Repository: kubernetes-sigs/gateway-api

Issue:
CORS documentation and validation are not consistent
The docs say you can have `*.com` and `*`, and the example on https://gateway-api.sigs.k8s.io/geps/gep-1767/?h=cors shows the same. The validation only allows a fully qualified name.

I think the fix is to loosen the validation

Hints from issue comments:
@howardjohn: Also its not 100% clear in the spec but I think you can only have 1 `*` and it must be the first element if so?@youngnick: In #3667, we discussed that we will loosen this, but since it needs some research, it's better to launch with a tighter validation and loosen later. So we're removing this from the v1.3.0 milestone.@howardjohn: One thing ambiguous in the current spec is if a the following are valid:
- `foo*bar.com`
- `*.foo.*.com`
- `foo.*.com`
I assume no and you can only have exactly 1 wildcard as the prefix but we should codify this and validate it@DamianSawicki: > One thing ambiguous in the current spec is if a the following are valid:
> 
> * `foo*bar.com`
> * `*.foo.*.com`
> * `foo.*.com`
>   I assume no and you can only have exactly 1 wildcard as the prefix but we should codify this and validate it

The first thing is that patterns in `allowOrigins` should normally consist of scheme, host, and port. So `*.foo.com` matches both `http://xyz.foo.com:80` and `https://abc.foo.com:443`. In the [discussion](https://github.com/kubernetes-sigs/gateway-api/pull/3435#discussion_r1877232311) on the original PR for GEP-1767, there are examples like `allowOrigins: ["https://*.foo.example", "http://*.foo.example"]`, which we probably should support and include in the documentation. CORS [allows](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin) `Access-Control-Allow-Origin: *`, so we should also support the catch-all `allowOrigins: ["*"]`.

As for `*` appearing in the middle of the host, it seems from the above-linked discussion that the intention there was to allow wildcarding subdomains rather than to support some fancy regexes, so I think we should not require supporting patterns as above (should we explicitly forbid them in validation?).

GEP-1767 says that `*` is `greedy match to the _left_`. The only search result for this phrase (without underscores) is the Gateway API [reference](https://gateway-api.sigs.k8s.io/reference/spec/), so I suppose it's not a fixed expression. Since regex is by default left-to-right (so it is in a sense "greedy from the left"), I guess that by `to the _left_` the GEP author meant that there should be only one `*` and it should be the leftmost part of the pattern (or at least of the host part of the pattern). Could you please comment on that @arkodg ?


@youngnick: In general, that idea - that a `*` must be the leftmost character - is pretty much a base assumption in the API on basically all uses of wildcards. In `hostname`, for example, a `*` must be the first DNS label (an alphanumeric string separated by `.`), and can only replace a _single_ label. (So, `*.example.com` only replaces `foo.example.com`, not `bar.baz.example.com`).

I think your reading in the last paragraph matches what I remember of these conversations. _But_, given that I don't do CORS much, it's probably more important that this wildcard behaves in the way that _CORS users_ would expect, so I'd be in favor of doing whatever maximizes that.@DamianSawicki: > _But_, given that I don't do CORS much, it's probably more important that this wildcard behaves in the way that _CORS users_ would expect, so I'd be in favor of doing whatever maximizes that.

According to both the [specification](https://fetch.spec.whatwg.org/#http-responses) and Mozilla [docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin), the value of the `Access-Control-Allow-Origin` header is one of
 * a specific origin (schema+host(+port)),
 * the catch-all wildcard `*`,
 * null ([discouraged](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin#directives)).

This means that if `allowOrigins` in HTTPCORSFilter does not contain `"*"`, but something like `"https://*.foo.example"`, it will always end up in the `Access-Control-Allow-Origin` header as a specific origin (namely the one from the `Origin` header of the HTTP request). So these patterns with wildcards longer than `"*"` are only relevant to implementations, not to clients.

Speaking about implementations, in Envoy the CORS [configuration](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/cors/v3/cors.proto#envoy-v3-api-msg-extensions-filters-http-cors-v3-corspolicy) enables multiple origin matching [options](https://www.envoyproxy.io/docs/envoy/latest/api-v3/type/matcher/v3/string.proto#envoy-v3-api-msg-type-matcher-v3-stringmatcher) (e.g. `prefix`, `suffix`, `contains`, and even `custom` or [`safe_regex`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/type/matcher/v3/regex.proto#envoy-v3-api-msg-type-matcher-v3-regexmatcher) via Google RE2). The pattern `"https://*.foo.example"` has wildcard in the middle, but the matching options are mutually exclusive, so one cannot specify `prefix` and `suffix` simultaneously. However, such a pattern should be easily expressible with `safe_regex`.

Solution patch:
diff --git a/apis/v1/gateway_types.go b/apis/v1/gateway_types.go
index e85e81ba..652101ff 100644
--- a/apis/v1/gateway_types.go
+++ b/apis/v1/gateway_types.go
@@ -279,15 +279,6 @@ type GatewaySpec struct {
 	// +optional
 	Infrastructure *GatewayInfrastructure `json:"infrastructure,omitempty"`
 
-	// BackendTLS configures TLS settings for when this Gateway is connecting to
-	// backends with TLS.
-	//
-	// Support: Core
-	//
-	// +optional
-	// <gateway:experimental>
-	BackendTLS *GatewayBackendTLS `json:"backendTLS,omitempty"`
-
 	// AllowedListeners defines which ListenerSets can be attached to this Gateway.
 	// While this feature is experimental, the default value is to allow no ListenerSets.
 	//
@@ -296,7 +287,7 @@ type GatewaySpec struct {
 	// +optional
 	AllowedListeners *AllowedListeners `json:"allowedListeners,omitempty"`
 	//
-	// GatewayTLSConfig specifies frontend tls configuration for gateway.
+	// TLS specifies frontend and backend tls configuration for entire gateway.
 	//
 	// Support: Extended
 	//
@@ -525,8 +516,6 @@ type GatewayBackendTLS struct {
 	// ClientCertificateRef can reference to standard Kubernetes resources, i.e.
 	// Secret, or implementation-specific custom resources.
 	//
-	// This setting can be overridden on the service level by use of BackendTLSPolicy.
-	//
 	// Support: Core
 	//
 	// +optional
@@ -602,8 +591,31 @@ type ListenerTLSConfig struct {
 	Options map[AnnotationKey]AnnotationValue `json:"options,omitempty"`
 }
 
-// GatewayTLSConfig specifies frontend tls configuration for gateway.
+// GatewayTLSConfig specifies frontend and backend tls configuration for gateway.
 type GatewayTLSConfig struct {
+	// Backend describes TLS configuration for gateway when connecting
+	// to backends.
+	//
+	// Note that this contains only details for the Gateway as a TLS client,
+	// and does _not_ imply behavior about how to choose which backend should
+	// get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+	//
+	// Support: Core
+	//
+	// +optional
+	// <gateway:experimental>
+	Backend *GatewayBackendTLS `json:"backend,omitempty"`
+
+	// Frontend describes TLS config when client connects to Gateway.
+	// Support: Core
+	//
+	// +optional
+	// <gateway:experimental>
+	Frontend *FrontendTLSConfig `json:"frontend,omitempty"`
+}
+
+// FrontendTLSConfig specifies frontend tls configuration for gateway.
+type FrontendTLSConfig struct {
 	// Default specifies the default client certificate validation configuration
 	// for all Listeners handling HTTPS traffic, unless a per-port configuration
 	// is defined.
@@ -653,7 +665,7 @@ const (
 // within this Gateway. Currently, it stores only the client certificate validation
 // configuration, but this may be extended in the future.
 type TLSConfig struct {
-	// FrontendValidation holds configuration information for validating the frontend (client).
+	// Validation holds configuration information for validating the frontend (client).
 	// Setting this field will result in mutual authentication when connecting to the gateway.
 	// In browsers this may result in a dialog appearing
 	// that requests a user to specify the client certificate.
@@ -661,9 +673,9 @@ type TLSConfig struct {
 	//
 	// Support: Core
 	//
-	// +required
+	// +optional
 	// <gateway:experimental>
-	FrontendValidation FrontendTLSValidation `json:"frontendValidation"`
+	Validation *FrontendTLSValidation `json:"validation,omitempty"`
 }
 
 type TLSPortConfig struct {
diff --git a/apis/v1/httproute_types.go b/apis/v1/httproute_types.go
index 53fae567..5dad01e0 100644
--- a/apis/v1/httproute_types.go
+++ b/apis/v1/httproute_types.go
@@ -1404,8 +1404,9 @@ type HTTPCORSFilter struct {
 	// Support: Extended
 	// +listType=set
 	// +kubebuilder:validation:MaxItems=64
+	// +kubebuilder:validation:XValidation:message="AllowOrigins cannot contain '*' alongside other origins",rule="!('*' in self && self.size() > 1)"
 	// +optional
-	AllowOrigins []AbsoluteURI `json:"allowOrigins,omitempty"`
+	AllowOrigins []CORSOrigin `json:"allowOrigins,omitempty"`
 
 	// AllowCredentials indicates whether the actual cross-origin request allows
 	// to include credentials.
diff --git a/apis/v1/shared_types.go b/apis/v1/shared_types.go
index 5b5ed4cf..99299acd 100644
--- a/apis/v1/shared_types.go
+++ b/apis/v1/shared_types.go
@@ -608,6 +608,17 @@ type PreciseHostname string
 // +kubebuilder:validation:Pattern=`^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?`
 type AbsoluteURI string
 
+// The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+// encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+// scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+// URIs that include an authority MUST include a fully qualified domain name or
+// IP address as the host.
+// <gateway:util:excludeFromCRD> The below regex was generated to simplify the assertion of scheme://host:<port> being port optional </gateway:util:excludeFromCRD>
+// +kubebuilder:validation:MinLength=1
+// +kubebuilder:validation:MaxLength=253
+// +kubebuilder:validation:Pattern=`(^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)`
+type CORSOrigin string
+
 // Group refers to a Kubernetes Group. It must either be an empty string or a
 // RFC 1123 subdomain.
 //
diff --git a/apis/v1/zz_generated.deepcopy.go b/apis/v1/zz_generated.deepcopy.go
index 6bbf75ba..be8e2485 100644
--- a/apis/v1/zz_generated.deepcopy.go
+++ b/apis/v1/zz_generated.deepcopy.go
@@ -205,6 +205,29 @@ func (in *Fraction) DeepCopy() *Fraction {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FrontendTLSConfig) DeepCopyInto(out *FrontendTLSConfig) {
+	*out = *in
+	in.Default.DeepCopyInto(&out.Default)
+	if in.PerPort != nil {
+		in, out := &in.PerPort, &out.PerPort
+		*out = make([]TLSPortConfig, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FrontendTLSConfig.
+func (in *FrontendTLSConfig) DeepCopy() *FrontendTLSConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(FrontendTLSConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *FrontendTLSValidation) DeepCopyInto(out *FrontendTLSValidation) {
 	*out = *in
@@ -777,11 +800,6 @@ func (in *GatewaySpec) DeepCopyInto(out *GatewaySpec) {
 		*out = new(GatewayInfrastructure)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.BackendTLS != nil {
-		in, out := &in.BackendTLS, &out.BackendTLS
-		*out = new(GatewayBackendTLS)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.AllowedListeners != nil {
 		in, out := &in.AllowedListeners, &out.AllowedListeners
 		*out = new(AllowedListeners)
@@ -883,13 +901,15 @@ func (in *GatewayStatusAddress) DeepCopy() *GatewayStatusAddress {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GatewayTLSConfig) DeepCopyInto(out *GatewayTLSConfig) {
 	*out = *in
-	in.Default.DeepCopyInto(&out.Default)
-	if in.PerPort != nil {
-		in, out := &in.PerPort, &out.PerPort
-		*out = make([]TLSPortConfig, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
+	if in.Backend != nil {
+		in, out := &in.Backend, &out.Backend
+		*out = new(GatewayBackendTLS)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Frontend != nil {
+		in, out := &in.Frontend, &out.Frontend
+		*out = new(FrontendTLSConfig)
+		(*in).DeepCopyInto(*out)
 	}
 }
 
@@ -956,7 +976,7 @@ func (in *HTTPCORSFilter) DeepCopyInto(out *HTTPCORSFilter) {
 	*out = *in
 	if in.AllowOrigins != nil {
 		in, out := &in.AllowOrigins, &out.AllowOrigins
-		*out = make([]AbsoluteURI, len(*in))
+		*out = make([]CORSOrigin, len(*in))
 		copy(*out, *in)
 	}
 	if in.AllowCredentials != nil {
@@ -1962,7 +1982,11 @@ func (in *SupportedFeature) DeepCopy() *SupportedFeature {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TLSConfig) DeepCopyInto(out *TLSConfig) {
 	*out = *in
-	in.FrontendValidation.DeepCopyInto(&out.FrontendValidation)
+	if in.Validation != nil {
+		in, out := &in.Validation, &out.Validation
+		*out = new(FrontendTLSValidation)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
diff --git a/applyconfiguration/apis/v1/frontendtlsconfig.go b/applyconfiguration/apis/v1/frontendtlsconfig.go
new file mode 100644
index 00000000..4cf84649
--- /dev/null
+++ b/applyconfiguration/apis/v1/frontendtlsconfig.go
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// FrontendTLSConfigApplyConfiguration represents a declarative configuration of the FrontendTLSConfig type for use
+// with apply.
+type FrontendTLSConfigApplyConfiguration struct {
+	Default *TLSConfigApplyConfiguration      `json:"default,omitempty"`
+	PerPort []TLSPortConfigApplyConfiguration `json:"perPort,omitempty"`
+}
+
+// FrontendTLSConfigApplyConfiguration constructs a declarative configuration of the FrontendTLSConfig type for use with
+// apply.
+func FrontendTLSConfig() *FrontendTLSConfigApplyConfiguration {
+	return &FrontendTLSConfigApplyConfiguration{}
+}
+
+// WithDefault sets the Default field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Default field is set to the value of the last call.
+func (b *FrontendTLSConfigApplyConfiguration) WithDefault(value *TLSConfigApplyConfiguration) *FrontendTLSConfigApplyConfiguration {
+	b.Default = value
+	return b
+}
+
+// WithPerPort adds the given value to the PerPort field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the PerPort field.
+func (b *FrontendTLSConfigApplyConfiguration) WithPerPort(values ...*TLSPortConfigApplyConfiguration) *FrontendTLSConfigApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithPerPort")
+		}
+		b.PerPort = append(b.PerPort, *values[i])
+	}
+	return b
+}
diff --git a/applyconfiguration/apis/v1/gatewayspec.go b/applyconfiguration/apis/v1/gatewayspec.go
index b123a40f..e976dc48 100644
--- a/applyconfiguration/apis/v1/gatewayspec.go
+++ b/applyconfiguration/apis/v1/gatewayspec.go
@@ -29,7 +29,6 @@ type GatewaySpecApplyConfiguration struct {
 	Listeners        []ListenerApplyConfiguration             `json:"listeners,omitempty"`
 	Addresses        []GatewaySpecAddressApplyConfiguration   `json:"addresses,omitempty"`
 	Infrastructure   *GatewayInfrastructureApplyConfiguration `json:"infrastructure,omitempty"`
-	BackendTLS       *GatewayBackendTLSApplyConfiguration     `json:"backendTLS,omitempty"`
 	AllowedListeners *AllowedListenersApplyConfiguration      `json:"allowedListeners,omitempty"`
 	TLS              *GatewayTLSConfigApplyConfiguration      `json:"tls,omitempty"`
 }
@@ -82,14 +81,6 @@ func (b *GatewaySpecApplyConfiguration) WithInfrastructure(value *GatewayInfrast
 	return b
 }
 
