For more information on release channels, refer to our [versioning
-    guide](/concepts/versioning).
+    guide](versioning.md).
 
 A Gateway describes how traffic can be translated to Services within the
 cluster. That is, it defines a request for a way to translate traffic from
@@ -100,7 +100,7 @@ types may be added to the API in future.
 
     The `HTTPRoute` resource is GA and has been part of the Standard Channel since
     `v0.5.0`. For more information on release channels, refer to our [versioning
-    guide](/concepts/versioning).
+    guide](versioning.md).
 
 HTTPRoute is for multiplexing HTTP or terminated HTTPS connections. It's intended
 for use in cases where you want to inspect the HTTP stream and use HTTP request data
@@ -113,7 +113,7 @@ modifying them in-flight.
 
     The `TLSRoute` resource is Alpha and has been part of the Experimental
     Channel since `v0.3.0`. For more information on release channels, refer to
-    our [versioning guide](/concepts/versioning).
+    our [versioning guide](versioning.md).
 
 TLSRoute is for multiplexing TLS connections, discriminated via SNI. It's intended
 for where you want to use the SNI as the main routing method, and are not interested
@@ -126,7 +126,7 @@ connection is proxied without any inspection to the backend.
 
     The `TCPRoute` and `UDPRoute` resources are Alpha and have been part of the
     Experimental Channel since `v0.3.0`. For more information on release
-    channels, refer to our [versioning guide](/concepts/versioning).
+    channels, refer to our [versioning guide](versioning.md).
 
 TCPRoute (and UDPRoute) are intended for use for mapping one or more ports
 to a single backend. In this case, there is no discriminator you can
@@ -142,7 +142,7 @@ is passed through to the backend.
 
     The `GRPCRoute` resource is GA and has been part of the Standard Channel since
     `v1.1.0`. For more information on release channels, refer to our [versioning
-    guide](/concepts/versioning).
+    guide](versioning.md).
 
 GRPCRoute is for idiomatically routing gRPC traffic. Gateways supporting
 GRPCRoute are required to support HTTP/2 without an initial upgrade from HTTP/1,
@@ -202,9 +202,9 @@ application to the outside world. Team C deploys their own Gateway
 Namespace.
 
 <!-- source: https://docs.google.com/presentation/d/1neBkFDTZ__vRoDXIWvAcxk2Pb7-evdBT6ykw_frf9QQ/edit?usp=sharing -->
-![route binding](/images/gateway-route-binding.png)
+![route binding](../images/gateway-route-binding.png)
 
-[Chihiro]:/concepts/roles-and-personas#Chihiro
+[Chihiro]:roles-and-personas.md#Chihiro
 
 ### How it Works
 
@@ -219,7 +219,7 @@ The following is required for a Route to be attached to a Gateway:
 
     The `Port` field described below is currently only included in the
     "Experimental" channel of Gateway API. For more information on release
-    channels, refer to the [related documentation](/concepts/versioning/#adding-experimental-fields).
+    channels, refer to the [related documentation](versioning.md#adding-experimental-fields).
 
 A Route can reference a Gateway by specifying the namespace (optional if the
 Route and the Gateway are in the same namespace) and name of the Gateway in
@@ -291,7 +291,7 @@ defines an implementable load-balancer. The diagram below illustrates the
 relationships between the different resources:
 
 <!-- source: https://docs.google.com/document/d/1BxYbDovMwnEqe8lj8JwHo8YxHAt3oC7ezhlFsG_tyag/edit#heading=h.8du598fded3c -->
-![schema](/images/schema-uml.svg)
+![schema](../images/schema-uml.svg)
 
 ### Request flow
 
@@ -310,13 +310,13 @@ reverse proxy is:
 6. Lastly, the reverse proxy forwards the request to one or more objects, i.e.
    `Service`, in the cluster based on `backendRefs` rules of the `HTTPRoute`.
 
-[north/south]:/concepts/glossary#northsouth-traffic
+[north/south]:glossary.md#northsouth-traffic
 
 ### TLS Configuration
 
 TLS is configured on Gateway listeners, and may be referred to across namespaces.
 
-Please refer to the [TLS details](/guides/tls) guide for a deep dive on TLS.
+Please refer to the [TLS details](../guides/tls.md) guide for a deep dive on TLS.
 
 ## Attaching Routes to Services
 
@@ -328,7 +328,7 @@ as covered in the [GAMMA routing documentation].
 
 [GAMMA]:/concepts/gamma
 [GAMMA routing documentation]:/concepts/gamma#gateway-api-for-mesh
-[service mesh]:/concepts/glossary#service-mesh
+[service mesh]:glossary.md#service-mesh
 
 ## Extension points
 
diff --git a/site-src/concepts/conformance.md b/site-src/concepts/conformance.md
index 754ab273..d2a469eb 100644
--- a/site-src/concepts/conformance.md
+++ b/site-src/concepts/conformance.md
@@ -15,7 +15,7 @@ resources that have graduated to "beta". The "experimental" channel of the API
 includes everything in the "standard" channel, along with experimental fields
 and resources that may still be changed in breaking ways **or removed
 altogether**. For more information on this concept, refer to our
-[versioning](/concepts/versioning) documentation.
+[versioning](versioning.md) documentation.
 
 ## 2. Support Levels
 
diff --git a/site-src/concepts/roles-and-personas.md b/site-src/concepts/roles-and-personas.md
index b3eb55cd..8c5689ff 100644
--- a/site-src/concepts/roles-and-personas.md
+++ b/site-src/concepts/roles-and-personas.md
@@ -77,4 +77,4 @@ system and will define resource model responsibility and separation.
 
 RBAC is discussed further in the [Security Model] description.
 
-[Security Model]: /concepts/security-model#rbac
+[Security Model]: security-model.md#rbac
diff --git a/site-src/concepts/security-model.md b/site-src/concepts/security-model.md
index 3774fc98..35d9215c 100644
--- a/site-src/concepts/security-model.md
+++ b/site-src/concepts/security-model.md
@@ -21,7 +21,7 @@ There are 3 primary roles in Gateway API, as described in [roles and personas]:
 - **Chihiro** (they/them): Cluster Operator
 - **Ana** (she/her): Application Developer
 
-[roles and personas]:/concepts/roles-and-personas
+[roles and personas]:roles-and-personas.md
 
 ### RBAC
 
@@ -98,7 +98,7 @@ the ReferenceGrant.
 ```
 
 For more information on ReferenceGrant, refer to our [detailed documentation
-for this resource](/api-types/referencegrant).
+for this resource](../api-types/referencegrant.md).
 
 ## Advanced Concept: Limiting Namespaces Where a GatewayClass Can Be Used
 Some infrastructure providers or cluster operators may wish to limit the
diff --git a/site-src/concepts/tooling.md b/site-src/concepts/tooling.md
index 884fa6d8..c8e6a240 100644
--- a/site-src/concepts/tooling.md
+++ b/site-src/concepts/tooling.md
@@ -6,13 +6,13 @@ Gateway API has tooling to facilitate interacting with the resources.
 
 Interested in seeing what your ingress resources will look like in Gateway API? `ingress2gateway` provides an easy manner to translate provider-specific resources to Gateway API resources. Managed by the Gateway API SIG-Network subproject.
 
-Get started [here](https://github.com/kubernetes-sigs/ingress2gateway?tab=readme-ov-file#installation)!
+Get started with [kubernetes-sigs/ingress2gateway: installation](https://github.com/kubernetes-sigs/ingress2gateway?tab=readme-ov-file#installation)!
 
 ## `gwctl`
 
-A command line tool for managing your Gateway API resouces. Explore your policies, xRoutes, and interact with your resources.
+A command line tool for managing your Gateway API resources. Explore your policies, xRoutes, and interact with your resources.
 
-Get started [here](https://github.com/kubernetes-sigs/gwctl?tab=readme-ov-file#installation)!
+Get started with [kubernetes-sigs/gwctl: installation](https://github.com/kubernetes-sigs/gwctl?tab=readme-ov-file#installation)!
 
 ## Third-Party Tooling
 
@@ -20,4 +20,4 @@ Get started [here](https://github.com/kubernetes-sigs/gwctl?tab=readme-ov-file#i
 
 Machinery for implementing Gateway API policies and policy controllers.
 
-Get started [here](https://github.com/Kuadrant/policy-machinery/tree/main)
+Get started with [Kuadrant/policy-machinery](https://github.com/Kuadrant/policy-machinery/tree/main)
diff --git a/site-src/concepts/use-cases.md b/site-src/concepts/use-cases.md
index ff0ce95a..dfe68d2a 100644
--- a/site-src/concepts/use-cases.md
+++ b/site-src/concepts/use-cases.md
@@ -13,20 +13,21 @@ these roles might be filled by the same person, especially in smaller
 organizations, they all have distinct concerns that we need to consider
 separately.)
 
-[roles and personas]:/concepts/roles-and-personas
-[Ana]:/concepts/roles-and-personas#ana
-[Chihiro]:/concepts/roles-and-personas#chihiro
-[Ian]:/concepts/roles-and-personas#ian
+[roles and personas]:roles-and-personas.md
+[Ana]:roles-and-personas.md#ana
+[Chihiro]:roles-and-personas.md#chihiro
+[Ian]:roles-and-personas.md#ian
 
 ## The Use Cases
 
-- [Basic north/south use case](#basic-northsouth-use-case)
-- [Multiple applications behind a single
-  Gateway](#multiple-applications-behind-a-single-gateway)
-- [Basic east/west use case](#basic-eastwest-use-case) -- **experimental**
-- [Gateway and mesh use case](#gateway-and-mesh-use-case) -- **experimental**
+- [Use Cases](#use-cases)
+  - [The Use Cases](#the-use-cases)
+  - [Basic north/south use case](#basic-northsouth-use-case)
+  - [Multiple applications behind a single Gateway](#multiple-applications-behind-a-single-gateway)
+  - [Basic east/west use case](#basic-eastwest-use-case)
+  - [Gateway and mesh use case](#gateway-and-mesh-use-case)
 
-[role and personas]:/concepts/roles-and-personas
+[role and personas]:roles-and-personas.md
 
 ## Basic [north/south] use case
 
@@ -34,7 +35,7 @@ separately.)
 
     The [north/south] use case is fully supported by the Standard Channel
     since `v0.8.0`. For more information on release
-    channels, refer to our [versioning guide](/concepts/versioning).
+    channels, refer to our [versioning guide](versioning.md).
 
 Ana has created a microservice application which she wants to run in
 Kubernetes. Her application will be used by clients outside the cluster, and
@@ -80,12 +81,12 @@ wheelhouse.
     to Ana's application according to her routing specification.
 
 This allows Chihiro to enforce centralized policies [such as
-TLS](/guides/tls#downstream-tls) at the Gateway, while simultaneously allowing
+TLS](../guides/tls.md#downstream-tls) at the Gateway, while simultaneously allowing
 Ana and her colleagues control over the application's [routing
-logic](/guides/http-routing) and rollout plans (e.g. [traffic splitting
-rollouts](/guides/traffic-splitting)).
+logic](../guides/http-routing.md) and rollout plans (e.g. [traffic splitting
+rollouts](../guides/traffic-splitting.md)).
 
-[north/south]:/concepts/glossary#northsouth-traffic
+[north/south]:glossary.md#northsouth-traffic
 
 ## Multiple applications behind a single Gateway
 
@@ -93,7 +94,7 @@ rollouts](/guides/traffic-splitting)).
 
     The [north/south] use case is fully supported by the Standard Channel
     since `v0.8.0`. For more information on release
-    channels, refer to our [versioning guide](/concepts/versioning).
+    channels, refer to our [versioning guide](versioning.md).
 
 This is remarkably similar to the [basic north/south use
 case](#basic-northsouth-use-case), but there are multiple application teams:
@@ -108,20 +109,20 @@ Namespace.
   same `Gateway` resource.
 
 Again, this separation of concerns allows Chihiro to enforce centralized
-policies [such as TLS](/guides/tls#downstream-tls) can be enforced at the
+policies [such as TLS](../guides/tls.md#downstream-tls) can be enforced at the
 Gateway. Meanwhile, Ana and Allison run their applications [in their own
-Namespaces](/guides/multiple-ns), but attach their Routes to the same shared
+Namespaces](../guides/multiple-ns.md), but attach their Routes to the same shared
 Gateway, allowing them to independently control their [routing
-logic](/guides/http-routing), [traffic splitting
-rollout](/guides/traffic-splitting), etc., while not worrying about the things
+logic](../guides/http-routing.md), [traffic splitting
+rollout](../guides/traffic-splitting.md), etc., while not worrying about the things
 that Chihiro and Ian are handling.
 
-[HTTPRoute]:/api-types/httproute
-[GatewayClass]:/api-types/gatewayclass
-[Gateway]:/api-types/gateway
-[Route Attachment Process]:/concepts/api-overview#attaching-routes-to-gateways
+[HTTPRoute]:../api-types/httproute.md
+[GatewayClass]:../api-types/gatewayclass.md
+[Gateway]:../api-types/gateway.md
+[Route Attachment Process]:api-overview.md#attaching-routes-to-gateways
 
-![Gateway API Roles](/images/gateway-roles.png)
+![Gateway API Roles](../images/gateway-roles.png)
 
 ## Basic [east/west] use case
 
@@ -146,9 +147,9 @@ In this case, the separation of concerns across roles allows Ana to take
 advantage of the service mesh, with custom routing logic, without any
 bottlenecks in requests to Chihiro or Ian.
 
-[east/west]:/concepts/glossary#eastwest-traffic
+[east/west]:glossary.md#eastwest-traffic
 [GAMMA]:/concepts/gamma/
-[service mesh]:/concepts/glossary#service-mesh
+[service mesh]:glossary.md#service-mesh
 
 ## Gateway and mesh use case
 
@@ -178,15 +179,15 @@ involved:
 
 As always, the ultimate point of separating concerns in this way is that it
 permits Chihiro to enforce centralized policies [such as
-TLS](/guides/tls#downstream-tls) at the Gateway, while allowing Ana and
+TLS](../guides/tls.md#downstream-tls) at the Gateway, while allowing Ana and
 Allison to retain independent control of [routing
-logic](/guides/http-routing), [traffic splitting
-rollout](/guides/traffic-splitting), etc., both for [north/south] and for
+logic](../guides/http-routing.md), [traffic splitting
+rollout](../guides/traffic-splitting.md), etc., both for [north/south] and for
 [east/west] routing.
 
 
 
 
-[gateway controller]:/concepts/glossary#gateway-controller
-[Service routing]:/concepts/glossary#service-routing
-[endpoint routing]:/concepts/glossary#endpoint-routing
+[gateway controller]:glossary.md#gateway-controller
+[Service routing]:glossary.md#service-routing
+[endpoint routing]:glossary.md#endpoint-routing
diff --git a/site-src/concepts/versioning.md b/site-src/concepts/versioning.md
index da233768..b3b9f0ce 100644
--- a/site-src/concepts/versioning.md
+++ b/site-src/concepts/versioning.md
@@ -15,7 +15,7 @@ point, these may graduate to the Standard release channel or be dropped from the
 API entirely.
 
 The following diagram provides a high level overview of the lifecycle of a
-feature or resource proposed by a new [GEP](/geps/overview/) (enhancement
+feature or resource proposed by a new [GEP](../geps/overview.md) (enhancement
 proposal) in Gateway API:
 
 ```mermaid
@@ -45,7 +45,7 @@ channel, plus:
 * Resources with Alpha API Versions
 * All new fields before they graduate to Standard Channel
 
-![Release Channel Overlap](/images/release-channel-overlap.svg)
+![Release Channel Overlap](../images/release-channel-overlap.svg)
 <!-- Source: https://docs.google.com/presentation/d/1sfZTV-vlisDUIie_iK_B2HqKia_querT6m6T2_vbAk0/edit -->
 
 We recommend using the Standard Channel by default as it will provide a stable
@@ -168,7 +168,7 @@ consistent upgrade experiences across versions. To accomplish that, we commit to
 
 ## CRD Management
 For information on how to manage Gateway API CRDs in your clusters, refer to our
-[CRD Management Guide](/guides/crd-management).
+[CRD Management Guide](../guides/crd-management.md).
 