-// WithBackendTLS sets the BackendTLS field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the BackendTLS field is set to the value of the last call.
-func (b *GatewaySpecApplyConfiguration) WithBackendTLS(value *GatewayBackendTLSApplyConfiguration) *GatewaySpecApplyConfiguration {
-	b.BackendTLS = value
-	return b
-}
-
 // WithAllowedListeners sets the AllowedListeners field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the AllowedListeners field is set to the value of the last call.
diff --git a/applyconfiguration/apis/v1/gatewaytlsconfig.go b/applyconfiguration/apis/v1/gatewaytlsconfig.go
index dbd3f443..4ec825db 100644
--- a/applyconfiguration/apis/v1/gatewaytlsconfig.go
+++ b/applyconfiguration/apis/v1/gatewaytlsconfig.go
@@ -21,8 +21,8 @@ package v1
 // GatewayTLSConfigApplyConfiguration represents a declarative configuration of the GatewayTLSConfig type for use
 // with apply.
 type GatewayTLSConfigApplyConfiguration struct {
-	Default *TLSConfigApplyConfiguration      `json:"default,omitempty"`
-	PerPort []TLSPortConfigApplyConfiguration `json:"perPort,omitempty"`
+	Backend  *GatewayBackendTLSApplyConfiguration `json:"backend,omitempty"`
+	Frontend *FrontendTLSConfigApplyConfiguration `json:"frontend,omitempty"`
 }
 
 // GatewayTLSConfigApplyConfiguration constructs a declarative configuration of the GatewayTLSConfig type for use with
@@ -31,23 +31,18 @@ func GatewayTLSConfig() *GatewayTLSConfigApplyConfiguration {
 	return &GatewayTLSConfigApplyConfiguration{}
 }
 
-// WithDefault sets the Default field in the declarative configuration to the given value
+// WithBackend sets the Backend field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the Default field is set to the value of the last call.
-func (b *GatewayTLSConfigApplyConfiguration) WithDefault(value *TLSConfigApplyConfiguration) *GatewayTLSConfigApplyConfiguration {
-	b.Default = value
+// If called multiple times, the Backend field is set to the value of the last call.
+func (b *GatewayTLSConfigApplyConfiguration) WithBackend(value *GatewayBackendTLSApplyConfiguration) *GatewayTLSConfigApplyConfiguration {
+	b.Backend = value
 	return b
 }
 
-// WithPerPort adds the given value to the PerPort field in the declarative configuration
-// and returns the receiver, so that objects can be build by chaining "With" function invocations.
-// If called multiple times, values provided by each call will be appended to the PerPort field.
-func (b *GatewayTLSConfigApplyConfiguration) WithPerPort(values ...*TLSPortConfigApplyConfiguration) *GatewayTLSConfigApplyConfiguration {
-	for i := range values {
-		if values[i] == nil {
-			panic("nil value passed to WithPerPort")
-		}
-		b.PerPort = append(b.PerPort, *values[i])
-	}
+// WithFrontend sets the Frontend field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Frontend field is set to the value of the last call.
+func (b *GatewayTLSConfigApplyConfiguration) WithFrontend(value *FrontendTLSConfigApplyConfiguration) *GatewayTLSConfigApplyConfiguration {
+	b.Frontend = value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/httpcorsfilter.go b/applyconfiguration/apis/v1/httpcorsfilter.go
index cc556b3e..b4b9776b 100644
--- a/applyconfiguration/apis/v1/httpcorsfilter.go
+++ b/applyconfiguration/apis/v1/httpcorsfilter.go
@@ -25,7 +25,7 @@ import (
 // HTTPCORSFilterApplyConfiguration represents a declarative configuration of the HTTPCORSFilter type for use
 // with apply.
 type HTTPCORSFilterApplyConfiguration struct {
-	AllowOrigins     []apisv1.AbsoluteURI            `json:"allowOrigins,omitempty"`
+	AllowOrigins     []apisv1.CORSOrigin             `json:"allowOrigins,omitempty"`
 	AllowCredentials *bool                           `json:"allowCredentials,omitempty"`
 	AllowMethods     []apisv1.HTTPMethodWithWildcard `json:"allowMethods,omitempty"`
 	AllowHeaders     []apisv1.HTTPHeaderName         `json:"allowHeaders,omitempty"`
@@ -42,7 +42,7 @@ func HTTPCORSFilter() *HTTPCORSFilterApplyConfiguration {
 // WithAllowOrigins adds the given value to the AllowOrigins field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the AllowOrigins field.
-func (b *HTTPCORSFilterApplyConfiguration) WithAllowOrigins(values ...apisv1.AbsoluteURI) *HTTPCORSFilterApplyConfiguration {
+func (b *HTTPCORSFilterApplyConfiguration) WithAllowOrigins(values ...apisv1.CORSOrigin) *HTTPCORSFilterApplyConfiguration {
 	for i := range values {
 		b.AllowOrigins = append(b.AllowOrigins, values[i])
 	}
diff --git a/applyconfiguration/apis/v1/tlsconfig.go b/applyconfiguration/apis/v1/tlsconfig.go
index 1dfa5e02..99a42ca4 100644
--- a/applyconfiguration/apis/v1/tlsconfig.go
+++ b/applyconfiguration/apis/v1/tlsconfig.go
@@ -21,7 +21,7 @@ package v1
 // TLSConfigApplyConfiguration represents a declarative configuration of the TLSConfig type for use
 // with apply.
 type TLSConfigApplyConfiguration struct {
-	FrontendValidation *FrontendTLSValidationApplyConfiguration `json:"frontendValidation,omitempty"`
+	Validation *FrontendTLSValidationApplyConfiguration `json:"validation,omitempty"`
 }
 
 // TLSConfigApplyConfiguration constructs a declarative configuration of the TLSConfig type for use with
@@ -30,10 +30,10 @@ func TLSConfig() *TLSConfigApplyConfiguration {
 	return &TLSConfigApplyConfiguration{}
 }
 
-// WithFrontendValidation sets the FrontendValidation field in the declarative configuration to the given value
+// WithValidation sets the Validation field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the FrontendValidation field is set to the value of the last call.
-func (b *TLSConfigApplyConfiguration) WithFrontendValidation(value *FrontendTLSValidationApplyConfiguration) *TLSConfigApplyConfiguration {
-	b.FrontendValidation = value
+// If called multiple times, the Validation field is set to the value of the last call.
+func (b *TLSConfigApplyConfiguration) WithValidation(value *FrontendTLSValidationApplyConfiguration) *TLSConfigApplyConfiguration {
+	b.Validation = value
 	return b
 }
diff --git a/applyconfiguration/internal/internal.go b/applyconfiguration/internal/internal.go
index 953f2863..974c4bd2 100644
--- a/applyconfiguration/internal/internal.go
+++ b/applyconfiguration/internal/internal.go
@@ -304,6 +304,21 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: numeric
       default: 0
+- name: io.k8s.sigs.gateway-api.apis.v1.FrontendTLSConfig
+  map:
+    fields:
+    - name: default
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.TLSConfig
+      default: {}
+    - name: perPort
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apis.v1.TLSPortConfig
+          elementRelationship: associative
+          keys:
+          - port
 - name: io.k8s.sigs.gateway-api.apis.v1.FrontendTLSValidation
   map:
     fields:
@@ -598,9 +613,6 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: allowedListeners
       type:
         namedType: io.k8s.sigs.gateway-api.apis.v1.AllowedListeners
-    - name: backendTLS
-      type:
-        namedType: io.k8s.sigs.gateway-api.apis.v1.GatewayBackendTLS
     - name: gatewayClassName
       type:
         scalar: string
@@ -666,18 +678,12 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.sigs.gateway-api.apis.v1.GatewayTLSConfig
   map:
     fields:
-    - name: default
+    - name: backend
       type:
-        namedType: io.k8s.sigs.gateway-api.apis.v1.TLSConfig
-      default: {}
-    - name: perPort
+        namedType: io.k8s.sigs.gateway-api.apis.v1.GatewayBackendTLS
+    - name: frontend
       type:
-        list:
-          elementType:
-            namedType: io.k8s.sigs.gateway-api.apis.v1.TLSPortConfig
-          elementRelationship: associative
-          keys:
-          - port
+        namedType: io.k8s.sigs.gateway-api.apis.v1.FrontendTLSConfig
 - name: io.k8s.sigs.gateway-api.apis.v1.HTTPAuthConfig
   map:
     fields:
@@ -1311,10 +1317,9 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.sigs.gateway-api.apis.v1.TLSConfig
   map:
     fields:
-    - name: frontendValidation
+    - name: validation
       type:
         namedType: io.k8s.sigs.gateway-api.apis.v1.FrontendTLSValidation
-      default: {}
 - name: io.k8s.sigs.gateway-api.apis.v1.TLSPortConfig
   map:
     fields:
diff --git a/applyconfiguration/utils.go b/applyconfiguration/utils.go
index 5acafbc2..274736cd 100644
--- a/applyconfiguration/utils.go
+++ b/applyconfiguration/utils.go
@@ -56,6 +56,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apisv1.ForwardBodyConfigApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("Fraction"):
 		return &apisv1.FractionApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("FrontendTLSConfig"):
+		return &apisv1.FrontendTLSConfigApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("FrontendTLSValidation"):
 		return &apisv1.FrontendTLSValidationApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("Gateway"):
diff --git a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
index f04f7b97..6e154e95 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
@@ -215,70 +215,6 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                 type: object
-              backendTLS:
-                description: |-
-                  BackendTLS configures TLS settings for when this Gateway is connecting to
-                  backends with TLS.
-
-                  Support: Core
-                properties:
-                  clientCertificateRef:
-                    description: |-
-                      ClientCertificateRef is a reference to an object that contains a Client
-                      Certificate and the associated private key.
-
-                      References to a resource in different namespace are invalid UNLESS there
-                      is a ReferenceGrant in the target namespace that allows the certificate
-                      to be attached. If a ReferenceGrant does not allow this reference, the
-                      "ResolvedRefs" condition MUST be set to False for this listener with the
-                      "RefNotPermitted" reason.
-
-                      ClientCertificateRef can reference to standard Kubernetes resources, i.e.
-                      Secret, or implementation-specific custom resources.
-
-                      This setting can be overridden on the service level by use of BackendTLSPolicy.
-
-                      Support: Core
-                    properties:
-                      group:
-                        default: ""
-                        description: |-
-                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                          When unspecified or empty string, core API group is inferred.
-                        maxLength: 253
-                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                        type: string
-                      kind:
-                        default: Secret
-                        description: Kind is kind of the referent. For example "Secret".
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                        type: string
-                      name:
-                        description: Name is the name of the referent.
-                        maxLength: 253
-                        minLength: 1
-                        type: string
-                      namespace:
-                        description: |-
-                          Namespace is the namespace of the referenced object. When unspecified, the local
-                          namespace is inferred.
-
-                          Note that when a namespace different than the local namespace is specified,
-                          a ReferenceGrant object is required in the referent namespace to allow that
-                          namespace's owner to accept the reference. See the ReferenceGrant
-                          documentation for details.
-
-                          Support: Core
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
               gatewayClassName:
                 description: |-
                   GatewayClassName used for this Gateway. This is the name of a
@@ -970,294 +906,363 @@ spec:
                     == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
               tls:
                 description: |-
-                  GatewayTLSConfig specifies frontend tls configuration for gateway.
+                  TLS specifies frontend and backend tls configuration for entire gateway.
 
                   Support: Extended
                 properties:
-                  default:
+                  backend:
                     description: |-
-                      Default specifies the default client certificate validation configuration
-                      for all Listeners handling HTTPS traffic, unless a per-port configuration
-                      is defined.
+                      Backend describes TLS configuration for gateway when connecting
+                      to backends.
 
-                      support: Core
+                      Note that this contains only details for the Gateway as a TLS client,
+                      and does _not_ imply behavior about how to choose which backend should
+                      get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+
+                      Support: Core
                     properties:
-                      frontendValidation:
+                      clientCertificateRef:
                         description: |-
-                          FrontendValidation holds configuration information for validating the frontend (client).
-                          Setting this field will result in mutual authentication when connecting to the gateway.
-                          In browsers this may result in a dialog appearing
-                          that requests a user to specify the client certificate.
-                          The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                          ClientCertificateRef is a reference to an object that contains a Client
+                          Certificate and the associated private key.
+
+                          References to a resource in different namespace are invalid UNLESS there
+                          is a ReferenceGrant in the target namespace that allows the certificate
+                          to be attached. If a ReferenceGrant does not allow this reference, the
+                          "ResolvedRefs" condition MUST be set to False for this listener with the
+                          "RefNotPermitted" reason.
+
+                          ClientCertificateRef can reference to standard Kubernetes resources, i.e.
+                          Secret, or implementation-specific custom resources.
 
                           Support: Core
                         properties:
-                          caCertificateRefs:
+                          group:
+                            default: ""
                             description: |-
-                              CACertificateRefs contains one or more references to
-                              Kubernetes objects that contain TLS certificates of
-                              the Certificate Authorities that can be used
-                              as a trust anchor to validate the certificates presented by the client.
-
-                              A single CA certificate reference to a Kubernetes ConfigMap
-                              has "Core" support.
-                              Implementations MAY choose to support attaching multiple CA certificates to
-                              a Listener, but this behavior is implementation-specific.
-
-                              Support: Core - A single reference to a Kubernetes ConfigMap
-                              with the CA certificate in a key named `ca.crt`.
-
-                              Support: Implementation-specific (More than one certificate in a ConfigMap
-                              with different keys or more than one reference, or other kinds of resources).
-
-                              References to a resource in a different namespace are invalid UNLESS there
-                              is a ReferenceGrant in the target namespace that allows the certificate
-                              to be attached. If a ReferenceGrant does not allow this reference, the
-                              "ResolvedRefs" condition MUST be set to False for this listener with the
-                              "RefNotPermitted" reason.
-                            items:
-                              description: |-
-                                ObjectReference identifies an API object including its namespace.
-
-                                The API object must be valid in the cluster; the Group and Kind must
-                                be registered in the cluster for this reference to be valid.
-
-                                References to objects with invalid Group and Kind are not valid, and must
-                                be rejected by the implementation, with appropriate Conditions set
-                                on the containing object.
-                              properties:
-                                group:
-                                  description: |-
-                                    Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                    When set to the empty string, core API group is inferred.
-                                  maxLength: 253
-                                  pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  type: string
-                                kind:
-                                  description: Kind is kind of the referent. For example
-                                    "ConfigMap" or "Service".
-                                  maxLength: 63
-                                  minLength: 1
-                                  pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                  type: string
-                                name:
-                                  description: Name is the name of the referent.
-                                  maxLength: 253
-                                  minLength: 1
-                                  type: string
-                                namespace:
-                                  description: |-
-                                    Namespace is the namespace of the referenced object. When unspecified, the local
-                                    namespace is inferred.
-
-                                    Note that when a namespace different than the local namespace is specified,
-                                    a ReferenceGrant object is required in the referent namespace to allow that
-                                    namespace's owner to accept the reference. See the ReferenceGrant
-                                    documentation for details.
-
-                                    Support: Core
-                                  maxLength: 63
-                                  minLength: 1
-                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                  type: string
-                              required:
-                              - group
-                              - kind
-                              - name
-                              type: object
-                            maxItems: 8
-                            minItems: 1
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          mode:
-                            default: AllowValidOnly
+                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                              When unspecified or empty string, core API group is inferred.
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Secret
+                            description: Kind is kind of the referent. For example
+                              "Secret".
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: Name is the name of the referent.
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
                             description: |-
-                              FrontendValidationMode defines the mode for validating the client certificate.
-                              There are two possible modes:
-
-                              - AllowValidOnly: In this mode, the gateway will accept connections only if
-                                the client presents a valid certificate. This certificate must successfully
-                                pass validation against the CA certificates specified in `CACertificateRefs`.
-                              - AllowInsecureFallback: In this mode, the gateway will accept connections
-                                even if the client certificate is not presented or fails verification.
+                              Namespace is the namespace of the referenced object. When unspecified, the local
+                              namespace is inferred.
 