 ## Out of Scope
 ### Unreleased APIs
diff --git a/site-src/contributing/devguide.md b/site-src/contributing/devguide.md
index 3f7e92a9..6d3acfdf 100644
--- a/site-src/contributing/devguide.md
+++ b/site-src/contributing/devguide.md
@@ -82,7 +82,7 @@ ensuring the field name will not be reused.
 
 ### Deploy the Code
 
-Use the following command to deploy CRDs to the pre-existing `Kind` cluster.
+Use the following command to deploy CRDs to the preexisting `Kind` cluster.
 
 ```shell
 make crd
@@ -96,8 +96,8 @@ kubectl get crds
 
 ### Test Manually
 
-Install a [gateway API implementation](https://gateway-api.sigs.k8s.io/implementations/) and test out the change. Take a look at some 
-examples [here](https://gateway-api.sigs.k8s.io/guides/).
+Install a [gateway API implementation](../implementations.md) and test out the change. Take a look at some
+[examples](../guides/index.md).
 
 ### Verify
 
@@ -132,7 +132,7 @@ The site documentation is written in Markdown and compiled with
 [mkdocs](https://www.mkdocs.org/). Each PR will automatically include a
 [Netlify](https://netlify.com/) deploy preview. When new code merges, it will
 automatically be deployed with Netlify to
-[gateway-api.sigs.k8s.io](https://gateway-api.sigs.k8s.io). If you want to
+[gateway-api.sigs.k8s.io](). If you want to
 manually preview docs changes locally, you can install mkdocs and run:
 
 ```shell
@@ -155,9 +155,9 @@ INFO    -  Building documentation...
 ```
 
 For more information on how documentation should be written, refer to our
-[Documentation Style Guide](/contributing/style-guide).
+[Documentation Style Guide](style-guide.md).
 
 ### Conformance Tests
 
 To develop or run conformance tests, refer to the [Conformance Test
-Documentation](/concepts/conformance/#running-tests).
+Documentation](../concepts/conformance.md#running-tests).
diff --git a/site-src/contributing/enhancement-requests.md b/site-src/contributing/enhancement-requests.md
index de693a5e..0bdf2ea9 100644
--- a/site-src/contributing/enhancement-requests.md
+++ b/site-src/contributing/enhancement-requests.md
@@ -41,23 +41,23 @@ request for enhancement if that enhancement is non-trivial (which we will define
 as either: _implicates changes to the API specification_
 OR _has some kind of end-user impact_).
 
-Please use our [Github Discussions][discussion] forum as the initial place to
+Please use our [GitHub Discussions][discussion] forum as the initial place to
 start, and feel free to bring that discussion up for synchronous conversation in
 one of our [community meetings][meetings]. If the created request doesn't
 include reference to a discussion and/or recordings of discussion in our
 community meetings, please note that it _may_ get closed with a request to
 create an initial discussion first.
 
-[gep]: /geps/overview
+[gep]: ../geps/overview.md
 [discussion]: https://github.com/kubernetes-sigs/gateway-api/discussions/new/choose
-[meetings]: /contributing/#meetings
+[meetings]: index.md#meetings
 
 ## When are Enhancements Accepted?
 
 Gateway API has a predictable release cycle that includes multiple phases. New
 enhancements are only considered in the early phases of that release cycle while
 the scope of a release is being determined. For more information, refer to our
-[release cycle documentation](/contributing/release-cycle).
+[release cycle documentation](release-cycle.md).
 
 ## Why are Enhancements Tracked
 
diff --git a/site-src/contributing/index.md b/site-src/contributing/index.md
index e663c078..613b15de 100644
--- a/site-src/contributing/index.md
+++ b/site-src/contributing/index.md
@@ -3,7 +3,7 @@
 This page contains links to all of the meeting notes, design docs and related
 discussions around the APIs. If you're interested in working towards a formal
 role in the project, refer to the [Contributor
-Ladder](/contributing/contributor-ladder).
+Ladder](contributor-ladder.md).
 
 ## Feedback and Questions
 
@@ -22,7 +22,7 @@ Gateway API and not the API specification itself, please check our
 you can get help with your specific implementation.
 
 [gh-issues]: https://github.com/kubernetes-sigs/gateway-api/issues/new/choose
-[implementations]:/implementations/
+[implementations]:../implementations.md
 
 ## Communications
 
@@ -85,7 +85,7 @@ service mesh use cases can be found in a separate
 
 [early-yt-playlist]: https://www.youtube.com/playlist?list=PL7KjrPTDcs4Xe6SZj-51WvBfufKf-la1O
 [sig-net-yt-playlist]: https://www.youtube.com/playlist?list=PL69nYSiGNLP2E8vmnqo5MwPOY25sDWIxb
-[gamma]: /mesh/gamma/
+[gamma]: ../mesh/gamma.md
 [gamma-meeting-notes]: https://docs.google.com/document/d/1s5hQU0CB9ehjFukRmRHQ41f1FA8GX5_1Rv6nHW6NWAA/edit#
 
 #### Initial Design Discussions
diff --git a/site-src/contributing/style-guide.md b/site-src/contributing/style-guide.md
index 162d17d8..3358e032 100644
--- a/site-src/contributing/style-guide.md
+++ b/site-src/contributing/style-guide.md
@@ -24,13 +24,13 @@ channel. To accomplish that, we use admonitions that look like this:
 
     The `HTTPRoute` resource is GA and has been part of the Standard Channel
     since `v0.5.0`. For more information on release channels, refer to our
-    [versioning guide](/concepts/versioning).
+    [versioning guide](../concepts/versioning.md).
 
 ??? example "Experimental Channel since v0.3.0"
 
     The `TLSRoute` resource is Alpha and has been part of the Experimental
     Channel since `v0.3.0`. For more information on release channels, refer to
-    our [versioning guide](/concepts/versioning).
+    our [versioning guide](../concepts/versioning.md).
 
 ## Diagrams
 In many cases, diagrams are the best way to explain a concept. Unfortunately
diff --git a/site-src/faq.md b/site-src/faq.md
index fa8b72a2..0e580689 100644
--- a/site-src/faq.md
+++ b/site-src/faq.md
@@ -15,10 +15,10 @@ more protocols than just HTTP, and models more infrastructure components to
 provide better deployment and management options for cluster operators.
 
 For more information, see the [Migrating from
-Ingress](/guides/migrating-from-ingress/) guide.
+Ingress](guides/migrating-from-ingress.md) guide.
 
 #### Will there be a default controller implementation?
-No. There are already many great [implementations](/implementations) to choose
+No. There are already many great [implementations](implementations.md) to choose
 from. The scope of this project is to define the API, conformance tests, and
 overall documentation.
 
@@ -26,7 +26,7 @@ overall documentation.
 There are a few mechanisms available for extending the API with
 implementation-specific capabilities:
 
-* The [Policy Attachment](/reference/policy-attachment/) model allows you to
+* The [Policy Attachment](reference/policy-attachment.md) model allows you to
 decorate Gateway API objects with implementation-specific CRDs. A policy or
 configuration object could match the Gateway API object either by name or by
 using an explicit object reference.
@@ -37,12 +37,12 @@ using an explicit object reference.
   objects.
 
 * Use API-defined extension points. Some Gateway API objects have explicit
-[extension points](/concepts/api-overview#extension-points) for implementations
+[extension points](concepts/api-overview.md#extension-points) for implementations
 to use.
 
 #### Where can I find Gateway API releases?
-Gateway API releases are tags of the [Github
-repository](https://github.com/kubernetes-sigs/gateway-api). The [Github
+Gateway API releases are tags of the [GitHub
+repository](https://github.com/kubernetes-sigs/gateway-api). The [GitHub
 releases](https://github.com/kubernetes-sigs/gateway-api/releases) page shows
 all the releases.
 
@@ -51,38 +51,37 @@ Similar to upstream Kubernetes, alpha API versions indicate that resources are
 still experimental in nature and may either be removed or changed in breaking
 ways in future releases of Gateway API.
 
-See the [Versioning](/concepts/versioning/) documentation for more info.
+See the [Versioning](concepts/versioning.md) documentation for more info.
 
 #### Which Kubernetes versions are supported?
 See our policy on [supported
-versions](/concepts/versioning/#supported-versions).
+versions](concepts/versioning.md#supported-versions).
 
 #### Is SSL Passthrough supported?
 SSL Passthrough (wherein a Gateway routes traffic with the [Transport Layer
 Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security)
 encryption _intact_ to a backend service instead of terminating it) is supported
-by [TLSRoutes](/concepts/api-overview#tlsroute). See the [TLS
-Guide](/guides/tls) for more details about passthrough and other TLS
+by [TLSRoutes](concepts/api-overview.md#tlsroute). See the [TLS
+Guide](guides/tls.md) for more details about passthrough and other TLS
 configurations.
 
 #### What's the difference between Gateway API and an API Gateway?
-An API Gateway is a general concept that describes anything that exposes
-capabilities of a backend service, while providing extra capabilities for
-traffic routing and manipulation, such as load balancing, request and response
-transformation, and sometimes more advanced features like authentication and
-authorization, rate limiting, and circuit breaking.
+An [API gateway](https://glossary.cncf.io/api-gateway/) is a tool that
+aggregates unique application APIs, making them all available in one place.
+It allows organizations to move key functions, such as authentication and
+authorization or limiting the number of requests between applications, to a
+centrally managed location. An API gateway functions as a common interface to (often external) API consumers.
 
-Gateway API is an interface, or set of resources, that model service networking
-in Kubernetes. One of the main resources is a `Gateway`, which declares the
-Gateway type (or class) to instantiate and its configuration. As a Gateway
-Provider, you can implement Gateway API to model Kubernetes service networking
-in an expressive, extensible, and role-oriented way.
+Gateway API is an interface, defined as a set of Kubernetes resources, that 
+models service networking in Kubernetes. One of the main resources is a `Gateway`,
+which declares the Gateway type (or class) to instantiate and its configuration.
+As a Gateway provider, you can implement Gateway API to model Kubernetes service
+networking in an expressive, extensible, and role-oriented way.
 
-Most Gateway API implementations are API Gateways to some extent, but not all
-API Gateways are Gateway API implementations.
+Some API gateways can be programmed using the Gateway API.
 
 #### Is Gateway API a standard for API Management?
 No. API Management is a much broader concept than what Gateway API aims to be,
 or what an API Gateway is intended to provide. An API Gateway can be an
 essential part of an API Management solution. Gateway API can be seen as a way
-to standardize on that aspect of API Management.
+to standardize provisioning of API Gateways.
diff --git a/site-src/guides/backend-protocol.md b/site-src/guides/backend-protocol.md
index 45a325e1..95870fd6 100644
--- a/site-src/guides/backend-protocol.md
+++ b/site-src/guides/backend-protocol.md
@@ -4,9 +4,9 @@
 
     This concept has been part of the Standard Channel since `v1.2.0`.
     For more information on release channels, refer to our
-    [versioning guide](/concepts/versioning).
+    [versioning guide](../concepts/versioning.md).
 
-Not all implementations of Gateway API support automatic protocol selection. In some cases protocols are disabled without an explicit opt-in. 
+Not all implementations of Gateway API support automatic protocol selection. In some cases protocols are disabled without an explicit opt-in.
 
 When a Route's backend references a Kubernetes Service, application developers can specify the protocol using `ServicePort` [`appProtocol`][appProtocol] field.
 
diff --git a/site-src/guides/crd-management.md b/site-src/guides/crd-management.md
index 7040292f..d2cfd588 100644
--- a/site-src/guides/crd-management.md
+++ b/site-src/guides/crd-management.md
@@ -33,7 +33,7 @@ explores one possible approach implementations could use to accomplish this.
 ## Upgrading to a new version
 
 Gateway API releases CRDs in two [release
-channels](/concepts/versioning/#release-channels-eg-experimental-standard).
+channels](../concepts/versioning.md#release-channels-eg-experimental-standard).
 Sticking with standard channel CRDs will ensure CRD upgrades are both simpler
 and safer.
 
@@ -44,7 +44,7 @@ and safer.
    that configuration.
 1. Read the release notes before upgrading. In some cases, they may contain some
    guidelines you need to follow before upgrading.
-1. Understand the [Gateway API versioning policy](/concepts/versioning) so you
+1. Understand the [Gateway API versioning policy](../concepts/versioning.md) so you
    know what can change.
 1. Although it is usually safe to upgrade across multiple Gateway API minor
    versions at once, the safest and most widely tested path will involve
diff --git a/site-src/guides/grpc-routing.md b/site-src/guides/grpc-routing.md
index acba8f11..ba0fca2b 100644
--- a/site-src/guides/grpc-routing.md
+++ b/site-src/guides/grpc-routing.md
@@ -1,12 +1,6 @@
 # gRPC routing
 
-!!! info "Experimental Channel"
-
-    The `GRPCRoute` resource described below is currently only included in the
-    "Experimental" channel of Gateway API. For more information on release
-    channels, refer to our [versioning guide](/concepts/versioning).
-
-The [GRPCRoute resource](/api-types/grpcroute) allows you to match on gRPC traffic and
+The [GRPCRoute resource](../api-types/grpcroute.md) allows you to match on gRPC traffic and
 direct it to Kubernetes backends. This guide shows how the GRPCRoute matches
 traffic on host, header, and service, and method fields and forwards it to different
 Kubernetes Services.
@@ -21,14 +15,14 @@ to `bar-svc-canary` for all services and methods
   all services and methods
 
 <!--- Editable source available at site-src/images/grpc-routing.png -->
-![gRPC Routing](/images/grpc-routing.png)
+![gRPC Routing](../images/grpc-routing.png)
 
 The dotted lines show the `Gateway` resources deployed to configure this routing
 behavior. There are two `GRPCRoute` resources that create routing rules on the
 same `prod` Gateway. This illustrates how more than one Route can bind to a
 Gateway which allows Routes to merge on a `Gateway` as long as they don't
 conflict. `GRPCRoute` follows the same Route merging semantics. For more
-information on that, refer to the [documentation](/api-types/httproute#merging).
+information on that, refer to the [documentation](../api-types/httproute.md#merging).
 
 In order to receive traffic from a [Gateway][gateway], a `GRPCRoute` resource
 must be configured with `ParentRefs` which reference the parent gateway(s) that it
@@ -69,7 +63,7 @@ missing or does not have the value `canary` then it will be forwarded to `bar-sv
 Reflection](https://github.com/grpc/grpc/blob/v1.49.1/doc/server-reflection.md)
 is required to use interactive clients such as
 [`grpcurl`](https://github.com/fullstorydev/grpcurl) without having a local copy
-of the target service's protocol buffers present on your local filesysem. To
+of the target service's protocol buffers present on your local filesystem. To
 enable this, first ensure that you have a gRPC reflection server listening on
 your application pods, then add the reflection method to your `GRPCRoute`. This
 is likely to be useful in development and staging environments, but this should
@@ -80,6 +74,6 @@ been considered.
 {% include 'standard/grpc-routing/reflection-grpcroute.yaml' %}
 ```
 
-[gateway]: /reference/spec/#gateway.networking.k8s.io/v1.Gateway
-[spec]: /reference/spec/#gateway.networking.k8s.io%2fv1alpha2.GRPCRouteSpec
+[gateway]: ../reference/spec.md#gateway.networking.k8s.io/v1.Gateway
+[spec]: ../reference/spec.md#gateway.networking.k8s.io%2fv1alpha2.GRPCRouteSpec
 [svc]:https://kubernetes.io/docs/concepts/services-networking/service/
diff --git a/site-src/guides/http-header-modifier.md b/site-src/guides/http-header-modifier.md
index f3af1a71..a55e2b86 100644
--- a/site-src/guides/http-header-modifier.md
+++ b/site-src/guides/http-header-modifier.md
@@ -1,15 +1,17 @@
 # HTTP Header Modifiers
 
-[HTTPRoute resources](/api-types/httproute) can modify the headers of HTTP requests and the HTTP responses from clients. 
-There are two types of [filters](/api-types/httproute#filters-optional) available to meet these requirements: `RequestHeaderModifier` and `ResponseHeaderModifier`.
+[HTTPRoute resources](../api-types/httproute.md) can modify the headers of HTTP requests and the HTTP responses from clients.
+There are two types of [filters](../api-types/httproute.md#filters-optional) available to meet these requirements: `RequestHeaderModifier` and `ResponseHeaderModifier`.
+[HTTPRoute resources](../api-types/httproute.md) can modify the headers of HTTP requests and the HTTP responses from clients.
+There are two types of [filters](../api-types/httproute.md#filters-optional) available to meet these requirements: `RequestHeaderModifier` and `ResponseHeaderModifier`.
 
 This guide shows how to use these features.
 
-Note that these features are compatible. HTTP headers of the incoming requests and the headers of their responses can both be modified using a single [HTTPRoute resource](/api-types/httproute).
+Note that these features are compatible. HTTP headers of the incoming requests and the headers of their responses can both be modified using a single [HTTPRoute resource](../api-types/httproute.md).
 
 ## HTTP Request Header Modifier
 
-HTTP header modification is the process of adding, removing, or modifying HTTP headers in incoming requests. 
+HTTP header modification is the process of adding, removing, or modifying HTTP headers in incoming requests.
 
 To configure HTTP header modification, define a Gateway object with one or more HTTP filters. Each filter specifies a specific modification to make to incoming requests, such as adding a custom header or modifying an existing header.
 
@@ -25,12 +27,12 @@ To edit an existing header, use the `set` action and specify the value of the he
     filters:
     - type: RequestHeaderModifier
       requestHeaderModifier:
-        set: 
+        set:
           - name: my-header-name
             value: my-new-header-value
 ```
 
-Headers can also be removed, by using the `remove` keyword and a list of header names. 
+Headers can also be removed, by using the `remove` keyword and a list of header names.
 
 ```yaml
     filters:
diff --git a/site-src/guides/http-redirect-rewrite.md b/site-src/guides/http-redirect-rewrite.md
index dc36bfd7..37a887d0 100644
--- a/site-src/guides/http-redirect-rewrite.md
+++ b/site-src/guides/http-redirect-rewrite.md
@@ -1,8 +1,8 @@
 # HTTP path redirects and rewrites
 
-[HTTPRoute resources](/api-types/httproute) can issue redirects to
+[HTTPRoute resources](../api-types/httproute.md) can issue redirects to
 clients or rewrite paths sent upstream using
-[filters](/api-types/httproute#filters-optional). This guide shows how
+[filters](../api-types/httproute.md#filters-optional). This guide shows how
 to use these features.
 
 Note that redirect and rewrite filters are mutually incompatible. Rules cannot
@@ -12,7 +12,7 @@ use both filter types at once.
 
 Redirects return HTTP 3XX responses to a client, instructing it to retrieve a
 different resource. [`RequestRedirect` rule
-filters](/reference/spec/#gateway.networking.k8s.io/v1.HTTPRequestRedirectFilter)
+filters](../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRequestRedirectFilter)
 instruct Gateways to emit a redirect response to requests matching a filtered
 HTTPRoute rule.
 
@@ -87,7 +87,7 @@ https://redirect.example/paprika/teaspoon` response headers.
 
 Rewrites modify components of a client request before proxying it upstream. A
 [`URLRewrite`
-filter](/reference/spec/#gateway.networking.k8s.io/v1.HTTPURLRewriteFilter)
+filter](../reference/spec.md#gateway.networking.k8s.io/v1.HTTPURLRewriteFilter)
 can change the upstream request hostname and/or path. For example, the
 following HTTPRoute will accept a request for
 `https://rewrite.example/cardamom` and send it upstream to `example-svc` with
diff --git a/site-src/guides/http-request-mirroring.md b/site-src/guides/http-request-mirroring.md
index 061ca081..61b7e27b 100644
--- a/site-src/guides/http-request-mirroring.md
+++ b/site-src/guides/http-request-mirroring.md
@@ -5,9 +5,9 @@
     As of v1.0.0, the Request Mirroring feature is an Extended feature, and
     requires implementations to support the `HTTPRouteRequestMirror` feature.
 
-The [HTTPRoute resource](/api-types/httproute) allows you to mirror HTTP
+The [HTTPRoute resource](../api-types/httproute.md) allows you to mirror HTTP
 requests to another backend using
-[filters](/api-types/httproute#filters-optional). This guide shows how to use
+[filters](../api-types/httproute.md#filters-optional). This guide shows how to use
 this feature.
 
 Mirrored requests will must only be sent to one single destination endpoint
@@ -24,4 +24,4 @@ responses to clients in any way.
 
 In this example, all requests are forwarded to service `foo-v1` on port `8080`,
 and they are also forwarded to service `foo-v2` on port `8080`, but responses
-are only generated from service `foo-v1`.
\ No newline at end of file
+are only generated from service `foo-v1`.
diff --git a/site-src/guides/http-routing.md b/site-src/guides/http-routing.md
index 2f5331a9..72112ec6 100644
--- a/site-src/guides/http-routing.md
+++ b/site-src/guides/http-routing.md
@@ -1,6 +1,6 @@
 # HTTP routing
 
-The [HTTPRoute resource](/api-types/httproute) allows you to match on HTTP traffic and
+The [HTTPRoute resource](../api-types/httproute.md) allows you to match on HTTP traffic and
 direct it to Kubernetes backends. This guide shows how the HTTPRoute matches
 traffic on host, header, and path fields and forwards it to different
 Kubernetes Services.
@@ -13,14 +13,14 @@ Services:
 to `bar-svc-canary`
 - Traffic to `bar.example.com/*` without the header is forwarded to `bar-svc`
 
-![HTTP Routing](/images/http-routing.png)
+![HTTP Routing](../images/http-routing.png)
 
 The dotted lines show the Gateway resources deployed to configure this routing
 behavior. There are two HTTPRoute resources that create routing rules on the
 same `prod-web` Gateway. This illustrates how more than one Route can bind to a
 Gateway which allows Routes to merge on a Gateway as long as they don't
 conflict. For more information on Route merging, refer to the [HTTPRoute
-documentation](/api-types/httproute#merging).
+documentation](../api-types/httproute.md#merging).
 
 In order to receive traffic from a [Gateway][gateway] an `HTTPRoute` resource
 must be configured with `ParentRefs` which reference the parent gateway(s) that it
@@ -57,6 +57,6 @@ missing or not `canary` then it'll be forwarded to `bar-svc`.
 {% include 'standard/http-routing/bar-httproute.yaml' %}
 ```
 
-[gateway]: /reference/spec/#gateway.networking.k8s.io/v1.Gateway
-[spec]: /reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteSpec
+[gateway]: ../reference/spec.md#gateway.networking.k8s.io/v1.Gateway
+[spec]: ../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteSpec
 [svc]:https://kubernetes.io/docs/concepts/services-networking/service/
diff --git a/site-src/guides/implementers.md b/site-src/guides/implementers.md
index eed5e62e..255be26a 100644
--- a/site-src/guides/implementers.md
+++ b/site-src/guides/implementers.md
@@ -55,7 +55,7 @@ explained in our [versioning][versioning] documentation.
 Implementations may use these to determine what schema versions are installed in
 the cluster, if any.
 
-[versioning]: /concepts/versioning
+[versioning]: ../concepts/versioning.md
 
 ### Changes to the Standard Channel CRDs are backwards compatible
 
@@ -63,7 +63,7 @@ Part of the contract for Standard Channel CRDs is that changes _within an API
 version_ must be _compatible_. Note that CRDs that are part of Experimental
 Channel do not provide any backwards compatibility guarantees.
 
-Although the [Gateway API versioning policy](/concepts/versioning) largely
+Although the [Gateway API versioning policy](../concepts/versioning.md) largely
 aligns with upstream Kubernetes APIs, it does allow for "corrections to
 validation". For example, if the API spec stated that a value was invalid but
 the corresponding validation did not cover that, it's possible that a future
@@ -84,7 +84,7 @@ in the older version.
 
 For information on how to manage Gateway API CRDs, including when it is
 acceptable to bundle CRD installation with your implementation, refer to our
-[CRD Management Guide](/guides/crd-management).
+[CRD Management Guide](crd-management.md).
 
 ### Conformance and Version Compatibility
 
@@ -101,7 +101,7 @@ Gateway API conformance is version-specific. An implementation that passes
 conformance for version N may not pass conformance for version N+1 without changes.
 
 Implementations SHOULD submit a report from the conformance testing suite back
-to the Gateway API Github repo containing details of their testing.
+to the Gateway API GitHub repo containing details of their testing.
 
 The conformance suite output includes the Gateway API version supported.
 
@@ -162,7 +162,7 @@ version of the object.
 ## TLS
 
 TLS is a large topic in Gateway API, with the set of capabilities continuing to
-expand. There is a [TLS guide](/guides/tls) that covers this topic in more depth
+expand. There is a [TLS guide](tls.md) that covers this topic in more depth
 from a user-facing perspective, but this section attempts to fill in some gaps
 from an implementer's perspective.
 
@@ -233,7 +233,7 @@ generated TLS certificates.
 
 #### 3. Certs that are specified by other personas
 In some organizations, Application Developers are responsible for managing TLS
-Certificates (see [Roles and Personas](/concepts/roles-and-personas) for more on
+Certificates (see [Roles and Personas](../concepts/roles-and-personas.md) for more on
 this and other roles).
 
 To enable this use case, a new controller and CRD would be created. This
diff --git a/site-src/guides/index.md b/site-src/guides/index.md
index 82464f2f..ac1a14a7 100644
--- a/site-src/guides/index.md
+++ b/site-src/guides/index.md
@@ -7,19 +7,19 @@ _THEN_
 
 **2.**   **Try out one of the available guides:**
 
-- [Simple Gateway](/guides/simple-gateway) (a good one to start out with)
-- [HTTP routing](/guides/http-routing)
-- [HTTP redirects and rewrites](/guides/http-redirect-rewrite)
-- [HTTP traffic splitting](/guides/traffic-splitting)
-- [Routing across Namespaces](/guides/multiple-ns)
-- [Configuring TLS](/guides/tls)
-- [TCP routing](/guides/tcp)
-- [gRPC routing](/guides/grpc-routing)
-- [Migrating from Ingress](/guides/migrating-from-ingress)
+- [Simple Gateway](simple-gateway.md) (a good one to start out with)
+- [HTTP routing](http-routing.md)
+- [HTTP redirects and rewrites](http-redirect-rewrite.md)
+- [HTTP traffic splitting](traffic-splitting.md)
+- [Routing across Namespaces](multiple-ns.md)
+- [Configuring TLS](tls.md)
+- [TCP routing](tcp.md)
+- [gRPC routing](grpc-routing.md)
+- [Migrating from Ingress](migrating-from-ingress.md)
 
 ## Installing a Gateway controller
 
-There are [multiple projects](/implementations) that support Gateway API. By
+There are [multiple projects](../implementations.md) that support Gateway API. By
 installing a Gateway controller in your Kubernetes cluster, you can try out the
 guides above. This will demonstrate that the desired routing configuration is
 actually being implemented by your Gateway resources (and the network
@@ -52,13 +52,13 @@ kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/downloa
 
 The experimental release channel includes everything in the standard release
 channel plus some experimental resources and fields. This includes
-TCPRoute, TLSRoute, UDPRoute and GRPCRoute.
+TCPRoute, TLSRoute, and UDPRoute.
 
 Note that future releases of the API could include breaking changes to
 experimental resources and fields. For example, any experimental resource or
 field could be removed in a future release. For more information on the
 experimental channel, refer to our [versioning
-documentation](/concepts/versioning/).
+documentation](../concepts/versioning.md).
 
 To install the experimental channel, run the following kubectl command:
 
@@ -190,4 +190,4 @@ break anything using these resources.
 ### More on CRD Management
 This guide only provides a high level overview of how to get started with
 Gateway API. For more on the topic of managing Gateway API CRDs, refer to our
-[CRD Management Guide](/guides/crd-management).
+[CRD Management Guide](crd-management.md).
diff --git a/site-src/guides/infrastructure.md b/site-src/guides/infrastructure.md
index eecdadb2..42e7f0b3 100644
--- a/site-src/guides/infrastructure.md
+++ b/site-src/guides/infrastructure.md
@@ -4,7 +4,7 @@
 
     The `infrastructure` field is GA and has been part of the Standard Channel since
     `v1.2.0`. For more information on release channels, refer to our [versioning
-    guide](/concepts/versioning).
+    guide](../concepts/versioning.md).
 
 Gateway API implementations are responsible for creating the backing
 infrastructure needed to make each Gateway work. For example, implementations
@@ -40,6 +40,6 @@ spec:
       linkerd.io/inject: enabled
 ```
 
-[infrastructure]: /reference/spec/#gateway.networking.k8s.io/v1.GatewayInfrastructure
+[infrastructure]: ../reference/spec.md#gateway.networking.k8s.io/v1.GatewayInfrastructure
 [service]: https://kubernetes.io/docs/concepts/services-networking/service/
-[deployment]: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
\ No newline at end of file
+[deployment]: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
diff --git a/site-src/guides/migrating-from-ingress.md b/site-src/guides/migrating-from-ingress.md
index 94f20772..bef5a6c4 100644
--- a/site-src/guides/migrating-from-ingress.md
+++ b/site-src/guides/migrating-from-ingress.md
@@ -43,7 +43,7 @@ However, the Ingress API has several limitations:
 
 Gateway API addresses those limitations, as the next section will show.
 