-                                This approach delegates client authorization to the backend and introduce
-                                a significant security risk. It should be used in testing environments or
-                                on a temporary basis in non-testing environments.
-
-                              Defaults to AllowValidOnly.
+                              Note that when a namespace different than the local namespace is specified,
+                              a ReferenceGrant object is required in the referent namespace to allow that
+                              namespace's owner to accept the reference. See the ReferenceGrant
+                              documentation for details.
 
                               Support: Core
-                            enum:
-                            - AllowValidOnly
-                            - AllowInsecureFallback
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                             type: string
                         required:
-                        - caCertificateRefs
+                        - name
                         type: object
-                    required:
-                    - frontendValidation
                     type: object
-                  perPort:
+                  frontend:
                     description: |-
-                      PerPort specifies tls configuration assigned per port.
-                      Per port configuration is optional. Once set this configuration overrides
-                      the default configuration for all Listeners handling HTTPS traffic
-                      that match this port.
-                      Each override port requires a unique TLS configuration.
-
-                      support: Core
-                    items:
-                      properties:
-                        port:
-                          description: |-
-                            The Port indicates the Port Number to which the TLS configuration will be
-                            applied. This configuration will be applied to all Listeners handling HTTPS
-                            traffic that match this port.
-
-                            Support: Core
-                          format: int32
-                          maximum: 65535
-                          minimum: 1
-                          type: integer
-                        tls:
-                          description: |-
-                            TLS store the configuration that will be applied to all Listeners handling
-                            HTTPS traffic and matching given port.
+                      Frontend describes TLS config when client connects to Gateway.
+                      Support: Core
+                    properties:
+                      default:
+                        description: |-
+                          Default specifies the default client certificate validation configuration
+                          for all Listeners handling HTTPS traffic, unless a per-port configuration
+                          is defined.
 
-                            Support: Core
-                          properties:
-                            frontendValidation:
-                              description: |-
-                                FrontendValidation holds configuration information for validating the frontend (client).
-                                Setting this field will result in mutual authentication when connecting to the gateway.
-                                In browsers this may result in a dialog appearing
-                                that requests a user to specify the client certificate.
-                                The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                          support: Core
+                        properties:
+                          validation:
+                            description: |-
+                              Validation holds configuration information for validating the frontend (client).
+                              Setting this field will result in mutual authentication when connecting to the gateway.
+                              In browsers this may result in a dialog appearing
+                              that requests a user to specify the client certificate.
+                              The maximum depth of a certificate chain accepted in verification is Implementation specific.
 
-                                Support: Core
-                              properties:
-                                caCertificateRefs:
+                              Support: Core
+                            properties:
+                              caCertificateRefs:
+                                description: |-
+                                  CACertificateRefs contains one or more references to
+                                  Kubernetes objects that contain TLS certificates of
+                                  the Certificate Authorities that can be used
+                                  as a trust anchor to validate the certificates presented by the client.
+
+                                  A single CA certificate reference to a Kubernetes ConfigMap
+                                  has "Core" support.
+                                  Implementations MAY choose to support attaching multiple CA certificates to
+                                  a Listener, but this behavior is implementation-specific.
+
+                                  Support: Core - A single reference to a Kubernetes ConfigMap
+                                  with the CA certificate in a key named `ca.crt`.
+
+                                  Support: Implementation-specific (More than one certificate in a ConfigMap
+                                  with different keys or more than one reference, or other kinds of resources).
+
+                                  References to a resource in a different namespace are invalid UNLESS there
+                                  is a ReferenceGrant in the target namespace that allows the certificate
+                                  to be attached. If a ReferenceGrant does not allow this reference, the
+                                  "ResolvedRefs" condition MUST be set to False for this listener with the
+                                  "RefNotPermitted" reason.
+                                items:
                                   description: |-
-                                    CACertificateRefs contains one or more references to
-                                    Kubernetes objects that contain TLS certificates of
-                                    the Certificate Authorities that can be used
-                                    as a trust anchor to validate the certificates presented by the client.
-
-                                    A single CA certificate reference to a Kubernetes ConfigMap
-                                    has "Core" support.
-                                    Implementations MAY choose to support attaching multiple CA certificates to
-                                    a Listener, but this behavior is implementation-specific.
-
-                                    Support: Core - A single reference to a Kubernetes ConfigMap
-                                    with the CA certificate in a key named `ca.crt`.
-
-                                    Support: Implementation-specific (More than one certificate in a ConfigMap
-                                    with different keys or more than one reference, or other kinds of resources).
-
-                                    References to a resource in a different namespace are invalid UNLESS there
-                                    is a ReferenceGrant in the target namespace that allows the certificate
-                                    to be attached. If a ReferenceGrant does not allow this reference, the
-                                    "ResolvedRefs" condition MUST be set to False for this listener with the
-                                    "RefNotPermitted" reason.
-                                  items:
-                                    description: |-
-                                      ObjectReference identifies an API object including its namespace.
+                                    ObjectReference identifies an API object including its namespace.
+
+                                    The API object must be valid in the cluster; the Group and Kind must
+                                    be registered in the cluster for this reference to be valid.
+
+                                    References to objects with invalid Group and Kind are not valid, and must
+                                    be rejected by the implementation, with appropriate Conditions set
+                                    on the containing object.
+                                  properties:
+                                    group:
+                                      description: |-
+                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                        When set to the empty string, core API group is inferred.
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      description: Kind is kind of the referent. For
+                                        example "ConfigMap" or "Service".
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: Name is the name of the referent.
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the referenced object. When unspecified, the local
+                                        namespace is inferred.
+
+                                        Note that when a namespace different than the local namespace is specified,
+                                        a ReferenceGrant object is required in the referent namespace to allow that
+                                        namespace's owner to accept the reference. See the ReferenceGrant
+                                        documentation for details.
+
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  required:
+                                  - group
+                                  - kind
+                                  - name
+                                  type: object
+                                maxItems: 8
+                                minItems: 1
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              mode:
+                                default: AllowValidOnly
+                                description: |-
+                                  FrontendValidationMode defines the mode for validating the client certificate.
+                                  There are two possible modes:
 
-                                      The API object must be valid in the cluster; the Group and Kind must
-                                      be registered in the cluster for this reference to be valid.
+                                  - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                    the client presents a valid certificate. This certificate must successfully
+                                    pass validation against the CA certificates specified in `CACertificateRefs`.
+                                  - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                    even if the client certificate is not presented or fails verification.
 
-                                      References to objects with invalid Group and Kind are not valid, and must
-                                      be rejected by the implementation, with appropriate Conditions set
-                                      on the containing object.
-                                    properties:
-                                      group:
-                                        description: |-
-                                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                          When set to the empty string, core API group is inferred.
-                                        maxLength: 253
-                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                        type: string
-                                      kind:
-                                        description: Kind is kind of the referent.
-                                          For example "ConfigMap" or "Service".
-                                        maxLength: 63
-                                        minLength: 1
-                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                        type: string
-                                      name:
-                                        description: Name is the name of the referent.
-                                        maxLength: 253
-                                        minLength: 1
-                                        type: string
-                                      namespace:
-                                        description: |-
-                                          Namespace is the namespace of the referenced object. When unspecified, the local
-                                          namespace is inferred.
-
-                                          Note that when a namespace different than the local namespace is specified,
-                                          a ReferenceGrant object is required in the referent namespace to allow that
-                                          namespace's owner to accept the reference. See the ReferenceGrant
-                                          documentation for details.
-
-                                          Support: Core
-                                        maxLength: 63
-                                        minLength: 1
-                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                        type: string
-                                    required:
-                                    - group
-                                    - kind
-                                    - name
-                                    type: object
-                                  maxItems: 8
-                                  minItems: 1
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                mode:
-                                  default: AllowValidOnly
-                                  description: |-
-                                    FrontendValidationMode defines the mode for validating the client certificate.
-                                    There are two possible modes:
+                                    This approach delegates client authorization to the backend and introduce
+                                    a significant security risk. It should be used in testing environments or
+                                    on a temporary basis in non-testing environments.
 
-                                    - AllowValidOnly: In this mode, the gateway will accept connections only if
-                                      the client presents a valid certificate. This certificate must successfully
-                                      pass validation against the CA certificates specified in `CACertificateRefs`.
-                                    - AllowInsecureFallback: In this mode, the gateway will accept connections
-                                      even if the client certificate is not presented or fails verification.
+                                  Defaults to AllowValidOnly.
 
-                                      This approach delegates client authorization to the backend and introduce
-                                      a significant security risk. It should be used in testing environments or
-                                      on a temporary basis in non-testing environments.
+                                  Support: Core
+                                enum:
+                                - AllowValidOnly
+                                - AllowInsecureFallback
+                                type: string
+                            required:
+                            - caCertificateRefs
+                            type: object
+                        type: object
+                      perPort:
+                        description: |-
+                          PerPort specifies tls configuration assigned per port.
+                          Per port configuration is optional. Once set this configuration overrides
+                          the default configuration for all Listeners handling HTTPS traffic
+                          that match this port.
+                          Each override port requires a unique TLS configuration.
+
+                          support: Core
+                        items:
+                          properties:
+                            port:
+                              description: |-
+                                The Port indicates the Port Number to which the TLS configuration will be
+                                applied. This configuration will be applied to all Listeners handling HTTPS
+                                traffic that match this port.
+
+                                Support: Core
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                            tls:
+                              description: |-
+                                TLS store the configuration that will be applied to all Listeners handling
+                                HTTPS traffic and matching given port.
 
-                                    Defaults to AllowValidOnly.
+                                Support: Core
+                              properties:
+                                validation:
+                                  description: |-
+                                    Validation holds configuration information for validating the frontend (client).
+                                    Setting this field will result in mutual authentication when connecting to the gateway.
+                                    In browsers this may result in a dialog appearing
+                                    that requests a user to specify the client certificate.
+                                    The maximum depth of a certificate chain accepted in verification is Implementation specific.
 
                                     Support: Core
-                                  enum:
-                                  - AllowValidOnly
-                                  - AllowInsecureFallback
-                                  type: string
-                              required:
-                              - caCertificateRefs
+                                  properties:
+                                    caCertificateRefs:
+                                      description: |-
+                                        CACertificateRefs contains one or more references to
+                                        Kubernetes objects that contain TLS certificates of
+                                        the Certificate Authorities that can be used
+                                        as a trust anchor to validate the certificates presented by the client.
+
+                                        A single CA certificate reference to a Kubernetes ConfigMap
+                                        has "Core" support.
+                                        Implementations MAY choose to support attaching multiple CA certificates to
+                                        a Listener, but this behavior is implementation-specific.
+
+                                        Support: Core - A single reference to a Kubernetes ConfigMap
+                                        with the CA certificate in a key named `ca.crt`.
+
+                                        Support: Implementation-specific (More than one certificate in a ConfigMap
+                                        with different keys or more than one reference, or other kinds of resources).
+
+                                        References to a resource in a different namespace are invalid UNLESS there
+                                        is a ReferenceGrant in the target namespace that allows the certificate
+                                        to be attached. If a ReferenceGrant does not allow this reference, the
+                                        "ResolvedRefs" condition MUST be set to False for this listener with the
+                                        "RefNotPermitted" reason.
+                                      items:
+                                        description: |-
+                                          ObjectReference identifies an API object including its namespace.
+
+                                          The API object must be valid in the cluster; the Group and Kind must
+                                          be registered in the cluster for this reference to be valid.
+
+                                          References to objects with invalid Group and Kind are not valid, and must
+                                          be rejected by the implementation, with appropriate Conditions set
+                                          on the containing object.
+                                        properties:
+                                          group:
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When set to the empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            description: Kind is kind of the referent.
+                                              For example "ConfigMap" or "Service".
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the referenced object. When unspecified, the local
+                                              namespace is inferred.
+
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                        required:
+                                        - group
+                                        - kind
+                                        - name
+                                        type: object
+                                      maxItems: 8
+                                      minItems: 1
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mode:
+                                      default: AllowValidOnly
+                                      description: |-
+                                        FrontendValidationMode defines the mode for validating the client certificate.
+                                        There are two possible modes:
+
+                                        - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                          the client presents a valid certificate. This certificate must successfully
+                                          pass validation against the CA certificates specified in `CACertificateRefs`.
+                                        - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                          even if the client certificate is not presented or fails verification.
+
+                                          This approach delegates client authorization to the backend and introduce
+                                          a significant security risk. It should be used in testing environments or
+                                          on a temporary basis in non-testing environments.
+
+                                        Defaults to AllowValidOnly.
+
+                                        Support: Core
+                                      enum:
+                                      - AllowValidOnly
+                                      - AllowInsecureFallback
+                                      type: string
+                                  required:
+                                  - caCertificateRefs
+                                  type: object
                               type: object
                           required:
-                          - frontendValidation
+                          - port
+                          - tls
                           type: object
-                      required:
-                      - port
-                      - tls
-                      type: object
-                    maxItems: 64
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - port
-                    x-kubernetes-list-type: map
-                    x-kubernetes-validations:
-                    - message: Port for TLS configuration must be unique within the
-                        Gateway
-                      rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
-                required:
-                - default
+                        maxItems: 64
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - port
+                        x-kubernetes-list-type: map
+                        x-kubernetes-validations:
+                        - message: Port for TLS configuration must be unique within
+                            the Gateway
+                          rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
+                    required:
+                    - default
+                    type: object
                 type: object
             required:
             - gatewayClassName
@@ -1762,70 +1767,6 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                 type: object
-              backendTLS:
-                description: |-
-                  BackendTLS configures TLS settings for when this Gateway is connecting to
-                  backends with TLS.
-
-                  Support: Core
-                properties:
-                  clientCertificateRef:
-                    description: |-
-                      ClientCertificateRef is a reference to an object that contains a Client
-                      Certificate and the associated private key.
-
-                      References to a resource in different namespace are invalid UNLESS there
-                      is a ReferenceGrant in the target namespace that allows the certificate
-                      to be attached. If a ReferenceGrant does not allow this reference, the
-                      "ResolvedRefs" condition MUST be set to False for this listener with the
-                      "RefNotPermitted" reason.
-
-                      ClientCertificateRef can reference to standard Kubernetes resources, i.e.
-                      Secret, or implementation-specific custom resources.
-
-                      This setting can be overridden on the service level by use of BackendTLSPolicy.
-
-                      Support: Core
-                    properties:
-                      group:
-                        default: ""
-                        description: |-
-                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                          When unspecified or empty string, core API group is inferred.
-                        maxLength: 253
-                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                        type: string
-                      kind:
-                        default: Secret
-                        description: Kind is kind of the referent. For example "Secret".
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                        type: string
-                      name:
-                        description: Name is the name of the referent.
-                        maxLength: 253
-                        minLength: 1
-                        type: string
-                      namespace:
-                        description: |-
-                          Namespace is the namespace of the referenced object. When unspecified, the local
-                          namespace is inferred.
-
-                          Note that when a namespace different than the local namespace is specified,
-                          a ReferenceGrant object is required in the referent namespace to allow that
-                          namespace's owner to accept the reference. See the ReferenceGrant
-                          documentation for details.
-
-                          Support: Core
-                        maxLength: 63
-                        minLength: 1
-                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
               gatewayClassName:
                 description: |-
                   GatewayClassName used for this Gateway. This is the name of a
@@ -2517,294 +2458,363 @@ spec:
                     == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
               tls:
                 description: |-
-                  GatewayTLSConfig specifies frontend tls configuration for gateway.
+                  TLS specifies frontend and backend tls configuration for entire gateway.
 
                   Support: Extended
                 properties:
-                  default:
+                  backend:
                     description: |-
-                      Default specifies the default client certificate validation configuration
-                      for all Listeners handling HTTPS traffic, unless a per-port configuration
-                      is defined.
+                      Backend describes TLS configuration for gateway when connecting
+                      to backends.
 
-                      support: Core
+                      Note that this contains only details for the Gateway as a TLS client,
+                      and does _not_ imply behavior about how to choose which backend should
+                      get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+
+                      Support: Core
                     properties:
-                      frontendValidation:
+                      clientCertificateRef:
                         description: |-
-                          FrontendValidation holds configuration information for validating the frontend (client).
-                          Setting this field will result in mutual authentication when connecting to the gateway.
-                          In browsers this may result in a dialog appearing
-                          that requests a user to specify the client certificate.
-                          The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                          ClientCertificateRef is a reference to an object that contains a Client
+                          Certificate and the associated private key.
+
+                          References to a resource in different namespace are invalid UNLESS there
+                          is a ReferenceGrant in the target namespace that allows the certificate
+                          to be attached. If a ReferenceGrant does not allow this reference, the
+                          "ResolvedRefs" condition MUST be set to False for this listener with the
+                          "RefNotPermitted" reason.
+
+                          ClientCertificateRef can reference to standard Kubernetes resources, i.e.
+                          Secret, or implementation-specific custom resources.
 
                           Support: Core
                         properties:
-                          caCertificateRefs:
+                          group:
+                            default: ""
                             description: |-
-                              CACertificateRefs contains one or more references to
-                              Kubernetes objects that contain TLS certificates of
-                              the Certificate Authorities that can be used
-                              as a trust anchor to validate the certificates presented by the client.
-
-                              A single CA certificate reference to a Kubernetes ConfigMap
-                              has "Core" support.
-                              Implementations MAY choose to support attaching multiple CA certificates to
-                              a Listener, but this behavior is implementation-specific.
-
-                              Support: Core - A single reference to a Kubernetes ConfigMap
-                              with the CA certificate in a key named `ca.crt`.
-
-                              Support: Implementation-specific (More than one certificate in a ConfigMap
-                              with different keys or more than one reference, or other kinds of resources).
-
-                              References to a resource in a different namespace are invalid UNLESS there
-                              is a ReferenceGrant in the target namespace that allows the certificate
-                              to be attached. If a ReferenceGrant does not allow this reference, the
-                              "ResolvedRefs" condition MUST be set to False for this listener with the
-                              "RefNotPermitted" reason.
-                            items:
-                              description: |-
-                                ObjectReference identifies an API object including its namespace.
-
-                                The API object must be valid in the cluster; the Group and Kind must
-                                be registered in the cluster for this reference to be valid.
-
-                                References to objects with invalid Group and Kind are not valid, and must
-                                be rejected by the implementation, with appropriate Conditions set
-                                on the containing object.
-                              properties:
-                                group:
-                                  description: |-
-                                    Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                    When set to the empty string, core API group is inferred.
-                                  maxLength: 253
-                                  pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                  type: string
-                                kind:
-                                  description: Kind is kind of the referent. For example
-                                    "ConfigMap" or "Service".
-                                  maxLength: 63
-                                  minLength: 1
-                                  pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                  type: string
-                                name:
-                                  description: Name is the name of the referent.
-                                  maxLength: 253
-                                  minLength: 1
-                                  type: string
-                                namespace:
-                                  description: |-
-                                    Namespace is the namespace of the referenced object. When unspecified, the local
-                                    namespace is inferred.
-
-                                    Note that when a namespace different than the local namespace is specified,
-                                    a ReferenceGrant object is required in the referent namespace to allow that
-                                    namespace's owner to accept the reference. See the ReferenceGrant
-                                    documentation for details.
-
-                                    Support: Core
-                                  maxLength: 63
-                                  minLength: 1
-                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                  type: string
-                              required:
-                              - group
-                              - kind
-                              - name
-                              type: object
-                            maxItems: 8
-                            minItems: 1
-                            type: array
-                            x-kubernetes-list-type: atomic
-                          mode:
-                            default: AllowValidOnly
+                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                              When unspecified or empty string, core API group is inferred.
+                            maxLength: 253
+                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          kind:
+                            default: Secret
+                            description: Kind is kind of the referent. For example
+                              "Secret".
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                            type: string
+                          name:
+                            description: Name is the name of the referent.
+                            maxLength: 253
+                            minLength: 1
+                            type: string
+                          namespace:
                             description: |-
-                              FrontendValidationMode defines the mode for validating the client certificate.
-                              There are two possible modes:
-
-                              - AllowValidOnly: In this mode, the gateway will accept connections only if
-                                the client presents a valid certificate. This certificate must successfully
-                                pass validation against the CA certificates specified in `CACertificateRefs`.
-                              - AllowInsecureFallback: In this mode, the gateway will accept connections
-                                even if the client certificate is not presented or fails verification.
+                              Namespace is the namespace of the referenced object. When unspecified, the local
+                              namespace is inferred.
 
-                                This approach delegates client authorization to the backend and introduce
-                                a significant security risk. It should be used in testing environments or
-                                on a temporary basis in non-testing environments.
-
-                              Defaults to AllowValidOnly.
+                              Note that when a namespace different than the local namespace is specified,
+                              a ReferenceGrant object is required in the referent namespace to allow that
+                              namespace's owner to accept the reference. See the ReferenceGrant
+                              documentation for details.
 
                               Support: Core
-                            enum:
-                            - AllowValidOnly
-                            - AllowInsecureFallback
+                            maxLength: 63
+                            minLength: 1
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                             type: string
                         required:
-                        - caCertificateRefs
+                        - name
                         type: object
-                    required:
-                    - frontendValidation
                     type: object
-                  perPort:
+                  frontend:
                     description: |-
-                      PerPort specifies tls configuration assigned per port.
-                      Per port configuration is optional. Once set this configuration overrides
-                      the default configuration for all Listeners handling HTTPS traffic
-                      that match this port.
-                      Each override port requires a unique TLS configuration.
-
-                      support: Core
-                    items:
-                      properties:
-                        port:
-                          description: |-
-                            The Port indicates the Port Number to which the TLS configuration will be
-                            applied. This configuration will be applied to all Listeners handling HTTPS
-                            traffic that match this port.
-
-                            Support: Core
-                          format: int32
-                          maximum: 65535
-                          minimum: 1
-                          type: integer
-                        tls:
-                          description: |-
-                            TLS store the configuration that will be applied to all Listeners handling
-                            HTTPS traffic and matching given port.
+                      Frontend describes TLS config when client connects to Gateway.
+                      Support: Core
+                    properties:
+                      default:
+                        description: |-
+                          Default specifies the default client certificate validation configuration
+                          for all Listeners handling HTTPS traffic, unless a per-port configuration
+                          is defined.
 
-                            Support: Core
-                          properties:
-                            frontendValidation:
-                              description: |-
-                                FrontendValidation holds configuration information for validating the frontend (client).
-                                Setting this field will result in mutual authentication when connecting to the gateway.
-                                In browsers this may result in a dialog appearing
-                                that requests a user to specify the client certificate.
-                                The maximum depth of a certificate chain accepted in verification is Implementation specific.
+                          support: Core
+                        properties:
+                          validation:
+                            description: |-
+                              Validation holds configuration information for validating the frontend (client).
+                              Setting this field will result in mutual authentication when connecting to the gateway.
+                              In browsers this may result in a dialog appearing
+                              that requests a user to specify the client certificate.
+                              The maximum depth of a certificate chain accepted in verification is Implementation specific.
 
-                                Support: Core
-                              properties:
-                                caCertificateRefs:
+                              Support: Core
+                            properties:
+                              caCertificateRefs:
+                                description: |-
+                                  CACertificateRefs contains one or more references to
+                                  Kubernetes objects that contain TLS certificates of
+                                  the Certificate Authorities that can be used
+                                  as a trust anchor to validate the certificates presented by the client.
+
+                                  A single CA certificate reference to a Kubernetes ConfigMap
+                                  has "Core" support.
+                                  Implementations MAY choose to support attaching multiple CA certificates to
+                                  a Listener, but this behavior is implementation-specific.
+
+                                  Support: Core - A single reference to a Kubernetes ConfigMap
+                                  with the CA certificate in a key named `ca.crt`.
+
+                                  Support: Implementation-specific (More than one certificate in a ConfigMap
+                                  with different keys or more than one reference, or other kinds of resources).
+
+                                  References to a resource in a different namespace are invalid UNLESS there
+                                  is a ReferenceGrant in the target namespace that allows the certificate
+                                  to be attached. If a ReferenceGrant does not allow this reference, the
+                                  "ResolvedRefs" condition MUST be set to False for this listener with the
+                                  "RefNotPermitted" reason.
+                                items:
                                   description: |-
-                                    CACertificateRefs contains one or more references to
-                                    Kubernetes objects that contain TLS certificates of
-                                    the Certificate Authorities that can be used
-                                    as a trust anchor to validate the certificates presented by the client.
-
-                                    A single CA certificate reference to a Kubernetes ConfigMap
-                                    has "Core" support.
-                                    Implementations MAY choose to support attaching multiple CA certificates to
-                                    a Listener, but this behavior is implementation-specific.
-
-                                    Support: Core - A single reference to a Kubernetes ConfigMap
-                                    with the CA certificate in a key named `ca.crt`.
-
-                                    Support: Implementation-specific (More than one certificate in a ConfigMap
-                                    with different keys or more than one reference, or other kinds of resources).
-
-                                    References to a resource in a different namespace are invalid UNLESS there
-                                    is a ReferenceGrant in the target namespace that allows the certificate
-                                    to be attached. If a ReferenceGrant does not allow this reference, the
-                                    "ResolvedRefs" condition MUST be set to False for this listener with the
-                                    "RefNotPermitted" reason.
-                                  items:
-                                    description: |-
-                                      ObjectReference identifies an API object including its namespace.
+                                    ObjectReference identifies an API object including its namespace.
+
+                                    The API object must be valid in the cluster; the Group and Kind must
+                                    be registered in the cluster for this reference to be valid.
+
+                                    References to objects with invalid Group and Kind are not valid, and must
+                                    be rejected by the implementation, with appropriate Conditions set
+                                    on the containing object.
+                                  properties:
+                                    group:
+                                      description: |-
+                                        Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                        When set to the empty string, core API group is inferred.
+                                      maxLength: 253
+                                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                      type: string
+                                    kind:
+                                      description: Kind is kind of the referent. For
+                                        example "ConfigMap" or "Service".
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                      type: string
+                                    name:
+                                      description: Name is the name of the referent.
+                                      maxLength: 253
+                                      minLength: 1
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace of the referenced object. When unspecified, the local
+                                        namespace is inferred.
+
+                                        Note that when a namespace different than the local namespace is specified,
+                                        a ReferenceGrant object is required in the referent namespace to allow that
+                                        namespace's owner to accept the reference. See the ReferenceGrant
+                                        documentation for details.
+
+                                        Support: Core
+                                      maxLength: 63
+                                      minLength: 1
+                                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                      type: string
+                                  required:
+                                  - group
+                                  - kind
+                                  - name
+                                  type: object
+                                maxItems: 8
+                                minItems: 1
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              mode:
+                                default: AllowValidOnly
+                                description: |-
+                                  FrontendValidationMode defines the mode for validating the client certificate.
+                                  There are two possible modes:
 
-                                      The API object must be valid in the cluster; the Group and Kind must
-                                      be registered in the cluster for this reference to be valid.
+                                  - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                    the client presents a valid certificate. This certificate must successfully
+                                    pass validation against the CA certificates specified in `CACertificateRefs`.
+                                  - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                    even if the client certificate is not presented or fails verification.
 
-                                      References to objects with invalid Group and Kind are not valid, and must
-                                      be rejected by the implementation, with appropriate Conditions set
-                                      on the containing object.
-                                    properties:
-                                      group:
-                                        description: |-
-                                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
-                                          When set to the empty string, core API group is inferred.
-                                        maxLength: 253
-                                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
-                                        type: string
-                                      kind:
-                                        description: Kind is kind of the referent.
-                                          For example "ConfigMap" or "Service".
-                                        maxLength: 63
-                                        minLength: 1
-                                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
-                                        type: string
-                                      name:
-                                        description: Name is the name of the referent.
-                                        maxLength: 253
-                                        minLength: 1
-                                        type: string
-                                      namespace:
-                                        description: |-
-                                          Namespace is the namespace of the referenced object. When unspecified, the local
-                                          namespace is inferred.
-
-                                          Note that when a namespace different than the local namespace is specified,
-                                          a ReferenceGrant object is required in the referent namespace to allow that
-                                          namespace's owner to accept the reference. See the ReferenceGrant
-                                          documentation for details.
-
-                                          Support: Core
-                                        maxLength: 63
-                                        minLength: 1
-                                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
-                                        type: string
-                                    required:
-                                    - group
-                                    - kind
-                                    - name
-                                    type: object
-                                  maxItems: 8
-                                  minItems: 1
-                                  type: array
-                                  x-kubernetes-list-type: atomic
-                                mode:
-                                  default: AllowValidOnly
-                                  description: |-
-                                    FrontendValidationMode defines the mode for validating the client certificate.
-                                    There are two possible modes:
+                                    This approach delegates client authorization to the backend and introduce
+                                    a significant security risk. It should be used in testing environments or
+                                    on a temporary basis in non-testing environments.
 
-                                    - AllowValidOnly: In this mode, the gateway will accept connections only if
-                                      the client presents a valid certificate. This certificate must successfully
-                                      pass validation against the CA certificates specified in `CACertificateRefs`.
-                                    - AllowInsecureFallback: In this mode, the gateway will accept connections
-                                      even if the client certificate is not presented or fails verification.
+                                  Defaults to AllowValidOnly.
 
-                                      This approach delegates client authorization to the backend and introduce
-                                      a significant security risk. It should be used in testing environments or
-                                      on a temporary basis in non-testing environments.
+                                  Support: Core
+                                enum:
+                                - AllowValidOnly
+                                - AllowInsecureFallback
+                                type: string
+                            required:
+                            - caCertificateRefs
+                            type: object
+                        type: object
+                      perPort:
+                        description: |-
+                          PerPort specifies tls configuration assigned per port.
+                          Per port configuration is optional. Once set this configuration overrides
+                          the default configuration for all Listeners handling HTTPS traffic
+                          that match this port.
+                          Each override port requires a unique TLS configuration.
+
+                          support: Core
+                        items:
+                          properties:
+                            port:
+                              description: |-
+                                The Port indicates the Port Number to which the TLS configuration will be
+                                applied. This configuration will be applied to all Listeners handling HTTPS
+                                traffic that match this port.
+
+                                Support: Core
+                              format: int32
+                              maximum: 65535
+                              minimum: 1
+                              type: integer
+                            tls:
+                              description: |-
+                                TLS store the configuration that will be applied to all Listeners handling
+                                HTTPS traffic and matching given port.
 
-                                    Defaults to AllowValidOnly.
+                                Support: Core
+                              properties:
+                                validation:
+                                  description: |-
+                                    Validation holds configuration information for validating the frontend (client).
+                                    Setting this field will result in mutual authentication when connecting to the gateway.
+                                    In browsers this may result in a dialog appearing
+                                    that requests a user to specify the client certificate.
+                                    The maximum depth of a certificate chain accepted in verification is Implementation specific.
 