-> Read more about the [design goals](/#gateway-api-concepts)
+> Read more about the [design goals](../index.md#gateway-api-concepts)
 > of Gateway API.
 
 ## Key Differences Between Ingress API and Gateway API
@@ -73,7 +73,7 @@ resource, the infrastructure provider and cluster operator became the owners of
 that resource, and thus, explicit personas of the Ingress API.
 
 Gateway API
-includes [four explicit personas](/concepts/security-model/#roles-and-personas):
+includes [four explicit personas](../concepts/security-model.md#roles-and-personas):
 the application developer, the application admin, the cluster operator, and the
 infrastructure providers. This allows you to break away from the self-service
 model by splitting the responsibilities of the user persona across those
@@ -147,24 +147,24 @@ Gateway API has the following primary extension points:
 * *External references.* A feature (field) of a Gateway API resource can
   reference a custom resource specific to the Gateway implementation that
   configures that feature. For example:
-    * [HTTPRouteFilter](/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteFilter)
+    * [HTTPRouteFilter](../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteFilter)
       can reference an external resource via the `extensionRef` field, thus
       configuring an implementation-specific filter.
-    * [BackendObjectReference](/reference/spec/#gateway.networking.k8s.io/v1.BackendObjectReference)
+    * [BackendObjectReference](../reference/spec.md#gateway.networking.k8s.io/v1.BackendObjectReference)
       supports resources other than Services.
-    * [SecretObjectReference](/reference/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)
+    * [SecretObjectReference](../reference/spec.md#gateway.networking.k8s.io/v1.SecretObjectReference)
       supports resources other than Secrets.
 * *Custom implementations*. For some features, it is left up to an
   implementation to define how to support them. Those features correspond to the
   implementation-specific
-  (custom)  [conformance level](/concepts/conformance/#2-support-levels). For
+  (custom)  [conformance level](../concepts/conformance.md#2-support-levels). For
   example:
     * The `RegularExpression` type of
-      the [HTTPPathMatch](/reference/spec/#gateway.networking.k8s.io/v1.HTTPPathMatch).
+      the [HTTPPathMatch](../reference/spec.md#gateway.networking.k8s.io/v1.HTTPPathMatch).
 * *Policies.* A Gateway implementation can define custom resources called
   Policies for exposing data plane features like authentication. Gateway API
   does not prescribe the details of those resources. However, it prescribes a
-  standard UX. See the [Policy attachment guide](/reference/policy-attachment/)
+  standard UX. See the [Policy attachment guide](../reference/policy-attachment.md)
   for more details. In contrast with the *external references* above, a Gateway
   API resource does not reference a Policy. Instead, a Policy must reference a
   Gateway API resource.
@@ -192,9 +192,9 @@ Typically, they will either be shared by all Ingress resources, or every Ingress
 resource will get dedicated entry points.
 
 In Gateway API, entry points must be explicitly defined in
-a [Gateway](/api-types/gateway/) resource. For example, if you want the data
+a [Gateway](../api-types/gateway.md) resource. For example, if you want the data
 plane to handle HTTP traffic on port 80, you need to define
-a [listener](/reference/spec/#gateway.networking.k8s.io/v1.Listener) for
+a [listener](../reference/spec.md#gateway.networking.k8s.io/v1.Listener) for
 that traffic. Typically, a Gateway implementation provides a dedicated data
 plane for each Gateway resource.
 
@@ -207,7 +207,7 @@ the [TLS section](https://kubernetes.io/docs/concepts/services-networking/ingres
 where the TLS certificate and key are stored in a Secret.
 
 In Gateway API, TLS termination is a property of
-the [Gateway listener](/reference/spec/#gateway.networking.k8s.io/v1.Listener),
+the [Gateway listener](../reference/spec.md#gateway.networking.k8s.io/v1.Listener),
 and similarly to the Ingress, a TLS certificate and key are also stored in a
 Secret.
 
@@ -218,21 +218,21 @@ application admin own TLS termination.
 
 The [path-based routing rules](https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types)
 of the Ingress resource map directly to
-the [routing rules](/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteRule)
-of the [HTTPRoute](/api-types/httproute/).
+the [routing rules](../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteRule)
+of the [HTTPRoute](../api-types/httproute.md).
 
 The [host-header-based routing rules](https://kubernetes.io/docs/concepts/services-networking/ingress/#name-based-virtual-hosting)
 map to
-the [hostnames](/reference/spec/#gateway.networking.k8s.io/v1.Hostname) of
+the [hostnames](../reference/spec.md#gateway.networking.k8s.io/v1.Hostname) of
 the HTTPRoute. However, note that in the Ingress, each hostname has separate
 routing rules, while in the HTTPRoute the routing rules apply to all hostnames.
 
 > The Ingress API uses the term host while Gateway API uses the hostname.
 > This guide will use Gateway API term to refer to the Ingress host.
 
-> The `hostnames` of an HTTPRoute must match the `hostname` of the [Gateway listener](/reference/spec/#gateway.networking.k8s.io/v1.Listener).
+> The `hostnames` of an HTTPRoute must match the `hostname` of the [Gateway listener](../reference/spec.md#gateway.networking.k8s.io/v1.Listener).
 > Otherwise, the listener will ignore the routing rules for the unmatched
-> hostnames. See the [HTTPRoute documentation](/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteSpec).
+> hostnames. See the [HTTPRoute documentation](../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteSpec).
 
 HTTPRoutes are owned by the application developer.
 
@@ -251,7 +251,7 @@ In contrast, Gateway API specifies how to merge rules and resolve conflicts:
 * A Gateway implementation must merge the routing rules from all HTTPRoutes
   attached to a listener.
 * Conflicts must be handled as
-  prescribed [here](/concepts/guidelines/#conflicts). For example, more specific
+  prescribed in [API Design Guide: Conflicts](/guides/api-design/#conflicts). For example, more specific
   matches in a routing rule win over the less specific ones.
 
 #### Default Backend
@@ -270,7 +270,7 @@ An Ingress resource must specify
 a [class](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class)
 to select which Ingress controller to use. An HTTPRoute must specify which
 Gateway (or Gateways) to attach to via
-a [parentRef](/reference/spec/#gateway.networking.k8s.io/v1.ParentRef).
+a [parentRef](../reference/spec.md#gateway.networking.k8s.io/v1.ParentRef).
 
 ### Implementation-Specific Ingress Features (Annotations)
 
diff --git a/site-src/guides/multiple-ns.md b/site-src/guides/multiple-ns.md
index 1bb52176..dce09dc6 100644
--- a/site-src/guides/multiple-ns.md
+++ b/site-src/guides/multiple-ns.md
@@ -35,7 +35,7 @@ to centrally control security without directly involving application teams.
 
 The logical relationship between Gateway API resources looks like this:
 
-![Cross-Namespace routing](/images/cross-namespace-routing.svg)
+![Cross-Namespace routing](../images/cross-namespace-routing.svg)
 
 ## Cross-namespace Route Attachment
 
@@ -155,7 +155,7 @@ Gateway that these Routes want to attach to.
 
 After these three Routes are deployed, they will all be attached to the
 `shared-gateway` Gateway. The Gateway merges these Routes into a single flat
-list of routing rules. [Routing precedence](/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteRule)
+list of routing rules. [Routing precedence](../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteRule)
 between these routing rules is determined by most specific match and
 conflicts are handled according to [conflict
 resolution](/concepts/guidelines#conflicts). This provides predictable and
@@ -166,4 +166,4 @@ ownership of their infrastructure more evenly, while still retaining centralized
 control. This gives them the best of both worlds, all delivered through
 declarative and open source APIs.
 
-[attachment]:/concepts/api-overview/#attaching-routes-to-gateways
+[attachment]:../concepts/api-overview.md#attaching-routes-to-gateways
diff --git a/site-src/guides/simple-gateway.md b/site-src/guides/simple-gateway.md
index a49bce55..bcfd64ab 100644
--- a/site-src/guides/simple-gateway.md
+++ b/site-src/guides/simple-gateway.md
@@ -6,7 +6,7 @@ deployed together by the same owner. This represents a similar kind of model
 used for Ingress. In this guide, a Gateway and HTTPRoute are deployed which
 match all HTTP traffic and directs it to a single Service named `foo-svc`. 
 
-![Simple Gateway](/images/single-service-gateway.png)
+![Simple Gateway](../images/single-service-gateway.png)
 
 ```yaml  
 {% include 'standard/simple-gateway/gateway.yaml' %}
@@ -15,9 +15,9 @@ match all HTTP traffic and directs it to a single Service named `foo-svc`.
 The Gateway represents the instantiation of a logical load balancer and the
 GatewayClass defines the load balancer template when users create a Gateway.
 The example Gateway is templated from a hypothetical `example`
-GatewayClass, which is meant to be a placeholder and substitued by users. Here
+GatewayClass, which is meant to be a placeholder and substituted by users. Here
 is a list of available
-[Gateway Implementation](https://gateway-api.sigs.k8s.io/implementations/) that
+[Gateway Implementation](../implementations.md) that
 can be used to determine the correct GatewayClass based on the specific
 infrastructure provider.
 
diff --git a/site-src/guides/tcp.md b/site-src/guides/tcp.md
index e1e66e8e..ccd460ae 100644
--- a/site-src/guides/tcp.md
+++ b/site-src/guides/tcp.md
@@ -2,7 +2,7 @@
 
     The `TCPRoute` resource described below is currently only included in the
     "Experimental" channel of Gateway API. For more information on release
-    channels, refer to our [versioning guide](/concepts/versioning).
+    channels, refer to our [versioning guide](../concepts/versioning.md).
 
 Gateway API is designed to work with multiple protocols and [TCPRoute][tcproute]
 is one such route which allows for managing [TCP][tcp] traffic.
@@ -64,9 +64,9 @@ downside of more tightly coupling the relationship between the Gateway and
 its associated Routes. Refer to [Attaching to Gateways][attaching] for more
 details.
 
-[tcproute]:/reference/spec/#gateway.networking.k8s.io/v1alpha2.TCPRoute
+[tcproute]:../reference/spec.md#gateway.networking.k8s.io/v1alpha2.TCPRoute
 [tcp]:https://datatracker.ietf.org/doc/html/rfc793
-[httproute]:/reference/spec/#gateway.networking.k8s.io/v1alpha2.HTTPRoute
-[gateway]:/reference/spec/#gateway.networking.k8s.io/v1alpha2.Gateway
+[httproute]:../reference/spec.md#gateway.networking.k8s.io/v1alpha2.HTTPRoute
+[gateway]:../reference/spec.md#gateway.networking.k8s.io/v1alpha2.Gateway
 [svc]:https://kubernetes.io/docs/concepts/services-networking/service/
-[attaching]:/api-types/httproute/#attaching-to-gateways
+[attaching]:../api-types/httproute.md#attaching-to-gateways
diff --git a/site-src/guides/tls.md b/site-src/guides/tls.md
index 28dc3dea..be3281ee 100644
--- a/site-src/guides/tls.md
+++ b/site-src/guides/tls.md
@@ -14,11 +14,11 @@ implementation(s) you're using with Gateway API.
 
     The `TLSRoute` and `BackendTLSPolicy` resources described below are currently only included in the
     "Experimental" channel of Gateway API. For more information on release
-    channels, refer to our [versioning guide](/concepts/versioning).
+    channels, refer to our [versioning guide](../concepts/versioning.md).
 
 ## Client/Server and TLS
 
-![overview](/images/tls-overview.svg)
+![overview](../images/tls-overview.svg)
 
 For Gateways, there are two connections involved:
 
diff --git a/site-src/guides/traffic-splitting.md b/site-src/guides/traffic-splitting.md
index e55183d3..b2f99682 100644
--- a/site-src/guides/traffic-splitting.md
+++ b/site-src/guides/traffic-splitting.md
@@ -1,15 +1,15 @@
 # HTTP traffic splitting
 
-The [HTTPRoute resource](/api-types/httproute) allows you to specify 
-weights to shift traffic between different backends. This is useful for 
-splitting traffic during rollouts, canarying changes, or for emergencies. 
-The HTTPRoute`spec.rules.backendRefs` accepts a list of backends that a route 
-rule will send traffic to. The relative weights of these backends define 
-the split of traffic between them. The following YAML snippet shows how two 
-Services are listed as backends for a single route rule. This route rule 
+The [HTTPRoute resource](../api-types/httproute.md) allows you to specify
+weights to shift traffic between different backends. This is useful for
+splitting traffic during rollouts, canarying changes, or for emergencies.
+The HTTPRoute`spec.rules.backendRefs` accepts a list of backends that a route
+rule will send traffic to. The relative weights of these backends define
+the split of traffic between them. The following YAML snippet shows how two
+Services are listed as backends for a single route rule. This route rule
 will split traffic 90% to `foo-v1` and 10% to `foo-v2`.
 
-![Traffic splitting](/images/simple-split.png)
+![Traffic splitting](../images/simple-split.png)
 
 ```yaml
 {% include 'standard/traffic-splitting/simple-split.yaml' %}
@@ -29,7 +29,7 @@ is used to manage the gradual splitting of traffic from v1 to v2.
 