                                     Support: Core
-                                  enum:
-                                  - AllowValidOnly
-                                  - AllowInsecureFallback
-                                  type: string
-                              required:
-                              - caCertificateRefs
+                                  properties:
+                                    caCertificateRefs:
+                                      description: |-
+                                        CACertificateRefs contains one or more references to
+                                        Kubernetes objects that contain TLS certificates of
+                                        the Certificate Authorities that can be used
+                                        as a trust anchor to validate the certificates presented by the client.
+
+                                        A single CA certificate reference to a Kubernetes ConfigMap
+                                        has "Core" support.
+                                        Implementations MAY choose to support attaching multiple CA certificates to
+                                        a Listener, but this behavior is implementation-specific.
+
+                                        Support: Core - A single reference to a Kubernetes ConfigMap
+                                        with the CA certificate in a key named `ca.crt`.
+
+                                        Support: Implementation-specific (More than one certificate in a ConfigMap
+                                        with different keys or more than one reference, or other kinds of resources).
+
+                                        References to a resource in a different namespace are invalid UNLESS there
+                                        is a ReferenceGrant in the target namespace that allows the certificate
+                                        to be attached. If a ReferenceGrant does not allow this reference, the
+                                        "ResolvedRefs" condition MUST be set to False for this listener with the
+                                        "RefNotPermitted" reason.
+                                      items:
+                                        description: |-
+                                          ObjectReference identifies an API object including its namespace.
+
+                                          The API object must be valid in the cluster; the Group and Kind must
+                                          be registered in the cluster for this reference to be valid.
+
+                                          References to objects with invalid Group and Kind are not valid, and must
+                                          be rejected by the implementation, with appropriate Conditions set
+                                          on the containing object.
+                                        properties:
+                                          group:
+                                            description: |-
+                                              Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                                              When set to the empty string, core API group is inferred.
+                                            maxLength: 253
+                                            pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                                            type: string
+                                          kind:
+                                            description: Kind is kind of the referent.
+                                              For example "ConfigMap" or "Service".
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                                            type: string
+                                          name:
+                                            description: Name is the name of the referent.
+                                            maxLength: 253
+                                            minLength: 1
+                                            type: string
+                                          namespace:
+                                            description: |-
+                                              Namespace is the namespace of the referenced object. When unspecified, the local
+                                              namespace is inferred.
+
+                                              Note that when a namespace different than the local namespace is specified,
+                                              a ReferenceGrant object is required in the referent namespace to allow that
+                                              namespace's owner to accept the reference. See the ReferenceGrant
+                                              documentation for details.
+
+                                              Support: Core
+                                            maxLength: 63
+                                            minLength: 1
+                                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                                            type: string
+                                        required:
+                                        - group
+                                        - kind
+                                        - name
+                                        type: object
+                                      maxItems: 8
+                                      minItems: 1
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mode:
+                                      default: AllowValidOnly
+                                      description: |-
+                                        FrontendValidationMode defines the mode for validating the client certificate.
+                                        There are two possible modes:
+
+                                        - AllowValidOnly: In this mode, the gateway will accept connections only if
+                                          the client presents a valid certificate. This certificate must successfully
+                                          pass validation against the CA certificates specified in `CACertificateRefs`.
+                                        - AllowInsecureFallback: In this mode, the gateway will accept connections
+                                          even if the client certificate is not presented or fails verification.
+
+                                          This approach delegates client authorization to the backend and introduce
+                                          a significant security risk. It should be used in testing environments or
+                                          on a temporary basis in non-testing environments.
+
+                                        Defaults to AllowValidOnly.
+
+                                        Support: Core
+                                      enum:
+                                      - AllowValidOnly
+                                      - AllowInsecureFallback
+                                      type: string
+                                  required:
+                                  - caCertificateRefs
+                                  type: object
                               type: object
                           required:
-                          - frontendValidation
+                          - port
+                          - tls
                           type: object
-                      required:
-                      - port
-                      - tls
-                      type: object
-                    maxItems: 64
-                    type: array
-                    x-kubernetes-list-map-keys:
-                    - port
-                    x-kubernetes-list-type: map
-                    x-kubernetes-validations:
-                    - message: Port for TLS configuration must be unique within the
-                        Gateway
-                      rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
-                required:
-                - default
+                        maxItems: 64
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - port
+                        x-kubernetes-list-type: map
+                        x-kubernetes-validations:
+                        - message: Port for TLS configuration must be unique within
+                            the Gateway
+                          rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
+                    required:
+                    - default
+                    type: object
                 type: object
             required:
             - gatewayClassName
diff --git a/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
index 34876b54..03293113 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
@@ -657,18 +657,22 @@ spec:
                                         Support: Extended
                                       items:
                                         description: |-
-                                          The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
-                                          encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
-                                          scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
-                                          include an authority MUST include a fully qualified domain name or
+                                          The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                          encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                          scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                          URIs that include an authority MUST include a fully qualified domain name or
                                           IP address as the host.
                                         maxLength: 253
                                         minLength: 1
-                                        pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                        pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
                                         type: string
                                       maxItems: 64
                                       type: array
                                       x-kubernetes-list-type: set
+                                      x-kubernetes-validations:
+                                      - message: AllowOrigins cannot contain '*' alongside
+                                          other origins
+                                        rule: '!(''*'' in self && self.size() > 1)'
                                     exposeHeaders:
                                       description: |-
                                         ExposeHeaders indicates which HTTP response headers can be exposed
@@ -2139,18 +2143,22 @@ spec:
                                   Support: Extended
                                 items:
                                   description: |-
-                                    The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
-                                    encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
-                                    scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
-                                    include an authority MUST include a fully qualified domain name or
+                                    The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                    encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                    scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                    URIs that include an authority MUST include a fully qualified domain name or
                                     IP address as the host.
                                   maxLength: 253
                                   minLength: 1
-                                  pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                  pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
                                   type: string
                                 maxItems: 64
                                 type: array
                                 x-kubernetes-list-type: set
+                                x-kubernetes-validations:
+                                - message: AllowOrigins cannot contain '*' alongside
+                                    other origins
+                                  rule: '!(''*'' in self && self.size() > 1)'
                               exposeHeaders:
                                 description: |-
                                   ExposeHeaders indicates which HTTP response headers can be exposed
@@ -4801,18 +4809,22 @@ spec:
                                         Support: Extended
                                       items:
                                         description: |-
-                                          The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
-                                          encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
-                                          scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
-                                          include an authority MUST include a fully qualified domain name or
+                                          The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                          encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                          scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                          URIs that include an authority MUST include a fully qualified domain name or
                                           IP address as the host.
                                         maxLength: 253
                                         minLength: 1
-                                        pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                        pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
                                         type: string
                                       maxItems: 64
                                       type: array
                                       x-kubernetes-list-type: set
+                                      x-kubernetes-validations:
+                                      - message: AllowOrigins cannot contain '*' alongside
+                                          other origins
+                                        rule: '!(''*'' in self && self.size() > 1)'
                                     exposeHeaders:
                                       description: |-
                                         ExposeHeaders indicates which HTTP response headers can be exposed
@@ -6283,18 +6295,22 @@ spec:
                                   Support: Extended
                                 items:
                                   description: |-
-                                    The AbsoluteURI MUST NOT be a relative URI, and it MUST follow the URI syntax and
-                                    encoding rules specified in RFC3986.  The AbsoluteURI MUST include both a
-                                    scheme (e.g., "http" or "spiffe") and a scheme-specific-part.  URIs that
-                                    include an authority MUST include a fully qualified domain name or
+                                    The CORSOrigin MUST NOT be a relative URI, and it MUST follow the URI syntax and
+                                    encoding rules specified in RFC3986.  The CORSOrigin MUST include both a
+                                    scheme (e.g., "http" or "spiffe") and a scheme-specific-part, or it should be a single '*' character.
+                                    URIs that include an authority MUST include a fully qualified domain name or
                                     IP address as the host.
                                   maxLength: 253
                                   minLength: 1
-                                  pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                                  pattern: (^\*$)|(^([a-zA-Z][a-zA-Z0-9+\-.]+):\/\/([^:/?#]+)(:([0-9]{1,5}))?$)
                                   type: string
                                 maxItems: 64
                                 type: array
                                 x-kubernetes-list-type: set
+                                x-kubernetes-validations:
+                                - message: AllowOrigins cannot contain '*' alongside
+                                    other origins
+                                  rule: '!(''*'' in self && self.size() > 1)'
                               exposeHeaders:
                                 description: |-
                                   ExposeHeaders indicates which HTTP response headers can be exposed
diff --git a/conformance/base/manifests.yaml b/conformance/base/manifests.yaml
index 9380223e..d8f8c45a 100644
--- a/conformance/base/manifests.yaml
+++ b/conformance/base/manifests.yaml
@@ -95,6 +95,39 @@ spec:
           matchLabels:
             gateway-conformance: backend
 ---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-backendtlspolicy
+  namespace: gateway-conformance-infra
+spec:
+  gatewayClassName: "{GATEWAY_CLASS_NAME}"
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    hostname: "abc.example.com"
+    allowedRoutes:
+      namespaces:
+        from: Same
+      kinds:
+      - kind: HTTPRoute
+  - name: https
+    port: 443
+    protocol: HTTPS
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - group: ""
+        kind: Secret
+        name: tls-checks-certificate
+    hostname: "abc.example.com"
+    allowedRoutes:
+      namespaces:
+        from: Same
+      kinds:
+      - kind: HTTPRoute
+---
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/conformance/reports/v1.1.0/airlock-microgateway/README.md b/conformance/reports/v1.1.0/airlock-microgateway/README.md
index a23522a4..37084e90 100644
--- a/conformance/reports/v1.1.0/airlock-microgateway/README.md
+++ b/conformance/reports/v1.1.0/airlock-microgateway/README.md
@@ -4,19 +4,20 @@
 
 | API channel  | Implementation version                                               | Mode    | Report                                           |
 |--------------|----------------------------------------------------------------------|---------|--------------------------------------------------|
-| experimental | [v4.4.0](https://github.com/airlock/microgateway/releases/tag/4.4.0) | default | [v4.4.0 report](./experimental-4.4.0-default-report.yaml) |
-| standard     | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [v4.5.0 report](./standard-4.5.0-default-report.yaml)     |
-| standard     | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [v4.6.0 report](./standard-4.6.0-default-report.yaml)     |
+| experimental | [v4.4.0](https://github.com/airlock/microgateway/releases/tag/4.4.0) | default | [link](./experimental-4.4.0-default-report.yaml) |
+| standard     | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./standard-4.5.0-default-report.yaml)     |
+| standard    | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml) |
+| standard    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./standard-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
 > 
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.1.0/airlock-microgateway/standard-4.7.0-default-report.yaml b/conformance/reports/v1.1.0/airlock-microgateway/standard-4.7.0-default-report.yaml
new file mode 100644
index 00000000..37091df4
--- /dev/null
+++ b/conformance/reports/v1.1.0/airlock-microgateway/standard-4.7.0-default-report.yaml
@@ -0,0 +1,47 @@
+apiVersion: gateway.networking.k8s.io/v1alpha1
+date: "2025-08-25T13:36:52Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.1.0
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 12
+      Skipped: 0
+    supportedFeatures:
+    - GatewayPort8080
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteBackendTimeout
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestTimeout
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
diff --git a/conformance/reports/v1.1.1/airlock-microgateway/README.md b/conformance/reports/v1.1.1/airlock-microgateway/README.md
index a61abd83..66143c04 100644
--- a/conformance/reports/v1.1.1/airlock-microgateway/README.md
+++ b/conformance/reports/v1.1.1/airlock-microgateway/README.md
@@ -6,16 +6,17 @@
 |-------------|----------------------------------------------------------------------|---------|----------------------------------------------|
 | standard    | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./standard-4.5.0-default-report.yaml) |
 | standard    | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml) |
+| standard    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./standard-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
 > 
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.1.1/airlock-microgateway/standard-4.7.0-default-report.yaml b/conformance/reports/v1.1.1/airlock-microgateway/standard-4.7.0-default-report.yaml
new file mode 100644
index 00000000..3bc63624
--- /dev/null
+++ b/conformance/reports/v1.1.1/airlock-microgateway/standard-4.7.0-default-report.yaml
@@ -0,0 +1,47 @@
+apiVersion: gateway.networking.k8s.io/v1alpha1
+date: "2025-08-25T13:37:05Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.1.1
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 12
+      Skipped: 0
+    supportedFeatures:
+    - GatewayPort8080
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteBackendTimeout
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestTimeout
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
diff --git a/conformance/reports/v1.2.0/airlock-microgateway/README.md b/conformance/reports/v1.2.0/airlock-microgateway/README.md
index a61abd83..66143c04 100644
--- a/conformance/reports/v1.2.0/airlock-microgateway/README.md
+++ b/conformance/reports/v1.2.0/airlock-microgateway/README.md
@@ -6,16 +6,17 @@
 |-------------|----------------------------------------------------------------------|---------|----------------------------------------------|
 | standard    | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./standard-4.5.0-default-report.yaml) |
 | standard    | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml) |
+| standard    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./standard-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
 > 
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.2.0/airlock-microgateway/standard-4.7.0-default-report.yaml b/conformance/reports/v1.2.0/airlock-microgateway/standard-4.7.0-default-report.yaml
new file mode 100644
index 00000000..af660c02
--- /dev/null
+++ b/conformance/reports/v1.2.0/airlock-microgateway/standard-4.7.0-default-report.yaml
@@ -0,0 +1,53 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-08-25T13:37:00Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.2.0
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 18
+      Skipped: 0
+    supportedFeatures:
+    - GatewayInfrastructurePropagation
+    - GatewayPort8080
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestTimeout
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
+succeededProvisionalTests:
+- GatewayInfrastructure
diff --git a/conformance/reports/v1.2.1/airlock-microgateway/README.md b/conformance/reports/v1.2.1/airlock-microgateway/README.md
index 97c52418..e6c945be 100644
--- a/conformance/reports/v1.2.1/airlock-microgateway/README.md
+++ b/conformance/reports/v1.2.1/airlock-microgateway/README.md
@@ -5,17 +5,18 @@
 | API channel  | Implementation version                                               | Mode    | Report                                           |
 |--------------|----------------------------------------------------------------------|---------|--------------------------------------------------|
 | experimental | [v4.5.0](https://github.com/airlock/microgateway/releases/tag/4.5.0) | default | [link](./experimental-4.5.0-default-report.yaml) |
-| standard     | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml)     |
+| standard    | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./standard-4.6.0-default-report.yaml) |
+| standard    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./standard-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
 > 
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.2.1/airlock-microgateway/standard-4.7.0-default-report.yaml b/conformance/reports/v1.2.1/airlock-microgateway/standard-4.7.0-default-report.yaml
new file mode 100644
index 00000000..53f5311c
--- /dev/null
+++ b/conformance/reports/v1.2.1/airlock-microgateway/standard-4.7.0-default-report.yaml
@@ -0,0 +1,53 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-08-25T13:37:50Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.2.1
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 18
+      Skipped: 0
+    supportedFeatures:
+    - GatewayInfrastructurePropagation
+    - GatewayPort8080
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestTimeout
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
+succeededProvisionalTests:
+- GatewayInfrastructure
diff --git a/conformance/reports/v1.3.0/airlock-microgateway/README.md b/conformance/reports/v1.3.0/airlock-microgateway/README.md
index bae978e3..62704570 100644
--- a/conformance/reports/v1.3.0/airlock-microgateway/README.md
+++ b/conformance/reports/v1.3.0/airlock-microgateway/README.md
@@ -5,16 +5,17 @@
 | API channel  | Implementation version                                               | Mode    | Report                                           |
 |--------------|----------------------------------------------------------------------|---------|--------------------------------------------------|
 | experimental | [v4.6.0](https://github.com/airlock/microgateway/releases/tag/4.6.0) | default | [link](./experimental-4.6.0-default-report.yaml) |
+| experimental    | [v4.7.0](https://github.com/airlock/microgateway/releases/tag/4.7.0) | default | [link](./experimental-4.7.0-default-report.yaml) |
 
 ## Reproduce
 
-The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/conformance.md) on GitHub.
+The Airlock Microgateway conformance report can be reproduced by following the steps in the [Gateway API conformance guide](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/conformance.md) on GitHub.
 