 This example assumes that the following Gateway is deployed:
 
-```yaml 
+```yaml
 {% include 'standard/simple-gateway/gateway.yaml' %}
 ```
 
@@ -41,11 +41,11 @@ production user traffic for `foo.example.com`. The following HTTPRoute has no
 receive 100% of the traffic matched by each of their route rules. A canary
 route rule is used (matching the header `traffic=test`) to send synthetic test
 traffic before splitting any production user traffic to `foo-v2`.
-[Routing precedence](/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteRule)
-ensures that all traffic with the matching host and header 
+[Routing precedence](../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRouteRule)
+ensures that all traffic with the matching host and header
 (the most specific match) will be sent to `foo-v2`.
 
-![Traffic splitting](/images/traffic-splitting-1.png)
+![Traffic splitting](../images/traffic-splitting-1.png)
 
 
 ```yaml
@@ -61,7 +61,7 @@ as a backend along with weights. The weights add up to a total of 100 so
 `foo-v1` receives 90/100=90% of the traffic and `foo-v2` receives
 10/100=10% of the traffic.
 
-![Traffic splitting](/images/traffic-splitting-2.png)
+![Traffic splitting](../images/traffic-splitting-2.png)
 
 
 ```yaml
@@ -72,9 +72,9 @@ as a backend along with weights. The weights add up to a total of 100 so
 
 Finally, if all signals are positive, it is time to fully shift traffic to
 `foo-v2` and complete the rollout. The weight for `foo-v1` is set to
-`0` so that it is configured to accept zero traffic. 
+`0` so that it is configured to accept zero traffic.
 
-![Traffic splitting](/images/traffic-splitting-3.png)
+![Traffic splitting](../images/traffic-splitting-3.png)
 
 
 ```yaml
diff --git a/site-src/implementations.md b/site-src/implementations.md
index 3daefaad..927fdc96 100644
--- a/site-src/implementations.md
+++ b/site-src/implementations.md
@@ -10,15 +10,15 @@ cover, and documentation to help users get started.
 
 !!! info "Compare extended supported features across implementations"
 
-    [View a table to quickly compare supported features of projects](/implementations/v1.1). These outline Gateway controller implementations that have passed core conformance tests, and focus on extended conformance features that they have implemented.
+    [View a table to quickly compare supported features of projects](implementations/v1.1.md). These outline Gateway controller implementations that have passed core conformance tests, and focus on extended conformance features that they have implemented.
 
 ## Gateway Controller Implementation Status <a name="gateways"></a>
 
 - [Acnodal EPIC][1]
 - [Airlock Microgateway][34]
-- [Amazon Elastic Kubernetes Service][23] (alpha)
+- [Amazon Elastic Kubernetes Service][23] (GA)
 - [Apache APISIX][2] (beta)
-- [Avi Kubernetes Operator][31] (tech preview)
+- [Avi Kubernetes Operator][31]
 - [Azure Application Gateway for Containers][27] (GA)
 - [Cilium][16] (beta)
 - [Contour][3] (GA)
@@ -113,13 +113,13 @@ In this section you will find specific links to blog posts, documentation and ot
 [epicsource]:https://github.com/epic-gateway
 
 ### Airlock Microgateway
-[![Conformance](https://img.shields.io/badge/Gateway%20API%20Conformance%20v1.1.0-Airlock%20Microgateway-green)](https://github.com/kubernetes-sigs/gateway-api/blob/main/conformance/reports/v1.1.0/airlock-microgateway)
+[![Conformance](https://img.shields.io/badge/Gateway%20API%20Conformance%20v1.2.1-Airlock%20Microgateway-green)](https://github.com/kubernetes-sigs/gateway-api/blob/main/conformance/reports/v1.2.1/airlock-microgateway)
 
 [Airlock Microgateway][airlock-microgateway] is a Kubernetes native WAAP (Web Application and API Protection) solution to protect microservices.
 Modern application security is embedded in the development workflow and follows DevSecOps paradigms.
 Airlock Microgateway protects your applications and microservices with the tried-and-tested Airlock security features against attacks, while also providing a high degree of scalability.
 
-With [Airlock Microgateway 4.4][airlock-microgateway-v4.4], Airlock Microgateway introduces a sidecarless data plane mode
+With [Airlock Microgateway 4.4][airlock-microgateway-gwapi-arch], Airlock Microgateway introduces a sidecarless data plane mode
 based on Gateway API to avoid the operational complexity of sidecars.
 
 #### Features
@@ -135,9 +135,9 @@ based on Gateway API to avoid the operational complexity of sidecars.
 - Check our [Airlock community forum][airlock-microgateway-community-support] and [support process][airlock-microgateway-premium-support] for support.
 
 [airlock-microgateway]:https://www.airlock.com/en/secure-access-hub/components/microgateway
-[airlock-microgateway-v4.4]:https://docs.airlock.com/microgateway/4.4/#data/1725073468781.html
+[airlock-microgateway-gwapi-arch]:https://docs.airlock.com/microgateway/latest/?topic=MGW-00000141
 [airlock-microgateway-documentation]:https://docs.airlock.com/microgateway/latest
-[airlock-microgateway-guide]:https://docs.airlock.com/microgateway/4.4/#data/1726159368351.html
+[airlock-microgateway-guide]:https://docs.airlock.com/microgateway/latest/?topic=MGW-00000142
 [airlock-microgateway-community-support]:https://forum.airlock.com/
 [airlock-microgateway-premium-support]:https://techzone.ergon.ch/support-process
 
@@ -160,15 +160,15 @@ APISIX currently supports Gateway API `v1beta1` version of the specification for
 
 ### Avi Kubernetes Operator
 
-[Avi Kubernetes Operator (AKO)][ako] provides L4-L7 load-balancing using VMware NSX Advanced Load Balancer.
+[Avi Kubernetes Operator (AKO)][ako] provides L4-L7 load-balancing using VMware AVI Advanced Load Balancer.
 
-Starting with AKO version [v1.11.1], Gateway API version v0.6.2 is supported. It implements v1beta1 version of Gateway API specification supporting GatewayClass, Gateway and HTTPRoute objects. AKO Gateway API is currently in Tech Preview.
+Starting with AKO version [v1.13.1], Gateway API version v1.0.0 is supported. It implements v1 version of Gateway API specification supporting GatewayClass, Gateway and HTTPRoute objects.
 
 Documentation to deploy and use AKO Gateway API can be found at [Avi Kubernetes Operator Gateway API][ako-gw].
 
-[ako]:https://docs.vmware.com/en/VMware-NSX-Advanced-Load-Balancer/1.11/Avi-Kubernetes-Operator-Guide/GUID-1E86BD1A-899F-40C2-A931-29310B2B340F.html
-[ako-gw]:https://docs.vmware.com/en/VMware-NSX-Advanced-Load-Balancer/1.11/Avi-Kubernetes-Operator-Guide/GUID-84BD68AB-B96F-425C-8323-3A249D6AC8B2.html
-[v1.11.1]:https://github.com/vmware/load-balancer-and-ingress-services-for-kubernetes
+[ako]:https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-kubernetes-operator/AKO/avi-kubernetes-operator-1-13/avi-kubernetes-operator.html
+[ako-gw]:https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-kubernetes-operator/AKO/avi-kubernetes-operator-1-13/gateway-api/gateway-api-v1.html
+[v1.13.1]:https://github.com/vmware/load-balancer-and-ingress-services-for-kubernetes
 
 ### Azure Application Gateway for Containers
 
@@ -221,7 +221,7 @@ For help and support with Contour's implementation, [create an issue][contour-is
 
 [contour]:https://projectcontour.io
 [contour-release]:https://github.com/projectcontour/contour/releases/tag/v1.30.0
-[contour-standard]:https://gateway-api.sigs.k8s.io/concepts/versioning/#release-channels-eg-experimental-standard
+[contour-standard]:concepts/versioning.md#release-channels-eg-experimental-standard
 [contour-guide]:https://projectcontour.io/docs/1.30/guides/gateway-api/
 [contour-issue-new]:https://github.com/projectcontour/contour/issues/new/choose
 [contour-slack]:https://kubernetes.slack.com/archives/C8XRH2R4J
@@ -265,7 +265,7 @@ few simple steps.
 
 [Flomesh Service Mesh][fsm] is a community driven lightweight service mesh for Kubernetes East-West and North-South traffic management. Flomesh uses [ebpf](https://www.kernel.org/doc/html/latest/bpf/index.html) for layer4 and [pipy](https://flomesh.io/pipy) proxy for layer7 traffic management. Flomesh comes bundled with a load balancer, cross-cluster service registration/discovery and it supports multi-cluster networking. It supports `Ingress` (and as such is an "Ingress controller") and Gateway API.
 
-FSM support of Gateway API is built on top [Flomesh Gateway API](fgw) and it currently supports Kubernetes Gateway API version [v0.7.1](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.7.1) with support for `v0.8.0` currently in progress.
+FSM support of Gateway API is built on top [Flomesh Gateway API][fgw] and it currently supports Kubernetes Gateway API version [v0.7.1](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.7.1) with support for `v0.8.0` currently in progress.
 
 - [FSM Kubernetes Gateway API compatibility matrix](https://github.com/flomesh-io/fsm/blob/main/docs/gateway-api-compatibility.md)
 - [How to use Gateway API support in FSM](https://github.com/flomesh-io/fsm/blob/main/docs/tests/gateway-api/README.md)
@@ -282,7 +282,7 @@ FSM support of Gateway API is built on top [Flomesh Gateway API](fgw) and it cur
 [Gloo Gateway][gloogateway] by [Solo.io][solo] is a feature-rich, Kubernetes-native ingress controller and next-generation API gateway.
 Gloo Gateway brings the full power and community support of Gateway API to its existing control-plane implementation.
 
-The Gloo Gateway ingress controller passes all the core Gateway API conformance tests in the v1.1.0 release for the GATEWAY_HTTP conformance 
+The Gloo Gateway ingress controller passes all the core Gateway API conformance tests in the v1.1.0 release for the GATEWAY_HTTP conformance
 profile except `HTTPRouteServiceTypes`.
 
 [gloogateway]:https://docs.solo.io/gateway/latest/
@@ -330,12 +330,12 @@ HAProxy Kubernetes Ingress Controller is an open-source project maintained by HA
 
 [Consul][consul], by [HashiCorp][hashicorp], is an open source control plane for multi-cloud networking. A single Consul deployment can span bare metal, VM and container environments.
 
-Consul service mesh works on any Kubernetes distribution, connects multiple clusters, and Consul CRDs provide a Kubernetes native workflow to manage traffic patterns and permissions in the mesh. [Consul API Gateway][consul-api-gw-doocs] supports Gateway API for managing North-South traffic.
+Consul service mesh works on any Kubernetes distribution, connects multiple clusters, and Consul CRDs provide a Kubernetes native workflow to manage traffic patterns and permissions in the mesh. [Consul API Gateway][consul-api-gw-docs] supports Gateway API for managing North-South traffic.
 
-Please see the [Consul API Gateway documentation][consul-api-gw-doocs] for current information on the supported version and features of the Gateway API.
+Please see the [Consul API Gateway documentation][consul-api-gw-docs] for current information on the supported version and features of the Gateway API.
 
 [consul]:https://consul.io
-[consul-api-gw-doocs]:https://www.consul.io/docs/api-gateway
+[consul-api-gw-docs]:https://www.consul.io/docs/api-gateway
 [hashicorp]:https://www.hashicorp.com
 
 ### Istio
@@ -427,7 +427,7 @@ The [LiteSpeed Ingress Controller](https://litespeedtech.com/products/litespeed-
 
 ### LoxiLB
 
-[kube-loxilb][kube-loxilb-gh] is [LoxiLB's][loxilb-org] implementation of Gateway API and kubernetes service load-balancer spec which includes support for load-balancer class, advanced IPAM (shared or exclusive) etc. kube-loxilb manages Gateway API resources with [LoxiLB][loxilb-gh] as L4 service LB and [loxilb-ingress][loxilb-ingress-gh] for Ingress(L7) resources.  
+[kube-loxilb][kube-loxilb-gh] is [LoxiLB's][loxilb-org] implementation of Gateway API and kubernetes service load-balancer spec which includes support for load-balancer class, advanced IPAM (shared or exclusive) etc. kube-loxilb manages Gateway API resources with [LoxiLB][loxilb-gh] as L4 service LB and [loxilb-ingress][loxilb-ingress-gh] for Ingress(L7) resources.
 
 Follow the [quickstart guide][loxigw-guide] to get LoxiLB running with Gateway API in a few simple steps.
 
@@ -446,7 +446,7 @@ Follow the [quickstart guide][loxigw-guide] to get LoxiLB running with Gateway A
 
 For a list of supported Gateway API resources and features, see the [Gateway API Compatibility][nginx-compat] doc.
 
-If you have any suggestions or experience issues with NGINX Gateway Fabric, please [create an issue][nginx-issue-new] or a [discussion][nginx-disc-new] on GitHub. You can also ask for help in the [#nginx-gateway-fabric channel on NGINX slack][nginx-slack].
+If you have any suggestions or experience issues with NGINX Gateway Fabric, please [create an issue][nginx-issue-new] or a [discussion][nginx-disc-new] on GitHub. You can also ask for help in the [NGINX Community Forum][nginx-forum].
 
 [nginx-gateway-fabric]:https://github.com/nginx/nginx-gateway-fabric
 [nginx]:https://nginx.org/
@@ -454,7 +454,7 @@ If you have any suggestions or experience issues with NGINX Gateway Fabric, plea
 [nginx-compat]:https://docs.nginx.com/nginx-gateway-fabric/overview/gateway-api-compatibility/
 [nginx-issue-new]:https://github.com/nginx/nginx-gateway-fabric/issues/new
 [nginx-disc-new]:https://github.com/nginx/nginx-gateway-fabric/discussions/new
-[nginx-slack]:https://nginxcommunity.slack.com/channels/nginx-gateway-fabric
+[nginx-forum]:https://community.nginx.org/
 
 
 ### ngrok Kubernetes Operator
diff --git a/site-src/index.md b/site-src/index.md
index 6eba2738..417c3f23 100644
--- a/site-src/index.md
+++ b/site-src/index.md
@@ -6,15 +6,15 @@ Load Balancing, and Service Mesh APIs. From the outset, it has been designed to
 be generic, expressive, and role-oriented.
 