 > [!NOTE]
 > The `HTTPRouteWeight` test fires 10 concurrent request to 3 backends totaling in 500 requests to assert a distribution that matches the configured weight.
-> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
+> Please be aware that this test exceeds the [5 req/sec rate-limit](https://docs.airlock.com/microgateway/latest/?topic=MGW-00000056) enforced in the <!-- markdown-link-check-disable --> [community edition](https://www.airlock.com/en/secure-access-hub/components/microgateway/community-edition) <!-- markdown-link-check-enable -->, causing the test to fail.
 > To successfully pass this test a <!-- markdown-link-check-disable --> [premium license](https://www.airlock.com/en/secure-access-hub/components/microgateway/premium-edition)  <!-- markdown-link-check-enable --> is required.
-> 
+>
 > The Airlock Microgateway drops all request headers except for a well-known built-in standard and tracing headers list (e.g., Accept, Cookie, X-CSRF-TOKEN) to reduce the attack surface.
-> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/examples/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
-> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
\ No newline at end of file
+> Therefore, to run the conformance tests, a `ContentSecurityPolicy` with a `HeaderRewrites` (see [`conformance-report.yaml`](https://github.com/airlock/microgateway/tree/main/gateway-api/conformance/manifests/conformance-report.yaml)) is required to disable request header filtering for all `HTTPRoute` tests relying on the `MakeRequestAndExpectEventuallyConsistentResponse` assertion.
+> Regardless of whether request header filtering is enabled or disabled, header-based routing works as specified in the Gateway API, as the headers are only filtered before the request is forwarded to the upstream.
diff --git a/conformance/reports/v1.3.0/airlock-microgateway/experimental-4.7.0-default-report.yaml b/conformance/reports/v1.3.0/airlock-microgateway/experimental-4.7.0-default-report.yaml
new file mode 100644
index 00000000..000e7877
--- /dev/null
+++ b/conformance/reports/v1.3.0/airlock-microgateway/experimental-4.7.0-default-report.yaml
@@ -0,0 +1,55 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-08-25T13:33:58Z"
+gatewayAPIChannel: experimental
+gatewayAPIVersion: v1.3.0
+implementation:
+  contact:
+  - https://www.airlock.com/en/contact
+  organization: airlock
+  project: microgateway
+  url: https://github.com/airlock/microgateway
+  version: 4.7.0
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 18
+      Skipped: 0
+    supportedFeatures:
+    - GatewayInfrastructurePropagation
+    - GatewayPort8080
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteHostRewrite
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRedirect
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestTimeout
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayAddressEmpty
+    - GatewayHTTPListenerIsolation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestPercentageMirror
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded. Extended tests succeeded.
+succeededProvisionalTests:
+- GatewayInfrastructure
diff --git a/conformance/utils/kubernetes/certificate.go b/conformance/utils/kubernetes/certificate.go
index 07c3c807..1b2ee3af 100644
--- a/conformance/utils/kubernetes/certificate.go
+++ b/conformance/utils/kubernetes/certificate.go
@@ -27,6 +27,7 @@ import (
 	"io"
 	"math/big"
 	"net"
+	"net/url"
 	"strings"
 	"testing"
 	"time"
@@ -119,6 +120,8 @@ func generateRSACert(hosts []string, keyOut, certOut io.Writer, ca *x509.Certifi
 			template.IPAddresses = append(template.IPAddresses, ip)
 		} else if err = validateHost(h); err == nil {
 			template.DNSNames = append(template.DNSNames, h)
+		} else if u, parseErr := url.Parse(h); parseErr == nil {
+			template.URIs = append(template.URIs, u)
 		}
 	}
 
@@ -215,6 +218,8 @@ func generateCACert(hosts []string) (*x509.Certificate, []byte, *rsa.PrivateKey,
 			ca.IPAddresses = append(ca.IPAddresses, ip)
 		} else if err := validateHost(h); err == nil {
 			ca.DNSNames = append(ca.DNSNames, h)
+		} else if u, err := url.Parse(h); err == nil {
+			ca.URIs = append(ca.URIs, u)
 		}
 	}
 
diff --git a/conformance/utils/kubernetes/helpers.go b/conformance/utils/kubernetes/helpers.go
index ea9b8af6..3309c8f2 100644
--- a/conformance/utils/kubernetes/helpers.go
+++ b/conformance/utils/kubernetes/helpers.go
@@ -1003,7 +1003,7 @@ func BackendTLSPolicyMustHaveCondition(t *testing.T, client client.Client, timeo
 		policy := &v1alpha3.BackendTLSPolicy{}
 		err := client.Get(ctx, policyNN, policy)
 		if err != nil {
-			return false, fmt.Errorf("error fetching BackendTLSPolicy: %w", err)
+			return false, fmt.Errorf("error fetching BackendTLSPolicy %v err: %w", policyNN, err)
 		}
 
 		for _, parent := range policy.Status.Ancestors {
@@ -1024,7 +1024,7 @@ func BackendTLSPolicyMustHaveCondition(t *testing.T, client client.Client, timeo
 		return false, nil
 	})
 
-	require.NoErrorf(t, waitErr, "error waiting for BackendTLSPolicy status to have a Condition %v", condition)
+	require.NoErrorf(t, waitErr, "error waiting for BackendTLSPolicy %v status to have a Condition %v", policyNN, condition)
 }
 
 // BackendTLSPolicyMustHaveLatestConditions will fail the test if there are
diff --git a/conformance/utils/suite/suite.go b/conformance/utils/suite/suite.go
index 23c93653..877c030f 100644
--- a/conformance/utils/suite/suite.go
+++ b/conformance/utils/suite/suite.go
@@ -394,6 +394,11 @@ func (suite *ConformanceTestSuite) Setup(t *testing.T, tests []ConformanceTest)
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMap}, suite.Cleanup)
 		secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-checks-certificate", []string{"abc.example.com"}, ca, caPrivKey)
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
+		// TODO(kl52752) Merge CA certificates for Backend TLS Policy and move Deployment to common file.
+		caConfigMap, ca, caPrivKey = kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "backend-tls-with-san-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity"})
+		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMap}, suite.Cleanup)
+		secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-with-san-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity"}, ca, caPrivKey)
+		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
 
 		tlog.Logf(t, "Test Setup: Ensuring Gateways and Pods from base manifests are ready")
 		namespaces := []string{
diff --git a/examples/experimental/backend-tls.yaml b/examples/experimental/backend-tls.yaml
new file mode 100644
index 00000000..94b8be09
--- /dev/null
+++ b/examples/experimental/backend-tls.yaml
@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: backend-tls
+spec:
+  gatewayClassName: acme-lb
+  tls:
+    backend:
+      clientCertificateRef:
+        kind: Secret
+        group: ""
+        name: foo-example-cert
+  listeners:
+  - name: foo-https
+    protocol: HTTP
+    port: 80
+    hostname: foo.example.com
+---
diff --git a/examples/experimental/frontend-cert-validation.yaml b/examples/experimental/frontend-cert-validation.yaml
index a7a9d4a1..34ada262 100644
--- a/examples/experimental/frontend-cert-validation.yaml
+++ b/examples/experimental/frontend-cert-validation.yaml
@@ -5,12 +5,22 @@ metadata:
 spec:
   gatewayClassName: acme-lb
   tls:
-    default:
-      frontendValidation:
-        caCertificateRefs:
-        - kind: ConfigMap
-          group: ""
-          name: foo-example-com-ca-cert
+    frontend:
+      default:
+        validation:
+          caCertificateRefs:
+          - kind: ConfigMap
+            group: ""
+            name: foo-example-com-ca-cert
+      perPort:
+      - port: 8443
+        tls:
+          validation:
+            caCertificateRefs:
+            - kind: ConfigMap
+              group: ""
+              name: foo-example-com-ca-cert
+            mode: "AllowInsecureFallback"
   listeners:
   - name: foo-https
     protocol: HTTPS
@@ -21,5 +31,14 @@ spec:
       - kind: Secret
         group: ""
         name: foo-example-com-cert
+  - name: bar-https
+    protocol: HTTPS
+    port: 8443
+    hostname: bar.example.com
+    tls:
+      certificateRefs:
+      - kind: Secret
+        group: ""
+        name: bar-example-com-cert
 ---
 
diff --git a/geps/gep-3155/index.md b/geps/gep-3155/index.md
index b75b64cc..41477c22 100644
--- a/geps/gep-3155/index.md
+++ b/geps/gep-3155/index.md
@@ -43,13 +43,20 @@ Specifying credentials at the gateway level is the default operation mode, where
 backends will be presented with a single gateway certificate. Per-service overrides are
 subject for consideration as the future work.
 