 The overall resource model focuses on 3 separate
-[personas](/concepts/roles-and-personas) and corresponding resources that
+[personas](concepts/roles-and-personas.md) and corresponding resources that
 they are expected to manage:
 
 <!-- Source: https://docs.google.com/presentation/d/11HEYCgFi-aya7FS91JvAfllHiIlvfgcp7qpi_Azjk4E/edit#slide=id.g292839eca6d_1_0 -->
 <img src="/images/resource-model.png" alt="Gateway API Resource Model" class="center" />
 
 Most of the configuration in this API is contained in the Routing layer. These
-protocol-specific resources ([HTTPRoute](/api-types/httproute),
-[GRPCRoute](/api-types/grpcroute), etc) enable advanced routing capabilities
+protocol-specific resources ([HTTPRoute](api-types/httproute.md),
+[GRPCRoute](api-types/grpcroute.md), etc) enable advanced routing capabilities
 for both Ingress and Mesh.
 
 The Gateway API Logo helps illustrate the dual purpose of this API, enabling
@@ -29,17 +29,17 @@ same configuration.
 
     Gateway, GatewayClass, and HTTPRoute have been part of the Standard Channel
     of Gateway API since v0.5.0 and are considered stable APIs. For more
-    information refer to our [versioning guide](/concepts/versioning).
+    information refer to our [versioning guide](concepts/versioning.md).
 
-When using Gateway API to manage ingress traffic, the [Gateway](/api-types/gateway) resource
+When using Gateway API to manage ingress traffic, the [Gateway](api-types/gateway.md) resource
 defines a point of access at which traffic can be routed across multiple
 contexts -- for example, from outside the cluster to inside the cluster
 ([north/south traffic]).
 
-Each Gateway is associated with a [GatewayClass](/api-types/gatewayclass), which
+Each Gateway is associated with a [GatewayClass](api-types/gatewayclass.md), which
 describes the actual kind of [gateway controller] that will handle traffic for
 the Gateway; individual routing resources (such as
-[HTTPRoute](/api-types/httproute)) are then [associated with the Gateway
+[HTTPRoute](api-types/httproute.md)) are then [associated with the Gateway
 resources][gateway-attachment]. Separating these different concerns into
 distinct resources is a critical part of the role-oriented nature of Gateway
 API, as well as allowing for multiple kinds of gateway controllers (represented
@@ -47,35 +47,35 @@ by GatewayClass resources), each with multiple instances (represented by Gateway
 resources), in the same cluster.
 
 [Ingress API]:https://kubernetes.io/docs/concepts/services-networking/ingress/
-[north/south traffic]:/concepts/glossary#northsouth-traffic
-[east/west traffic]:/concepts/glossary#eastwest-traffic
-[gateway controller]:/concepts/glossary#gateway-controller
-[gateway-attachment]:/concepts/api-overview#attaching-routes-to-gateways
+[north/south traffic]:concepts/glossary.md#northsouth-traffic
+[east/west traffic]:concepts/glossary.md#eastwest-traffic
+[gateway controller]:concepts/glossary.md#gateway-controller
+[gateway-attachment]:concepts/api-overview.md#attaching-routes-to-gateways
 
-## Gateway API for Service Mesh (the [GAMMA initiative](/mesh/gamma)) <a name="for-service-mesh"></a>
+## Gateway API for Service Mesh (the [GAMMA initiative](mesh/gamma.md)) <a name="for-service-mesh"></a>
 
 ??? success "Standard Channel since v1.1.0"
 
-    The [GAMMA initiative](/mesh/gamma) work for supporting service mesh use
+    The [GAMMA initiative](mesh/gamma.md) work for supporting service mesh use
     cases has been part of the Standard Channel since v1.1.0 and is considered
-    GA. For more information refer to our [versioning guide](/concepts/versioning).
+    GA. For more information refer to our [versioning guide](concepts/versioning.md).
 
 Things are a bit different when using Gateway API to manage a [service
 mesh][service-mesh]. Since there will usually only be one mesh active in the
-cluster, the [Gateway](/api-types/gateway) and
-[GatewayClass](/api-types/gatewayclass) resources are not used; instead,
-individual route resources (such as [HTTPRoute](/api-types/httproute)) are
+cluster, the [Gateway](api-types/gateway.md) and
+[GatewayClass](api-types/gatewayclass.md) resources are not used; instead,
+individual route resources (such as [HTTPRoute](api-types/httproute.md)) are
 [associated directly with Service resources][mesh-attachment], permitting the
 mesh to manage traffic from any traffic directed to that Service while
 preserving the role-oriented nature of Gateway API.
 
-To date, [GAMMA](/mesh/gamma) has been able to support mesh functionality with
+To date, [GAMMA](mesh/gamma.md) has been able to support mesh functionality with
 fairly minimal changes to Gateway API. One particular area that has
 rapidly become critical for GAMMA, though, is the definition of the different
 [facets of the Service resource][service-facets].
 
 [gamma]:/concepts/gamma/
-[service-mesh]:/concepts/glossary#service-mesh
+[service-mesh]:concepts/glossary.md#service-mesh
 [service-facets]:/concepts/service-facets
 [mesh-attachment]:/concepts/gamma#gateway-api-for-mesh
 
@@ -85,11 +85,11 @@ Whether you are a user interested in using Gateway API or an implementer
 interested in conforming to the API, the following resources will help give
 you the necessary background:
 
-- [API overview](/concepts/api-overview)
-- [User guides](/guides)
-- [Implementations](/implementations)
-- [API reference spec](/reference/spec)
-- [Community links](/contributing/community) and [developer guide](/contributing/devguide)
+- [API overview](concepts/api-overview.md)
+- [User guides](guides/index.md)
+- [Implementations](implementations.md)
+- [API reference spec](reference/spec.md)
+- [Community links](/contributing/community) and [developer guide](contributing/devguide.md)
 
 ## Gateway API concepts
 The following design goals drive the concepts of Gateway API. These
@@ -163,7 +163,7 @@ The roles used for Gateway API's design are defined by three personas:
   getting in her way to get things done.
 
 (These three are discussed in more detail in [Roles and
-Personas](/concepts/roles-and-personas).)
+Personas](concepts/roles-and-personas.md).)
 
 It should be clear that while Ana, Chihiro, and Ian do not necessarily see
 eye-to-eye about everything, they need to work together to keep things running
@@ -179,24 +179,23 @@ The use cases presented are deliberately cast in terms of the roles presented
 above. Ultimately Gateway API is meant for use by humans, which means that
 it must fit the uses to which each of Ana, Chihiro, and Ian will put it.
 
-[use-cases]:/concepts/use-cases
+[use-cases]:concepts/use-cases.md
 
 ## What's the difference between Gateway API and an API Gateway?
 
-An API Gateway is a general concept that describes anything that exposes
-capabilities of a backend service, while providing extra capabilities for
-traffic routing and manipulation, such as load balancing, request and response
-transformation, and sometimes more advanced features like authentication and
-authorization, rate limiting, and circuit breaking.
+An [API gateway](https://glossary.cncf.io/api-gateway/) is a tool that
+aggregates unique application APIs, making them all available in one place.
+It allows organizations to move key functions, such as authentication and
+authorization or limiting the number of requests between applications, to a
+centrally managed location. An API gateway functions as a common interface to (often external) API consumers.
 
-Gateway API is an interface, or set of resources, that model service
-networking in Kubernetes. One of the main resources is a `Gateway`, which
-declares the Gateway type (or class) to instantiate and its configuration. As
-a Gateway Provider, you can implement Gateway API to model Kubernetes
-service networking in an expressive, extensible, and role-oriented way.
+Gateway API is an interface, defined as a set of Kubernetes resources, that 
+models service networking in Kubernetes. One of the main resources is a `Gateway`,
+which declares the Gateway type (or class) to instantiate and its configuration.
+As a Gateway provider, you can implement Gateway API to model Kubernetes service
+networking in an expressive, extensible, and role-oriented way.
 
-Most Gateway API implementations are API Gateways to some extent, but not all
-API Gateways are Gateway API implementations.
+Some API gateways can be programmed using the Gateway API.
 
 ## Who is working on Gateway API?
 
diff --git a/site-src/mesh/gamma.md b/site-src/mesh/gamma.md
index a6d08d98..6071711c 100644
--- a/site-src/mesh/gamma.md
+++ b/site-src/mesh/gamma.md
@@ -38,11 +38,11 @@ non-technical.
 The simplest way to get started is to attend one of the regular Gateway API
 [meetings].
 
-[north/south traffic]:/concepts/glossary#northsouth-traffic
-[service mesh]:/concepts/glossary#service-mesh
-[east/west traffic]:/concepts/glossary#eastwest-traffic
-[role-oriented]:/concepts/roles-and-personas
-[geps]:/geps/overview
-[contributor-ladder]:/contributing/contributor-ladder
+[north/south traffic]:../concepts/glossary.md#northsouth-traffic
+[service mesh]:../concepts/glossary.md#service-mesh
+[east/west traffic]:../concepts/glossary.md#eastwest-traffic
+[role-oriented]:../concepts/roles-and-personas.md
+[geps]:../geps/overview.md
+[contributor-ladder]:../contributing/contributor-ladder.md
 [meetings]:/contributing/community/#meetings
 [GAMMA leads]:https://github.com/kubernetes-sigs/gateway-api/blob/main/OWNERS_ALIASES#L23
diff --git a/site-src/mesh/index.md b/site-src/mesh/index.md
index 47d0d5b1..98891909 100644
--- a/site-src/mesh/index.md
+++ b/site-src/mesh/index.md
@@ -3,11 +3,11 @@
 
 ??? success "Standard Channel since v1.1.0"
 
-    The [GAMMA initiative](/mesh/gamma) work for supporting service mesh use
+    The [GAMMA initiative](gamma.md) work for supporting service mesh use
     cases has been part of the Standard Channel since v1.1.0 and is considered
-    GA. For more information refer to our [versioning guide](/concepts/versioning).
+    GA. For more information refer to our [versioning guide](../concepts/versioning.md).
 
-The "[GAMMA initiative](/mesh/gamma)" refers to the group that is defining how
+The "[GAMMA initiative](gamma.md)" refers to the group that is defining how
 Gateway API can be used for Service Mesh. To date, this group has been able to
 define service mesh support in the Gateway API with relatively small changes.
 The most significant change that GAMMA has introduced to date is that, when
@@ -30,12 +30,12 @@ This distinction helps the Gateway API to be exact about how routing within a
 mesh functions, without requiring new resources that largely duplicate the
 Service.
 
-[GatewayClass]: /api-types/gatewayclass
-[Gateway]: /api-types/gateway
-[HTTPRoute]: /api-types/httproute
-[TCPRoute]: /concepts/api-overview/#tcproute-and-udproute
+[GatewayClass]: ../api-types/gatewayclass.md
+[Gateway]: ../api-types/gateway.md
+[HTTPRoute]: ../api-types/httproute.md
+[TCPRoute]: ../concepts/api-overview.md#tcproute-and-udproute
 [Service]: https://kubernetes.io/docs/concepts/services-networking/service/
-[service-mesh]:/concepts/glossary#service-mesh
+[service-mesh]:../concepts/glossary.md#service-mesh
 [service-facets]:/concepts/service-facets
 
 ## Connecting routes and services <a name="gateway-api-for-mesh">
@@ -128,11 +128,11 @@ it is not currently possible for `blender` and `mixer` to use HTTPRoutes to set
 different timeouts for their calls to the `oven` workload. `blender` and `mixer`
 would need to be moved into separate Namespaces to allow this.
 
-[Ana]:/concepts/roles-and-personas#ana
-[producer route]:/concepts/glossary#producer-route
-[consumer route]:/concepts/glossary#consumer-route
-[service mesh]:/concepts/glossary#service-mesh
-[Route merging rules]:/api-types/httproute#merging
+[Ana]:../concepts/roles-and-personas.md#ana
+[producer route]:../concepts/glossary.md#producer-route
+[consumer route]:../concepts/glossary.md#consumer-route
+[service mesh]:../concepts/glossary.md#service-mesh
+[Route merging rules]:../api-types/httproute.md#merging
 
 ## Request Flow
 
@@ -157,6 +157,6 @@ looks like:
 6. The data plane routes the request on to the destination workload (most likely
    using [endpoint routing], but it is allowed to use [Service routing]).
 
-[east/west]:/concepts/glossary#eastwest-traffic
-[endpoint routing]:/concepts/glossary#endpoint-routing
-[Service routing]:/concepts/glossary#service-routing
+[east/west]:../concepts/glossary.md#eastwest-traffic
+[endpoint routing]:../concepts/glossary.md#endpoint-routing
+[Service routing]:../concepts/glossary.md#service-routing
diff --git a/site-src/mesh/service-facets.md b/site-src/mesh/service-facets.md
index 80fc97e4..9b5f880b 100644
--- a/site-src/mesh/service-facets.md
+++ b/site-src/mesh/service-facets.md
@@ -25,7 +25,7 @@ as comprising two separate _facets_:
   associated with the endpoint IPs.)
 
 The distinction between the facets is critical because the
-[gateway](/api-types/gateway/) and the [mesh](/mesh) each need to decide whether
+[gateway](../api-types/gateway.md) and the [mesh](index.md) each need to decide whether
 a request that mentions a given Service should be directed to the Service's
 frontend or its backend:
 
@@ -44,7 +44,7 @@ endpoint routing can be more predictable when using Gateway API for both
 formalize guidance for this use case.
 
 [Service]: https://kubernetes.io/docs/concepts/services-networking/service/
-[north/south]:/concepts/glossary#northsouth-traffic
-[east/west traffic]:/concepts/glossary#eastwest-traffic
+[north/south]:../concepts/glossary.md#northsouth-traffic
+[east/west traffic]:../concepts/glossary.md#eastwest-traffic
 [gamma]:/concepts/gamma/
-[Ana]:/concepts/roles-and-personas#ana
+[Ana]:../concepts/roles-and-personas.md#ana
diff --git a/site-src/overrides/partials/copyright.html b/site-src/overrides/partials/copyright.html
index a34e202c..bb55bb04 100644
--- a/site-src/overrides/partials/copyright.html
+++ b/site-src/overrides/partials/copyright.html
@@ -22,10 +22,10 @@
 
 <!-- Copyright and theme information -->
 <div class="md-copyright">
-  {% if config.trademark %}
+  {% if config.extra.trademark %}
   <p>
     The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation,
-    please see our <a href="{{ config.trademark }}">Trademark Usage page</a>.
+    please see our <a href="{{ config.extra.trademark }}">Trademark Usage page</a>.
   </p>
   {% endif %}
   {% if not config.extra.generator == false %}
diff --git a/site-src/reference/policy-attachment.md b/site-src/reference/policy-attachment.md
index 6cb8789d..67c9d771 100644
--- a/site-src/reference/policy-attachment.md
+++ b/site-src/reference/policy-attachment.md
@@ -13,5 +13,5 @@ A "Policy Attachment" is a specific type of _metaresource_ that can affect speci
 settings across either one object (this is "Direct Policy Attachment"), or objects
 in a hierarchy (this is "Inherited Policy Attachment").
 