-**1. Add a new `BackendTLS` field at the top level of Gateways**
+**1. Add a new `BackendValidation` field at TLSConfig struct located in GatewayTLSConfig.Default field**
 
 ```go
-type GatewaySpec struct {
-  // BackendTLS configures TLS settings for when this Gateway is connecting to
-  // backends with TLS.
-  BackendTLS GatewayBackendTLS `json:"backendTLS,omitempty"'`
+// TLSConfig describes TLS configuration that can apply to multiple Listeners
+// within this Gateway.
+type TLSConfig struct {
+    ...
+	// GatewayBackendTLS describes TLS configuration for gateway when connecting
+	// to backends.
+	// Support: Core
+	//
+	// +optional
+	// <gateway:experimental>
+	BackendValidation *GatewayBackendTLS `json:"backendValidation,omitempty"`
 }
 type GatewayBackendTLS struct {
   // ClientCertificateRef is a reference to an object that contains a Client
diff --git a/go.mod b/go.mod
index c818773d..4f1a98f7 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/stretchr/testify v1.10.0
 	golang.org/x/net v0.43.0
 	golang.org/x/sync v0.16.0
-	google.golang.org/grpc v1.74.2
+	google.golang.org/grpc v1.75.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
 	google.golang.org/protobuf v1.36.7
 	k8s.io/api v0.33.4
@@ -77,7 +77,7 @@ require (
 	golang.org/x/time v0.9.0 // indirect
 	golang.org/x/tools v0.35.0 // indirect
 	golang.org/x/tools/go/expect v0.1.1-deprecated // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
diff --git a/go.sum b/go.sum
index b6f7fbce..4f596237 100644
--- a/go.sum
+++ b/go.sum
@@ -148,16 +148,16 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
-go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
-go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
-go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
-go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
-go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
-go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
-go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
-go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
-go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -221,10 +221,12 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a h1:v2PbRU4K3llS09c7zodFpNePeamkAwG3mPrAery9VeE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
-google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
 google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
diff --git a/pkg/features/backendtlspolicy.go b/pkg/features/backendtlspolicy.go
index 95d50171..12c6a24c 100644
--- a/pkg/features/backendtlspolicy.go
+++ b/pkg/features/backendtlspolicy.go
@@ -25,6 +25,9 @@ import "k8s.io/apimachinery/pkg/util/sets"
 const (
 	// This option indicates support for BackendTLSPolicy.
 	SupportBackendTLSPolicy FeatureName = "BackendTLSPolicy"
+
+	// This option indicates support for BackendTLSPolicy SubjectAltName Validation.
+	SupportBackendTLSPolicySANValidation FeatureName = "BackendTLSPolicySANValidation"
 )
 
 // TLSRouteFeature contains metadata for the TLSRoute feature.
@@ -33,8 +36,21 @@ var BackendTLSPolicyFeature = Feature{
 	Channel: FeatureChannelExperimental,
 }
 
+// BackendTLSPolicySanValidationFeature contains metadata for the BackendTLSPolicy
+// SubjectAltName Validation feature.
+var BackendTLSPolicySanValidationFeature = Feature{
+	Name:    SupportBackendTLSPolicySANValidation,
+	Channel: FeatureChannelExperimental,
+}
+
 // BackendTLSPolicyCoreFeatures includes all the supported features for the
 // BackendTLSPolicy API at a Core level of support.
 var BackendTLSPolicyCoreFeatures = sets.New(
 	BackendTLSPolicyFeature,
 )
+
+// BackendTLSPolicyExtendedFeatures includes all the supported features for the
+// BackendTLSPolicy API at a Extended level of support.
+var BackendTLSPolicyExtendedFeatures = sets.New(
+	BackendTLSPolicySanValidationFeature,
+)
diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go
index 588319b3..1451e17d 100644
--- a/pkg/generated/openapi/zz_generated.openapi.go
+++ b/pkg/generated/openapi/zz_generated.openapi.go
@@ -90,6 +90,7 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apis/v1.CookieConfig":                                    schema_sigsk8sio_gateway_api_apis_v1_CookieConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.ForwardBodyConfig":                               schema_sigsk8sio_gateway_api_apis_v1_ForwardBodyConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.Fraction":                                        schema_sigsk8sio_gateway_api_apis_v1_Fraction(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.FrontendTLSConfig":                               schema_sigsk8sio_gateway_api_apis_v1_FrontendTLSConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.FrontendTLSValidation":                           schema_sigsk8sio_gateway_api_apis_v1_FrontendTLSValidation(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.GRPCAuthConfig":                                  schema_sigsk8sio_gateway_api_apis_v1_GRPCAuthConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.GRPCBackendRef":                                  schema_sigsk8sio_gateway_api_apis_v1_GRPCBackendRef(ref),
@@ -3113,6 +3114,51 @@ func schema_sigsk8sio_gateway_api_apis_v1_Fraction(ref common.ReferenceCallback)
 	}
 }
 
+func schema_sigsk8sio_gateway_api_apis_v1_FrontendTLSConfig(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "FrontendTLSConfig specifies frontend tls configuration for gateway.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"default": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Default specifies the default client certificate validation configuration for all Listeners handling HTTPS traffic, unless a per-port configuration is defined.\n\nsupport: Core\n\n<gateway:experimental>",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.TLSConfig"),
+						},
+					},
+					"perPort": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"port",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "PerPort specifies tls configuration assigned per port. Per port configuration is optional. Once set this configuration overrides the default configuration for all Listeners handling HTTPS traffic that match this port. Each override port requires a unique TLS configuration.\n\nsupport: Core\n\n<gateway:experimental>",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.TLSPortConfig"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"default"},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apis/v1.TLSConfig", "sigs.k8s.io/gateway-api/apis/v1.TLSPortConfig"},
+	}
+}
+
 func schema_sigsk8sio_gateway_api_apis_v1_FrontendTLSValidation(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -3779,7 +3825,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewayBackendTLS(ref common.Reference
 				Properties: map[string]spec.Schema{
 					"clientCertificateRef": {
 						SchemaProps: spec.SchemaProps{
-							Description: "ClientCertificateRef is a reference to an object that contains a Client Certificate and the associated private key.\n\nReferences to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the \"ResolvedRefs\" condition MUST be set to False for this listener with the \"RefNotPermitted\" reason.\n\nClientCertificateRef can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources.\n\nThis setting can be overridden on the service level by use of BackendTLSPolicy.\n\nSupport: Core\n\n<gateway:experimental>",
+							Description: "ClientCertificateRef is a reference to an object that contains a Client Certificate and the associated private key.\n\nReferences to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the \"ResolvedRefs\" condition MUST be set to False for this listener with the \"RefNotPermitted\" reason.\n\nClientCertificateRef can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources.\n\nSupport: Core\n\n<gateway:experimental>",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.SecretObjectReference"),
 						},
 					},
@@ -4149,12 +4195,6 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayInfrastructure"),
 						},
 					},
-					"backendTLS": {
-						SchemaProps: spec.SchemaProps{
-							Description: "BackendTLS configures TLS settings for when this Gateway is connecting to backends with TLS.\n\nSupport: Core\n\n<gateway:experimental>",
-							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS"),
-						},
-					},
 					"allowedListeners": {
 						SchemaProps: spec.SchemaProps{
 							Description: "AllowedListeners defines which ListenerSets can be attached to this Gateway. While this feature is experimental, the default value is to allow no ListenerSets.\n\n<gateway:experimental>",
@@ -4163,7 +4203,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 					},
 					"tls": {
 						SchemaProps: spec.SchemaProps{
-							Description: "GatewayTLSConfig specifies frontend tls configuration for gateway.\n\nSupport: Extended\n\n<gateway:experimental>",
+							Description: "TLS specifies frontend and backend tls configuration for entire gateway.\n\nSupport: Extended\n\n<gateway:experimental>",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig"),
 						},
 					},
@@ -4172,7 +4212,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 			},
 		},
 		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1.AllowedListeners", "sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS", "sigs.k8s.io/gateway-api/apis/v1.GatewayInfrastructure", "sigs.k8s.io/gateway-api/apis/v1.GatewaySpecAddress", "sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig", "sigs.k8s.io/gateway-api/apis/v1.Listener"},
+			"sigs.k8s.io/gateway-api/apis/v1.AllowedListeners", "sigs.k8s.io/gateway-api/apis/v1.GatewayInfrastructure", "sigs.k8s.io/gateway-api/apis/v1.GatewaySpecAddress", "sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig", "sigs.k8s.io/gateway-api/apis/v1.Listener"},
 	}
 }
 
@@ -4314,44 +4354,26 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewayTLSConfig(ref common.ReferenceC
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "GatewayTLSConfig specifies frontend tls configuration for gateway.",
+				Description: "GatewayTLSConfig specifies frontend and backend tls configuration for gateway.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
-					"default": {
+					"backend": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Default specifies the default client certificate validation configuration for all Listeners handling HTTPS traffic, unless a per-port configuration is defined.\n\nsupport: Core\n\n<gateway:experimental>",
-							Default:     map[string]interface{}{},
-							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.TLSConfig"),
+							Description: "Backend describes TLS configuration for gateway when connecting to backends.\n\nNote that this contains only details for the Gateway as a TLS client, and does _not_ imply behavior about how to choose which backend should get a TLS connection. That is determined by the presence of a BackendTLSPolicy.\n\nSupport: Core\n\n<gateway:experimental>",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS"),
 						},
 					},
-					"perPort": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-map-keys": []interface{}{
-									"port",
-								},
-								"x-kubernetes-list-type": "map",
-							},
-						},
+					"frontend": {
 						SchemaProps: spec.SchemaProps{
-							Description: "PerPort specifies tls configuration assigned per port. Per port configuration is optional. Once set this configuration overrides the default configuration for all Listeners handling HTTPS traffic that match this port. Each override port requires a unique TLS configuration.\n\nsupport: Core\n\n<gateway:experimental>",
-							Type:        []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.TLSPortConfig"),
-									},
-								},
-							},
+							Description: "Frontend describes TLS config when client connects to Gateway. Support: Core\n\n<gateway:experimental>",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.FrontendTLSConfig"),
 						},
 					},
 				},
-				Required: []string{"default"},
 			},
 		},
 		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1.TLSConfig", "sigs.k8s.io/gateway-api/apis/v1.TLSPortConfig"},
+			"sigs.k8s.io/gateway-api/apis/v1.FrontendTLSConfig", "sigs.k8s.io/gateway-api/apis/v1.GatewayBackendTLS"},
 	}
 }
 
@@ -6230,15 +6252,13 @@ func schema_sigsk8sio_gateway_api_apis_v1_TLSConfig(ref common.ReferenceCallback
 				Description: "TLSConfig describes TLS configuration that can apply to multiple Listeners within this Gateway. Currently, it stores only the client certificate validation configuration, but this may be extended in the future.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
-					"frontendValidation": {
+					"validation": {
 						SchemaProps: spec.SchemaProps{
-							Description: "FrontendValidation holds configuration information for validating the frontend (client). Setting this field will result in mutual authentication when connecting to the gateway. In browsers this may result in a dialog appearing that requests a user to specify the client certificate. The maximum depth of a certificate chain accepted in verification is Implementation specific.\n\nSupport: Core\n\n<gateway:experimental>",
-							Default:     map[string]interface{}{},
+							Description: "Validation holds configuration information for validating the frontend (client). Setting this field will result in mutual authentication when connecting to the gateway. In browsers this may result in a dialog appearing that requests a user to specify the client certificate. The maximum depth of a certificate chain accepted in verification is Implementation specific.\n\nSupport: Core\n\n<gateway:experimental>",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.FrontendTLSValidation"),
 						},
 					},
 				},
-				Required: []string{"frontendValidation"},
 			},
 		},
 		Dependencies: []string{
diff --git a/site-src/implementations.md b/site-src/implementations.md
index 0d97e764..dc12477c 100644
--- a/site-src/implementations.md
+++ b/site-src/implementations.md
@@ -205,7 +205,7 @@ Airlock Microgateway protects your applications and microservices with the tried
 
 #### Features
 - Comprehensive WAAP (formerly known as WAF) with security features like Deny Rules to protect against known attacks (OWASP Top 10), header filtering, JSON parsing, OpenAPI specification enforcement, and GraphQL schema validation
-- Identity aware proxy which makes it possible to enforce authentication using JWT authentication or OIDC
+- Identity aware proxy which makes it possible to enforce authentication using JWT authentication or OIDC, with OAuth 2.0 Token Introspection and Token Exchange for continuous validation and secure delegation across services
 - Reverse proxy functionality with request routing rules, TLS termination and remote IP extraction
 - Easy-to-use Grafana dashboards which provide valuable insights in allowed and blocked traffic and other metrics
 
diff --git a/site-src/implementations/v1.1.md b/site-src/implementations/v1.1.md
index 21063b28..69a3326b 100644
--- a/site-src/implementations/v1.1.md
+++ b/site-src/implementations/v1.1.md
@@ -19,13 +19,14 @@ Implementations only appear in this page if they pass Core conformance for the r
 | Organization    | Project                            | Version            | Mode                             | Gateway Port 8080   | HTTPRoute Host Rewrite   | HTTPRoute Path Redirect   | HTTPRoute Request Mirror   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   | HTTPRoute Method Matching   | HTTPRoute Path Rewrite   | HTTPRoute Query Param Matching   | HTTPRoute Port Redirect   | HTTPRoute Parent Ref Port   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Timeout   |
 |:----------------|:-----------------------------------|:-------------------|:---------------------------------|:--------------------|:-------------------------|:--------------------------|:---------------------------|:-----------------------------------------|:----------------------------|:----------------------------|:-------------------------|:---------------------------------|:--------------------------|:----------------------------|:----------------------------------|:---------------------------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:-------------------------------------|:----------------------------|
 | GKE             | gke-gateway                        | 1.30.3-gke.1211000 | gke-l7-global-external-managed   | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :x:                         | :x:                      | :x:                              | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
-| GKE             | gke-gateway                        | 1.30.3-gke.1211000 | gke-l7-regional-external-managed | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :x:                         | :x:                      | :x:                              | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | GKE             | gke-gateway                        | 1.30.3-gke.1211000 | gke-l7-rilb                      | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :x:                         | :x:                      | :x:                              | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
+| GKE             | gke-gateway                        | 1.30.3-gke.1211000 | gke-l7-regional-external-managed | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :x:                         | :x:                      | :x:                              | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | Kong            | kubernetes-ingress-controller      | v3.2.0             | expressions                      | :x:                 | :white_check_mark:       | :x:                       | :x:                        | :white_check_mark:                       | :x:                         | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | Kong            | kubernetes-ingress-controller      | v3.3.1             | expressions                      | :x:                 | :white_check_mark:       | :x:                       | :x:                        | :white_check_mark:                       | :x:                         | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :x:                       | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | Microsoft Azure | Application Gateway for Containers | 1.3.7              | default                          | :x:                 | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :x:                         | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | airlock         | microgateway                       | 4.5.0              | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | airlock         | microgateway                       | 4.6.0              | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
+| airlock         | microgateway                       | 4.7.0              | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | airlock         | microgateway                       | v4.4.0             | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :x:                        | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :x:                               | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                  | :x:                         |
 | cilium          | cilium                             | v1.16.0            | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:          |
 | envoyproxy      | envoy-gateway                      | v1.1.0             | default                          | :white_check_mark:  | :white_check_mark:       | :white_check_mark:        | :white_check_mark:         | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :x:                              | :x:                                     | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:          |
diff --git a/site-src/implementations/v1.2.md b/site-src/implementations/v1.2.md
index c26434b4..a3728f6a 100644
--- a/site-src/implementations/v1.2.md
+++ b/site-src/implementations/v1.2.md
@@ -16,32 +16,39 @@ Implementations only appear in this page if they pass Core conformance for the r
 
 ### HTTPRoute
 
-| Organization   | Project                       | Version   | Mode                   | HTTPRoute Host Rewrite   | HTTPRoute Path Rewrite   | HTTPRoute Response Header Modification   | HTTPRoute Method Matching   | HTTPRoute Query Param Matching   | Gateway Infrastructure Propagation   | Gateway Port 8080   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Port Redirect   | HTTPRoute Request Timeout   | HTTPRoute Scheme Redirect   | HTTPRoute Path Redirect   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Request Header Modification   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   |
-|:---------------|:------------------------------|:----------|:-----------------------|:-------------------------|:-------------------------|:-----------------------------------------|:----------------------------|:---------------------------------|:-------------------------------------|:--------------------|:---------------------------------|:----------------------------------------|:----------------------------|:--------------------------------------|:----------------------------|:--------------------------|:----------------------------|:----------------------------|:--------------------------|:----------------------------------|:---------------------------|:------------------------------------------------|:---------------------------|:-------------------------------------|
-| Kong           | kubernetes-ingress-controller | v3.4.0    | traditional_compatible | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                                   | :x:                         | :x:                       | :x:                         | :x:                         | :x:                       | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| Kong           | kubernetes-ingress-controller | v3.4.0    | expressions            | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                                   | :x:                         | :x:                       | :x:                         | :x:                         | :x:                       | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| airlock        | microgateway                  | 4.5.0     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| airlock        | microgateway                  | 4.6.0     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| cilium         | cilium                        | v1.17     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :x:                         | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| envoyproxy     | envoy-gateway                 | latest    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:                | :x:                        | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| istio          | istio                         | 1.24      | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| kgateway-dev   | kgateway                      | v2.0.0    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :x:                 | :white_check_mark:               | :x:                                     | :x:                         | :x:                                   | :x:                         | :white_check_mark:        | :x:                         | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :white_check_mark:         | :x:                                  |
-| nginx          | nginx-gateway-fabric          | v1.6.0    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                                   | :x:                         | :white_check_mark:        | :x:                         | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| projectcontour | contour                       | v1.31.0   | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:        | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| traefik        | traefik                       | v3.2.2    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :x:                         | :white_check_mark:                    | :x:                         | :white_check_mark:        | :x:                         | :white_check_mark:          | :white_check_mark:        | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| Organization    | Project                            | Version   | Mode                   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Path Rewrite   | HTTPRoute Query Param Matching   | HTTPRoute Response Header Modification   | HTTPRoute Destination Port Matching   | HTTPRoute Path Redirect   | HTTPRoute Port Redirect   | HTTPRoute Scheme Redirect   | Gateway Infrastructure Propagation   | Gateway Port 8080   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Timeout   | HTTPRoute Parent Ref Port   | HTTPRoute Request Timeout   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Request Header Modification   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   |
+|:----------------|:-----------------------------------|:----------|:-----------------------|:-------------------------|:----------------------------|:-------------------------|:---------------------------------|:-----------------------------------------|:--------------------------------------|:--------------------------|:--------------------------|:----------------------------|:-------------------------------------|:--------------------|:---------------------------------|:----------------------------------------|:----------------------------|:----------------------------|:----------------------------|:----------------------------------|:---------------------------|:------------------------------------------------|:---------------------------|:-------------------------------------|
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | expressions            | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | traditional_compatible | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| Microsoft Azure | Application Gateway for Containers | 1.7.9     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| airlock         | microgateway                       | 4.5.0     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| airlock         | microgateway                       | 4.6.0     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| airlock         | microgateway                       | 4.7.0     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| cilium          | cilium                             | v1.17     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :x:                         | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| envoyproxy      | envoy-gateway                      | latest    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :x:                        | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| istio           | istio                              | 1.24      | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| kgateway-dev    | kgateway                           | v2.0.0    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :x:                 | :white_check_mark:               | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :white_check_mark:         | :x:                                  |