-This pattern is EXPERIMENTAL, and is described in [GEP-713](/geps/gep-713/).
+This pattern is EXPERIMENTAL, and is described in [GEP-713](../geps/gep-713/index.md).
 Please see that document for technical details.



Test patch:
diff --git a/apis/v1/util/validation/gatewayclass_test.go b/apis/v1/util/validation/gatewayclass_test.go
index d211b1fc..f5cdb1d0 100644
--- a/apis/v1/util/validation/gatewayclass_test.go
+++ b/apis/v1/util/validation/gatewayclass_test.go
@@ -20,7 +20,7 @@ import (
 	"testing"
 
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
-	validationtutils "sigs.k8s.io/gateway-api/apis/v1beta1/util/validation"
+	validationutil "sigs.k8s.io/gateway-api/apis/v1beta1/util/validation"
 )
 
 func TestIsControllerNameValid(t *testing.T) {
@@ -58,7 +58,7 @@ func TestIsControllerNameValid(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			isValid := validationtutils.IsControllerNameValid(tc.controllerName)
+			isValid := validationutil.IsControllerNameValid(tc.controllerName)
 			if isValid != tc.isvalid {
 				t.Errorf("Expected validity %t, got %t", tc.isvalid, isValid)
 			}
diff --git a/apis/v1beta1/util/validation/gatewayclass_test.go b/apis/v1beta1/util/validation/gatewayclass_test.go
index 175d4f9a..128de494 100644
--- a/apis/v1beta1/util/validation/gatewayclass_test.go
+++ b/apis/v1beta1/util/validation/gatewayclass_test.go
@@ -20,7 +20,7 @@ import (
 	"testing"
 
 	gatewayv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
-	validationtutils "sigs.k8s.io/gateway-api/apis/v1beta1/util/validation"
+	validationutil "sigs.k8s.io/gateway-api/apis/v1beta1/util/validation"
 )
 
 func TestIsControllerNameValid(t *testing.T) {
@@ -58,7 +58,7 @@ func TestIsControllerNameValid(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			isValid := validationtutils.IsControllerNameValid(tc.controllerName)
+			isValid := validationutil.IsControllerNameValid(tc.controllerName)
 			if isValid != tc.isvalid {
 				t.Errorf("Expected validity %t, got %t", tc.isvalid, isValid)
 			}
diff --git a/apis/applyconfiguration/apis/v1/grpcroutestatus.go b/applyconfiguration/apis/v1/grpcroutestatus.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/grpcroutestatus.go
rename to applyconfiguration/apis/v1/grpcroutestatus.go
diff --git a/apis/applyconfiguration/apis/v1/httproutestatus.go b/applyconfiguration/apis/v1/httproutestatus.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/httproutestatus.go
rename to applyconfiguration/apis/v1/httproutestatus.go
diff --git a/apis/applyconfiguration/apis/v1/routestatus.go b/applyconfiguration/apis/v1/routestatus.go
similarity index 100%
rename from apis/applyconfiguration/apis/v1/routestatus.go
rename to applyconfiguration/apis/v1/routestatus.go
diff --git a/apis/applyconfiguration/apis/v1alpha2/tcproutestatus.go b/applyconfiguration/apis/v1alpha2/tcproutestatus.go
similarity index 96%
rename from apis/applyconfiguration/apis/v1alpha2/tcproutestatus.go
rename to applyconfiguration/apis/v1alpha2/tcproutestatus.go
index a32ffd2b..9094efd4 100644
--- a/apis/applyconfiguration/apis/v1alpha2/tcproutestatus.go
+++ b/applyconfiguration/apis/v1alpha2/tcproutestatus.go
@@ -19,7 +19,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	v1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // TCPRouteStatusApplyConfiguration represents a declarative configuration of the TCPRouteStatus type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/tlsroutestatus.go b/applyconfiguration/apis/v1alpha2/tlsroutestatus.go
similarity index 96%
rename from apis/applyconfiguration/apis/v1alpha2/tlsroutestatus.go
rename to applyconfiguration/apis/v1alpha2/tlsroutestatus.go
index 4f0cb408..43a48f42 100644
--- a/apis/applyconfiguration/apis/v1alpha2/tlsroutestatus.go
+++ b/applyconfiguration/apis/v1alpha2/tlsroutestatus.go
@@ -19,7 +19,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	v1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // TLSRouteStatusApplyConfiguration represents a declarative configuration of the TLSRouteStatus type for use
diff --git a/apis/applyconfiguration/apis/v1alpha2/udproutestatus.go b/applyconfiguration/apis/v1alpha2/udproutestatus.go
similarity index 96%
rename from apis/applyconfiguration/apis/v1alpha2/udproutestatus.go
rename to applyconfiguration/apis/v1alpha2/udproutestatus.go
index 57abcf15..ae17a28b 100644
--- a/apis/applyconfiguration/apis/v1alpha2/udproutestatus.go
+++ b/applyconfiguration/apis/v1alpha2/udproutestatus.go
@@ -19,7 +19,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	v1 "sigs.k8s.io/gateway-api/apis/applyconfiguration/apis/v1"
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
 // UDPRouteStatusApplyConfiguration represents a declarative configuration of the UDPRouteStatus type for use
diff --git a/conformance/tests/httproute-request-header-modifier-backend-weights.go b/conformance/tests/httproute-request-header-modifier-backend-weights.go
new file mode 100644
index 00000000..33b720bf
--- /dev/null
+++ b/conformance/tests/httproute-request-header-modifier-backend-weights.go
@@ -0,0 +1,88 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/types"
+
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests,
+		HTTPRouteRequestHeaderModifierBackendWeights,
+	)
+}
+
+var HTTPRouteRequestHeaderModifierBackendWeights = suite.ConformanceTest{
+	ShortName:   "HTTPRouteRequestHeaderModifierBackendWeights",
+	Description: "An HTTPRoute with backend request header modifier filter sends traffic to the correct backends",
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportHTTPRouteBackendRequestHeaderModification,
+		features.SupportHTTPRoute,
+	},
+	Manifests: []string{"tests/httproute-request-header-modifier-backend-weights.yaml"},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-infra"
+
+		routeNN := types.NamespacedName{Name: "request-header-modifier-backend-weights", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+		gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
+		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+		roundTripper := suite.RoundTripper
+
+		expected := http.ExpectedResponse{
+			Request:   http.Request{Path: "/"},
+			Response:  http.Response{StatusCode: 200},
+			Namespace: "gateway-conformance-infra",
+		}
+
+		req := http.MakeRequest(t, &expected, gwAddr, "HTTP", "http")
+
+		// Assert request succeeds before checking traffic
+		http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expected)
+
+		for range 100 {
+			cReq, _, err := roundTripper.CaptureRoundTrip(req)
+			if err != nil {
+				t.Fatalf("failed to roundtrip request: %v", err)
+			}
+
+			expectedBackends := cReq.Headers["Backend"]
+
+			if len(expectedBackends) != 1 {
+				t.Fatalf("expected a single 'Backend' header to have been set, got %d", len(expectedBackends))
+			}
+
+			if !strings.HasPrefix(cReq.Pod, expectedBackends[0]) {
+				t.Fatalf(
+					"expected the backendRef to have set the correct headers and sent the request to the correct pod, got %q, want %q",
+					cReq.Pod,
+					expectedBackends[0],
+				)
+			}
+		}
+	},
+}
diff --git a/conformance/tests/httproute-request-header-modifier-backend-weights.yaml b/conformance/tests/httproute-request-header-modifier-backend-weights.yaml
new file mode 100644
index 00000000..3b4ad201
--- /dev/null
+++ b/conformance/tests/httproute-request-header-modifier-backend-weights.yaml
@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: request-header-modifier-backend-weights
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: same-namespace
+  rules:
+  - backendRefs:
+    - name: infra-backend-v1
+      port: 8080
+      weight: 10
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: Backend
+            value: infra-backend-v1
+    - name: infra-backend-v2
+      port: 8080
+      weight: 10
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: Backend
+            value: infra-backend-v2
diff --git a/conformance/utils/suite/suite_test.go b/conformance/utils/suite/suite_test.go
index 639fc6ca..951571f7 100644
--- a/conformance/utils/suite/suite_test.go
+++ b/conformance/utils/suite/suite_test.go
@@ -181,7 +181,7 @@ func TestGetAPIVersionAndChannel(t *testing.T) {
 }
 
 const (
-	coreFeature     features.FeatureName = "coreFature"
+	coreFeature     features.FeatureName = "coreFeature"
 	extendedFeature features.FeatureName = "extendedFeature"
 
 	testProfileName ConformanceProfileName = "testProfile"
diff --git a/pkg/test/cel/backendtrafficpolicy_test.go b/pkg/test/cel/backendtrafficpolicy_test.go
new file mode 100644
index 00000000..ca7aee69
--- /dev/null
+++ b/pkg/test/cel/backendtrafficpolicy_test.go
@@ -0,0 +1,269 @@
+//go:build experimental
+// +build experimental
+
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gatewayv1a2 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+)
+
+func TestBackendTrafficPolicyConfig(t *testing.T) {
+	tests := []struct {
+		name               string
+		wantErrors         []string
+		sessionPersistence gatewayv1a2.SessionPersistence
+		retryConstraint    gatewayv1a2.RetryConstraint
+	}{
+		{
+			name: "valid BackendTrafficPolicyConfig no retryConstraint budgetPercent",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName:     ptrTo("foo"),
+				AbsoluteTimeout: toDuration("1h"),
+				Type:            ptrTo(gatewayv1.CookieBasedSessionPersistence),
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetInterval: toDuration("10s"),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("1s"),
+				}),
+			},
+			wantErrors: []string{},
+		},
+		{
+			name: "valid BackendTrafficPolicyConfig no retryConstraint budgetInterval",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName:     ptrTo("foo"),
+				AbsoluteTimeout: toDuration("1h"),
+				Type:            ptrTo(gatewayv1.CookieBasedSessionPersistence),
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent: ptrTo(20),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("1s"),
+				}),
+			},
+			wantErrors: []string{},
+		},
+		{
+			name: "valid BackendTrafficPolicyConfig no retryConstraint minRetryRate",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName:     ptrTo("foo"),
+				AbsoluteTimeout: toDuration("1h"),
+				Type:            ptrTo(gatewayv1.CookieBasedSessionPersistence),
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent:  ptrTo(20),
+				BudgetInterval: toDuration("10s"),
+			},
+			wantErrors: []string{},
+		},
+		{
+			name: "invalid BackendTrafficPolicyConfig budgetInterval too long",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName:     ptrTo("foo"),
+				AbsoluteTimeout: toDuration("1h"),
+				Type:            ptrTo(gatewayv1.CookieBasedSessionPersistence),
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent:  ptrTo(20),
+				BudgetInterval: toDuration("2h"),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("10s"),
+				}),
+			},
+			wantErrors: []string{"budgetInterval can not be greater than one hour or less than one second"},
+		},
+		{
+			name: "invalid BackendTrafficPolicyConfig budgetInterval too short",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName:     ptrTo("foo"),
+				AbsoluteTimeout: toDuration("1h"),
+				Type:            ptrTo(gatewayv1.CookieBasedSessionPersistence),
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent:  ptrTo(20),
+				BudgetInterval: toDuration("1ms"),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("10s"),
+				}),
+			},
+			wantErrors: []string{"budgetInterval can not be greater than one hour or less than one second"},
+		},
+		{
+			name: "invalid BackendTrafficPolicyConfig minRetryRate interval",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName:     ptrTo("foo"),
+				AbsoluteTimeout: toDuration("1h"),
+				Type:            ptrTo(gatewayv1.CookieBasedSessionPersistence),
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent:  ptrTo(20),
+				BudgetInterval: toDuration("10s"),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("2h"),
+				}),
+			},
+			wantErrors: []string{"interval can not be greater than one hour"},
+		},
+		{
+			name: "valid BackendTrafficPolicyConfig no cookie lifetimeType",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName:     ptrTo("foo"),
+				AbsoluteTimeout: toDuration("1h"),
+				Type:            ptrTo(gatewayv1.CookieBasedSessionPersistence),
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent:  ptrTo(20),
+				BudgetInterval: toDuration("10s"),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("1s"),
+				}),
+			},
+			wantErrors: []string{},
+		},
+		{
+			name: "valid BackendTrafficPolicyConfig session cookie",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName: ptrTo("foo"),
+				Type:        ptrTo(gatewayv1.CookieBasedSessionPersistence),
+				CookieConfig: &gatewayv1.CookieConfig{
+					LifetimeType: ptrTo(gatewayv1.SessionCookieLifetimeType),
+				},
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent:  ptrTo(20),
+				BudgetInterval: toDuration("10s"),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("1s"),
+				}),
+			},
+			wantErrors: []string{},
+		},
+		{
+			name: "invalid BackendTrafficPolicyConfig permanent cookie",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName: ptrTo("foo"),
+				Type:        ptrTo(gatewayv1.CookieBasedSessionPersistence),
+				CookieConfig: &gatewayv1.CookieConfig{
+					LifetimeType: ptrTo(gatewayv1.PermanentCookieLifetimeType),
+				},
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent:  ptrTo(20),
+				BudgetInterval: toDuration("10s"),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("1s"),
+				}),
+			},
+			wantErrors: []string{"AbsoluteTimeout must be specified when cookie lifetimeType is Permanent"},
+		},
+		{
+			name: "valid BackendTrafficPolicyConfig permanent cookie",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName:     ptrTo("foo"),
+				AbsoluteTimeout: toDuration("1h"),
+				Type:            ptrTo(gatewayv1.CookieBasedSessionPersistence),
+				CookieConfig: &gatewayv1.CookieConfig{
+					LifetimeType: ptrTo(gatewayv1.PermanentCookieLifetimeType),
+				},
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent:  ptrTo(20),
+				BudgetInterval: toDuration("10s"),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("1s"),
+				}),
+			},
+			wantErrors: []string{},
+		},
+		{
+			name: "valid BackendTrafficPolicyConfig header-based session persistence",
+			sessionPersistence: gatewayv1a2.SessionPersistence{
+				SessionName: ptrTo("foo"),
+				Type:        ptrTo(gatewayv1.HeaderBasedSessionPersistence),
+			},
+			retryConstraint: gatewayv1a2.RetryConstraint{
+				BudgetPercent:  ptrTo(20),
+				BudgetInterval: toDuration("10s"),
+				MinRetryRate: ptrTo(gatewayv1a2.RequestRate{
+					Count:    ptrTo(10),
+					Interval: toDuration("1s"),
+				}),
+			},
+			wantErrors: []string{},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			trafficPolicy := &gatewayv1a2.BackendTrafficPolicy{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      fmt.Sprintf("foo-%v", time.Now().UnixNano()),
+					Namespace: metav1.NamespaceDefault,
+				},
+				Spec: gatewayv1a2.BackendTrafficPolicySpec{
+					TargetRefs: []gatewayv1a2.LocalPolicyTargetReference{{
+						Group: "group",
+						Kind:  "kind",
+						Name:  "name",
+					}},
+					RetryConstraint:    &tc.retryConstraint,
+					SessionPersistence: &tc.sessionPersistence,
+				},
+			}
+			validateBackendTrafficPolicy(t, trafficPolicy, tc.wantErrors)
+		})
+	}
+}
+
+func validateBackendTrafficPolicy(t *testing.T, trafficPolicy *gatewayv1a2.BackendTrafficPolicy, wantErrors []string) {
+	t.Helper()
+
+	ctx := context.Background()
+	err := k8sClient.Create(ctx, trafficPolicy)
+
+	if (len(wantErrors) != 0) != (err != nil) {
+		t.Fatalf("Unexpected response while creating BackendTrafficPolicy %q; got err=\n%v\n;want error=%v", fmt.Sprintf("%v/%v", trafficPolicy.Namespace, trafficPolicy.Name), err, wantErrors)
+	}
+
+	var missingErrorStrings []string
+	for _, wantError := range wantErrors {
+		if !celErrorStringMatches(err.Error(), wantError) {
+			missingErrorStrings = append(missingErrorStrings, wantError)
+		}
+	}
+	if len(missingErrorStrings) != 0 {
+		t.Errorf("Unexpected response while creating BackendTrafficPolicy %q; got err=\n%v\n;missing strings within error=%q", fmt.Sprintf("%v/%v", trafficPolicy.Namespace, trafficPolicy.Name), err, missingErrorStrings)
+	}
+}
diff --git a/pkg/test/cel/grpcroute_experimental_test.go b/pkg/test/cel/grpcroute_experimental_test.go
index 781a1947..4897e5c1 100644
--- a/pkg/test/cel/grpcroute_experimental_test.go
+++ b/pkg/test/cel/grpcroute_experimental_test.go
@@ -55,7 +55,7 @@ func TestGRPCRequestMirrorFilterExperimental(t *testing.T) {
 		rules      []gatewayv1.GRPCRouteRule
 	}{
 		{
-			name: "GRPCRoute - Invalid because both percent and fraction are specified",
+			name:       "GRPCRoute - Invalid because both percent and fraction are specified",
 			wantErrors: []string{"Only one of percent or fraction may be specified in HTTPRequestMirrorFilter"},
 			rules: []gatewayv1.GRPCRouteRule{{
 				Filters: []gatewayv1.GRPCRouteFilter{{
@@ -67,7 +67,7 @@ func TestGRPCRequestMirrorFilterExperimental(t *testing.T) {
 						},
 						Percent: &percent,
 						Fraction: &gatewayv1.Fraction{
-							Numerator: 83,
+							Numerator:   83,
 							Denominator: &denominator,
 						},
 					},
@@ -75,7 +75,7 @@ func TestGRPCRequestMirrorFilterExperimental(t *testing.T) {
 			}},
 		},
 		{
-			name: "GRPCRoute - Invalid fraction - numerator greater than denominator",
+			name:       "GRPCRoute - Invalid fraction - numerator greater than denominator",
 			wantErrors: []string{"numerator must be less than or equal to denominator"},
 			rules: []gatewayv1.GRPCRouteRule{{
 				Filters: []gatewayv1.GRPCRouteFilter{{
@@ -86,7 +86,7 @@ func TestGRPCRequestMirrorFilterExperimental(t *testing.T) {
 							Port: ptrTo(gatewayv1.PortNumber(8081)),
 						},
 						Fraction: &gatewayv1.Fraction{
-							Numerator: 1001,
+							Numerator:   1001,
 							Denominator: &denominator,
 						},
 					},
@@ -94,7 +94,7 @@ func TestGRPCRequestMirrorFilterExperimental(t *testing.T) {
 			}},
 		},
 		{
-			name: "GRPCRoute - Invalid fraction - denominator is 0",
+			name:       "GRPCRoute - Invalid fraction - denominator is 0",
 			wantErrors: []string{"spec.rules[0].filters[0].requestMirror.fraction.denominator in body should be greater than or equal to 1"},
 			rules: []gatewayv1.GRPCRouteRule{{
 				Filters: []gatewayv1.GRPCRouteFilter{{
@@ -105,7 +105,7 @@ func TestGRPCRequestMirrorFilterExperimental(t *testing.T) {
 							Port: ptrTo(gatewayv1.PortNumber(8081)),
 						},
 						Fraction: &gatewayv1.Fraction{
-							Numerator: 0,
+							Numerator:   0,
 							Denominator: &bad_denominator,
 						},
 					},
@@ -113,7 +113,7 @@ func TestGRPCRequestMirrorFilterExperimental(t *testing.T) {
 			}},
 		},
 		{
-			name: "GRPCRoute - Invalid fraction - numerator is negative",
+			name:       "GRPCRoute - Invalid fraction - numerator is negative",
 			wantErrors: []string{"spec.rules[0].filters[0].requestMirror.fraction.numerator in body should be greater than or equal to 0"},
 			rules: []gatewayv1.GRPCRouteRule{{
 				Filters: []gatewayv1.GRPCRouteFilter{{
@@ -124,7 +124,7 @@ func TestGRPCRequestMirrorFilterExperimental(t *testing.T) {
 							Port: ptrTo(gatewayv1.PortNumber(8081)),
 						},
 						Fraction: &gatewayv1.Fraction{
-							Numerator: -1,
+							Numerator:   -1,
 							Denominator: &denominator,
 						},
 					},
@@ -157,7 +157,7 @@ func TestGRPCRequestMirrorFilterExperimental(t *testing.T) {
 							Port: ptrTo(gatewayv1.PortNumber(8081)),
 						},
 						Fraction: &gatewayv1.Fraction{
-							Numerator: 83,
+							Numerator:   83,
 							Denominator: &denominator,
 						},
 					},
diff --git a/pkg/test/cel/grpcroute_test.go b/pkg/test/cel/grpcroute_test.go
index 366e91c1..628de66a 100644
--- a/pkg/test/cel/grpcroute_test.go
+++ b/pkg/test/cel/grpcroute_test.go
@@ -282,7 +282,67 @@ func TestGRPCRouteRule(t *testing.T) {
 				},
 			},
 		},
-	}
+		{
+			name:       "too many matches and rules",
+			wantErrors: []string{"total number of matches across all rules in a route must be less than 128"},
+			rules: func() []gatewayv1.GRPCRouteRule {
+				match := gatewayv1.GRPCRouteMatch{
+					Headers: []gatewayv1.GRPCHeaderMatch{
+						{
+							Type:  ptrTo(gatewayv1.GRPCHeaderMatchExact),
+							Name:  "version",
+							Value: "v1",
+						},
+					},
+					Method: &gatewayv1.GRPCMethodMatch{
+						Type:    ptrTo(gatewayv1.GRPCMethodMatchExact),
+						Service: ptrTo("foo"),
+						Method:  ptrTo("bar"),
+					},
+				}
+
+				var rules []gatewayv1.GRPCRouteRule
+				for i := 0; i < 7; i++ { // Create 7 rules
+					rule := gatewayv1.GRPCRouteRule{}
+					for j := 0; j < 20; j++ { // Each rule has 20 matches
+						rule.Matches = append(rule.Matches, match)
+					}
+					rules = append(rules, rule)
+				}
+				return rules
+			}(),
+		},
+		{
+			name:       "many matches and few rules",
+			wantErrors: nil,
+			rules: func() []gatewayv1.GRPCRouteRule {
+				match := gatewayv1.GRPCRouteMatch{
+					Headers: []gatewayv1.GRPCHeaderMatch{
+						{
+							Type:  ptrTo(gatewayv1.GRPCHeaderMatchExact),
+							Name:  "version",
+							Value: "v1",
+						},
+					},
+					Method: &gatewayv1.GRPCMethodMatch{
+						Type:    ptrTo(gatewayv1.GRPCMethodMatchExact),
+						Service: ptrTo("foo"),
+						Method:  ptrTo("bar"),
+					},
+				}
+
+				var rules []gatewayv1.GRPCRouteRule
+				for i := 0; i < 2; i++ { // Create 2 rules
+					rule := gatewayv1.GRPCRouteRule{}
+					for j := 0; j < 48; j++ { // Each rule has 48 matches
+						rule.Matches = append(rule.Matches, match)
+					}
+					rules = append(rules, rule)
+				}
+				return rules
+			}(),
+		}}
+
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			route := &gatewayv1.GRPCRoute{
diff --git a/pkg/test/cel/httproute_experimental_test.go b/pkg/test/cel/httproute_experimental_test.go
index a141899e..f6ff0d45 100644
--- a/pkg/test/cel/httproute_experimental_test.go
+++ b/pkg/test/cel/httproute_experimental_test.go
@@ -444,7 +444,7 @@ func TestHTTPRequestMirrorFilterExperimental(t *testing.T) {
 		rules      []gatewayv1.HTTPRouteRule
 	}{
 		{
-			name: "HTTPRoute - Invalid because both percent and fraction are specified",
+			name:       "HTTPRoute - Invalid because both percent and fraction are specified",
 			wantErrors: []string{"Only one of percent or fraction may be specified in HTTPRequestMirrorFilter"},
 			rules: []gatewayv1.HTTPRouteRule{{
 				Filters: []gatewayv1.HTTPRouteFilter{{
@@ -456,7 +456,7 @@ func TestHTTPRequestMirrorFilterExperimental(t *testing.T) {
 						},
 						Percent: &percent,
 						Fraction: &gatewayv1.Fraction{
-							Numerator: 83,
+							Numerator:   83,
 							Denominator: &denominator,
 						},
 					},
@@ -464,7 +464,7 @@ func TestHTTPRequestMirrorFilterExperimental(t *testing.T) {
 			}},
 		},
 		{
-			name: "HTTPRoute - Invalid fraction - numerator greater than denominator",
+			name:       "HTTPRoute - Invalid fraction - numerator greater than denominator",
 			wantErrors: []string{"numerator must be less than or equal to denominator"},
 			rules: []gatewayv1.HTTPRouteRule{{
 				Filters: []gatewayv1.HTTPRouteFilter{{
@@ -475,7 +475,7 @@ func TestHTTPRequestMirrorFilterExperimental(t *testing.T) {
 							Port: ptrTo(gatewayv1.PortNumber(8081)),
 						},
 						Fraction: &gatewayv1.Fraction{
-							Numerator: 1001,
+							Numerator:   1001,
 							Denominator: &denominator,
 						},
 					},
@@ -483,7 +483,7 @@ func TestHTTPRequestMirrorFilterExperimental(t *testing.T) {
 			}},
 		},
 		{
-			name: "HTTPRoute - Invalid fraction - denominator is 0",
+			name:       "HTTPRoute - Invalid fraction - denominator is 0",
 			wantErrors: []string{"spec.rules[0].filters[0].requestMirror.fraction.denominator in body should be greater than or equal to 1"},
 			rules: []gatewayv1.HTTPRouteRule{{
 				Filters: []gatewayv1.HTTPRouteFilter{{
@@ -494,7 +494,7 @@ func TestHTTPRequestMirrorFilterExperimental(t *testing.T) {
 							Port: ptrTo(gatewayv1.PortNumber(8081)),
 						},
 						Fraction: &gatewayv1.Fraction{
-							Numerator: 0,
+							Numerator:   0,
 							Denominator: &bad_denominator,
 						},
 					},
@@ -502,7 +502,7 @@ func TestHTTPRequestMirrorFilterExperimental(t *testing.T) {
 			}},
 		},
 		{
-			name: "HTTPRoute - Invalid fraction - numerator is negative",
+			name:       "HTTPRoute - Invalid fraction - numerator is negative",
 			wantErrors: []string{"spec.rules[0].filters[0].requestMirror.fraction.numerator in body should be greater than or equal to 0"},
 			rules: []gatewayv1.HTTPRouteRule{{
 				Filters: []gatewayv1.HTTPRouteFilter{{
@@ -513,7 +513,7 @@ func TestHTTPRequestMirrorFilterExperimental(t *testing.T) {
 							Port: ptrTo(gatewayv1.PortNumber(8081)),
 						},
 						Fraction: &gatewayv1.Fraction{
-							Numerator: -1,
+							Numerator:   -1,
 							Denominator: &denominator,
 						},
 					},
@@ -546,7 +546,7 @@ func TestHTTPRequestMirrorFilterExperimental(t *testing.T) {
 							Port: ptrTo(gatewayv1.PortNumber(8081)),
 						},
 						Fraction: &gatewayv1.Fraction{
-							Numerator: 83,
+							Numerator:   83,
 							Denominator: &denominator,
 						},
 					},
diff --git a/pkg/test/cel/main_test.go b/pkg/test/cel/main_test.go
index 96502432..3ba7de1d 100644
--- a/pkg/test/cel/main_test.go
+++ b/pkg/test/cel/main_test.go
@@ -27,6 +27,7 @@ import (
 	"sigs.k8s.io/gateway-api/apis/v1alpha2"
 	"sigs.k8s.io/gateway-api/apis/v1alpha3"
 	"sigs.k8s.io/gateway-api/apis/v1beta1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
 
 	"k8s.io/client-go/tools/clientcmd"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -53,6 +54,7 @@ func TestMain(m *testing.M) {
 	v1alpha2.Install(k8sClient.Scheme())
 	v1beta1.Install(k8sClient.Scheme())
 	v1.Install(k8sClient.Scheme())
+	apisxv1alpha1.Install(k8sClient.Scheme())
 
 	os.Exit(m.Run())
 }