+| kubvernor       | kubvernor                          | 0.1.0     | default                | :x:                      | :x:                         | :x:                      | :x:                              | :x:                                      | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| nginx           | nginx-gateway-fabric               | v1.6.0    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :white_check_mark:                | :x:                        | :x:                                             | :white_check_mark:         | :white_check_mark:                   |
+| nginx           | nginx-gateway-fabric               | v2.0.2    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :white_check_mark:                | :x:                        | :x:                                             | :white_check_mark:         | :white_check_mark:                   |
+| projectcontour  | contour                            | v1.31.0   | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| traefik         | traefik                            | v3.2.2    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
 
 ### GRPCRoute
 
-| Organization   | Project                       | Version   | Mode                   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
-|:---------------|:------------------------------|:----------|:-----------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
-| Kong           | kubernetes-ingress-controller | v3.4.0    | traditional_compatible | :x:                               | :x:                                  | :x:                 | :x:                        |
-| Kong           | kubernetes-ingress-controller | v3.4.0    | expressions            | :x:                               | :x:                                  | :x:                 | :x:                        |
-| cilium         | cilium                        | v1.17     | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| envoyproxy     | envoy-gateway                 | latest    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
-| istio          | istio                         | 1.24      | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| nginx          | nginx-gateway-fabric          | v1.6.0    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
-| projectcontour | contour                       | v1.31.0   | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| traefik        | traefik                       | v3.2.2    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
+| Organization    | Project                            | Version   | Mode                   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
+|:----------------|:-----------------------------------|:----------|:-----------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | expressions            | :x:                               | :x:                                  | :x:                 | :x:                        |
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | traditional_compatible | :x:                               | :x:                                  | :x:                 | :x:                        |
+| Microsoft Azure | Application Gateway for Containers | 1.7.9     | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
+| cilium          | cilium                             | v1.17     | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| envoyproxy      | envoy-gateway                      | latest    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
+| istio           | istio                              | 1.24      | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| kubvernor       | kubvernor                          | 0.1.0     | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
+| nginx           | nginx-gateway-fabric               | v1.6.0    | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| nginx           | nginx-gateway-fabric               | v2.0.2    | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| projectcontour  | contour                            | v1.31.0   | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| traefik         | traefik                            | v3.2.2    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
 
 ### TLSRoute
 
@@ -50,7 +57,8 @@ Implementations only appear in this page if they pass Core conformance for the r
 | cilium         | cilium               | v1.17     | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
 | envoyproxy     | envoy-gateway        | latest    | default | :x:                               | :x:                                  | :x:                 | :x:                        |
 | istio          | istio                | 1.24      | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| nginx          | nginx-gateway-fabric | v1.6.0    | default | :x:                               | :x:                                  | :x:                 | :x:                        |
+| nginx          | nginx-gateway-fabric | v1.6.0    | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| nginx          | nginx-gateway-fabric | v2.0.2    | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
 | projectcontour | contour              | v1.31.0   | default | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
 | traefik        | traefik              | v3.2.2    | default | :x:                               | :x:                                  | :x:                 | :x:                        |
 
diff --git a/site-src/implementations/v1.3.md b/site-src/implementations/v1.3.md
index 552e98cd..653a8b80 100644
--- a/site-src/implementations/v1.3.md
+++ b/site-src/implementations/v1.3.md
@@ -16,34 +16,48 @@ Implementations only appear in this page if they pass Core conformance for the r
 
 ### HTTPRoute
 
-| Organization   | Project       | Version   | Mode    | Gateway Infrastructure Propagation   | Gateway Port 8080   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Request Header Modification   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   |
-|:---------------|:--------------|:----------|:--------|:-------------------------------------|:--------------------|:---------------------------------|:----------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|:------------------------|:----------------------------------|:---------------------------|:------------------------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|
-| airlock        | microgateway  | 4.6.0     | default | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :x:                     | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  | :x:                                   |
-| cilium         | cilium        | main      | default | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    |
-| envoyproxy     | envoy-gateway | latest    | default | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:      | :white_check_mark:                | :x:                        | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    |
-| istio          | istio         | 1.26.1    | default | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    |
+| Organization   | Project              | Version     | Mode             | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   |
+|:---------------|:---------------------|:------------|:-----------------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|
+| agentgateway   | agentgateway         | v0.6.0-dev  | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| airlock        | microgateway         | 4.6.0       | default          | :x:                     | :x:                               | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :x:                        | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| airlock        | microgateway         | 4.7.0       | default          | :x:                     | :x:                               | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :x:                        | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| cilium         | cilium               | main        | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| envoyproxy     | envoy-gateway        | v1.5.0      | GatewayNamespace | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| envoyproxy     | envoy-gateway        | v1.5.0      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| istio          | istio                | 1.26.1      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| kgateway-dev   | kgateway             | v2.1.0-main | default          | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| nginx          | nginx-gateway-fabric | v2.0.0      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :x:                              | :white_check_mark:                      | :x:                                             | :x:                         | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :x:                         | :white_check_mark:                       | :white_check_mark:          |
+| nginx          | nginx-gateway-fabric | v2.1.0      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :x:                              | :white_check_mark:                      | :x:                                             | :x:                         | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :x:                         | :white_check_mark:                       | :white_check_mark:          |
 
 ### GRPCRoute
 
-| Organization   | Project       | Version   | Mode    | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
-|:---------------|:--------------|:----------|:--------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
-| cilium         | cilium        | main      | default | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| envoyproxy     | envoy-gateway | latest    | default | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        |
-| istio          | istio         | 1.26.1    | default | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| Organization   | Project              | Version   | Mode             | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
+|:---------------|:---------------------|:----------|:-----------------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
+| cilium         | cilium               | main      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| envoyproxy     | envoy-gateway        | v1.5.0    | GatewayNamespace | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| envoyproxy     | envoy-gateway        | v1.5.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| istio          | istio                | 1.26.1    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| nginx          | nginx-gateway-fabric | v2.0.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| nginx          | nginx-gateway-fabric | v2.1.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
 
 ### TLSRoute
 
-| Organization   | Project       | Version   | Mode    | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
-|:---------------|:--------------|:----------|:--------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
-| cilium         | cilium        | main      | default | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
-| envoyproxy     | envoy-gateway | latest    | default | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        |
-| istio          | istio         | 1.26.1    | default | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| Organization   | Project              | Version   | Mode             | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
+|:---------------|:---------------------|:----------|:-----------------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
+| cilium         | cilium               | main      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| envoyproxy     | envoy-gateway        | v1.5.0    | GatewayNamespace | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| envoyproxy     | envoy-gateway        | v1.5.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| istio          | istio                | 1.26.1    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
+| nginx          | nginx-gateway-fabric | v2.0.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| nginx          | nginx-gateway-fabric | v2.1.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
 
 ## Mesh Profile
 
 ### HTTPRoute
 
-| Organization   | Project   | Version   | Mode    | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   | Mesh Cluster IP Matching   | HTTPRoute Parent Ref Port   | Mesh Consumer Route   |
-|:---------------|:----------|:----------|:--------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|:---------------------------|:----------------------------|:----------------------|
-| cilium         | cilium    | main      | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:         | :x:                         | :x:                   |
-| istio          | istio     | 1.26.1    | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :x:                        | :white_check_mark:          | :white_check_mark:    |
\ No newline at end of file
+| Organization   | Project                        | Version         | Mode    | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   | Mesh Cluster IP Matching   | Mesh Consumer Route   | Mesh HTTPRoute Backend Request Header Modification   | Mesh HTTPRoute Query Param Matching   | Mesh HTTPRoute Redirect Port   | Mesh HTTPRoute Scheme Redirect   |
+|:---------------|:-------------------------------|:----------------|:--------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|:---------------------------|:----------------------|:-----------------------------------------------------|:--------------------------------------|:-------------------------------|:---------------------------------|
+| Buoyant        | Buoyant Enterprise for Linkerd | enterprise-2.18 | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:         | :white_check_mark:    | :white_check_mark:                                   | :white_check_mark:                    | :white_check_mark:             | :white_check_mark:               |
+| Linkerd        | Linkerd                        | version-2.18    | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:         | :white_check_mark:    | :white_check_mark:                                   | :white_check_mark:                    | :white_check_mark:             | :white_check_mark:               |
+| cilium         | cilium                         | main            | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:         | :x:                   | :x:                                                  | :x:                                   | :x:                            | :x:                              |
+| istio          | istio                          | 1.26.1          | default | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          | :x:                        | :white_check_mark:    | :x:                                                  | :x:                                   | :x:                            | :x:                              |
\ No newline at end of file


Test patch:
diff --git a/conformance/tests/backendtlspolicy-san.go b/conformance/tests/backendtlspolicy-san.go
new file mode 100644
index 00000000..38e7a2b4
--- /dev/null
+++ b/conformance/tests/backendtlspolicy-san.go
@@ -0,0 +1,163 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+	h "sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, BackendTLSPolicySANValidation)
+}
+
+var BackendTLSPolicySANValidation = suite.ConformanceTest{
+	ShortName:   "BackendTLSPolicySANValidation",
+	Description: "BackendTLSPolicySANValidation extend BackendTLSPolicy with SubjectAltNames validation",
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportHTTPRoute,
+		features.SupportBackendTLSPolicy,
+		features.SupportBackendTLSPolicySANValidation,
+	},
+	Manifests: []string{"tests/backendtlspolicy-san.yaml"},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-infra"
+		routeNN := types.NamespacedName{Name: "route-backendtlspolicy-san-test", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "gateway-backendtlspolicy", Namespace: ns}
+
+		kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
+		gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
+		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+		policyCond := metav1.Condition{
+			Type:   string(v1alpha2.PolicyConditionAccepted),
+			Status: metav1.ConditionTrue,
+			Reason: string(v1alpha2.PolicyReasonAccepted),
+		}
+
+		serverStr := "abc.example.com"
+
+		// Verify that the request sent to Service with valid BackendTLSPolicy containing dns SAN should succeed.
+		t.Run("HTTP request sent to Service with valid BackendTLSPolicy containing dns SAN should succeed", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-dns", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSSanDns",
+						SNI:  serverStr,
+					},
+					Response: h.Response{StatusCode: 200},
+				})
+		})
+
+		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched dns SAN should fail.
+		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched dns SAN should return an HTTP error", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-dns-mismatch", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSSanDnsMismatch",
+						SNI:  serverStr,
+					},
+				})
+		})
+
+		// Verify that the request sent to Service with valid BackendTLSPolicy containing uri SAN should succeed.
+		t.Run("HTTP request sent to Service with valid BackendTLSPolicy containing uri SAN should succeed", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-uri", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSSanUri",
+						SNI:  serverStr,
+					},
+					Response: h.Response{StatusCode: 200},
+				})
+		})
+
+		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched uri SAN should fail.
+		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched uri SAN should return an HTTP error", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-uri-mismatch", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSSanUriMismatch",
+						SNI:  serverStr,
+					},
+				})
+		})
+
+		// Verify that the request sent to Service with valid BackendTLSPolicy containing multi SANs should succeed.
+		t.Run("HTTP request sent to Service with valid BackendTLSPolicy containing multi SAN should succeed", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-multiple-sans", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSMultiSans",
+						SNI:  serverStr,
+					},
+					Response: h.Response{StatusCode: 200},
+				})
+		})
+
+		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched multi SAN should fail.
+		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched multi SAN should return an HTTP error", func(t *testing.T) {
+			policyNN := types.NamespacedName{Name: "backendtlspolicy-multiple-mismatch-sans", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
+
+			h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+				h.ExpectedResponse{
+					Namespace: ns,
+					Request: h.Request{
+						Host: serverStr,
+						Path: "/backendTLSMultiMismatchSans",
+						SNI:  serverStr,
+					},
+				})
+		})
+	},
+}
diff --git a/conformance/tests/backendtlspolicy-san.yaml b/conformance/tests/backendtlspolicy-san.yaml
new file mode 100644
index 00000000..e3e0f79b
--- /dev/null
+++ b/conformance/tests/backendtlspolicy-san.yaml
@@ -0,0 +1,341 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: route-backendtlspolicy-san-test
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: gateway-backendtlspolicy
+    namespace: gateway-conformance-infra
+  hostnames:
+  - abc.example.com
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-san-dns-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSSanDns
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-san-dns-mismatch-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSSanDnsMismatch
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-san-uri-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSSanUri
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-san-uri-mismatch-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSSanUriMismatch
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-multiple-sans-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSMultiSans
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-multiple-mismatch-sans-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendTLSMultiMismatchSans
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-san-dns-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-san-dns-mismatch-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-san-uri-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-san-uri-mismatch-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-multiple-sans-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-multiple-mismatch-sans-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: backendtlspolicy-san-test
+  ports:
+  - name: "btls"
+    protocol: TCP
+    appProtocol: HTTPS
+    port: 443
+    targetPort: 8443
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backendtlspolicy-san-test
+  namespace: gateway-conformance-infra
+  labels:
+    app: backendtlspolicy-san-test
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backendtlspolicy-san-test
+  template:
+    metadata:
+      labels:
+        app: backendtlspolicy-san-test
+    spec:
+      containers:
+      - name: backendtlspolicy-san-test
+        image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
+        volumeMounts:
+        - name: secret-volume
+          mountPath: /etc/secret-volume
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: TLS_SERVER_CERT
+          value: /etc/secret-volume/crt
+        - name: TLS_SERVER_PRIVKEY
+          value: /etc/secret-volume/key
+        resources:
+          requests:
+            cpu: 10m
+      volumes:
+      - name: secret-volume
+        secret:
+          # This secret is generated dynamically by the test suite.
+          secretName: tls-with-san-certificate
+          items:
+          - key: tls.crt
+            path: crt
+          - key: tls.key
+            path: key
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-san-dns
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-san-dns-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "Hostname"
+      hostname: "abc.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-san-dns-mismatch
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-san-dns-mismatch-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "Hostname"
+      hostname: "dce.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-san-uri
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-san-uri-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "URI"
+      uri: "spiffe://abc.example.com/test-identity"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-san-uri-mismatch
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-san-uri-mismatch-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "URI"
+      uri: "spiffe://def.example.com/test-identity"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-multiple-sans
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-multiple-sans-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "URI"
+      uri: "spiffe://abc.example.com/test-identity"
+    - type: "Hostname"
+      hostname: "abc.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: backendtlspolicy-multiple-mismatch-sans
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: backendtlspolicy-multiple-mismatch-sans-test
+    sectionName: "btls"
+  validation:
+    caCertificateRefs:
+    - group: ""
+      kind: ConfigMap
+      # This secret is generated dynamically by the test suite.
+      name: "backend-tls-with-san-certificate"
+    hostname: "abc.example.com"
+    subjectAltNames:
+    - type: "URI"
+      uri: "spiffe://def.example.com/test-identity"
+    - type: "Hostname"
+      hostname: "def.example.com"
diff --git a/conformance/tests/backendtlspolicy.yaml b/conformance/tests/backendtlspolicy.yaml
index e048cc2e..6d0cab8e 100644
--- a/conformance/tests/backendtlspolicy.yaml
+++ b/conformance/tests/backendtlspolicy.yaml
@@ -1,37 +1,4 @@
 apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: gateway-backendtlspolicy
-  namespace: gateway-conformance-infra
-spec:
-  gatewayClassName: "{GATEWAY_CLASS_NAME}"
-  listeners:
-  - name: http
-    port: 80
-    protocol: HTTP
-    hostname: "abc.example.com"
-    allowedRoutes:
-      namespaces:
-        from: Same
-      kinds:
-      - kind: HTTPRoute
-  - name: https
-    port: 443
-    protocol: HTTPS
-    tls:
-      mode: Terminate
-      certificateRefs:
-      - group: ""
-        kind: Secret
-        name: tls-checks-certificate
-    hostname: "abc.example.com"
-    allowedRoutes:
-      namespaces:
-        from: Same
-      kinds:
-      - kind: HTTPRoute
----
-apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: gateway-conformance-infra-test
diff --git a/conformance/tests/httproute-weight.go b/conformance/tests/httproute-weight.go
index fa85deb9..bafd768a 100644
--- a/conformance/tests/httproute-weight.go
+++ b/conformance/tests/httproute-weight.go
@@ -59,8 +59,10 @@ var HTTPRouteWeight = suite.ConformanceTest{
 
 		t.Run("Requests should have a distribution that matches the weight", func(t *testing.T) {
 			expected := http.ExpectedResponse{
-				Request:   http.Request{Path: "/"},
-				Response:  http.Response{StatusCode: 200},
+				Request: http.Request{Path: "/"},
+				Response: http.Response{
+					StatusCodes: []int{200},
+				},
 				Namespace: "gateway-conformance-infra",
 			}
 
diff --git a/pkg/test/cel/httproute_experimental_test.go b/pkg/test/cel/httproute_experimental_test.go
index 9978d4ca..b9d2289e 100644
--- a/pkg/test/cel/httproute_experimental_test.go
+++ b/pkg/test/cel/httproute_experimental_test.go
@@ -241,6 +241,135 @@ func toDuration(durationString string) *gatewayv1.Duration {
 	return (*gatewayv1.Duration)(&durationString)
 }
 
+func TestHTTPRouteCORS(t *testing.T) {
+	tests := []struct {
+		name       string
+		wantErrors []string
+		corsfilter *gatewayv1.HTTPCORSFilter
+	}{
+		{
+			name:       "Valid cors should be accepted",
+			wantErrors: nil,
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowOrigins: []gatewayv1.CORSOrigin{
+					"https://xpto.com",
+					"http://*.abcd.com",
+					"http://*.abcd.com:12345",
+				},
+			},
+		},
+		{
+			name:       "Using wildcard only is accepted",
+			wantErrors: nil,
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowOrigins: []gatewayv1.CORSOrigin{
+					"*",
+				},
+			},
+		},
+		{
+			name:       "Wildcard and other hosts on the same origin list should be denied",
+			wantErrors: []string{"AllowOrigins cannot contain '*' alongside other origins"},
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowOrigins: []gatewayv1.CORSOrigin{
+					"*",
+					"https://xpto.com",
+				},
+			},
+		},
+		{
+			name:       "An origin without the format scheme://host should be denied",
+			wantErrors: []string{"Invalid value: \"xpto.com\": spec.rules[0].filters[0].cors.allowOrigins[1] in body should match"},
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowOrigins: []gatewayv1.CORSOrigin{
+					"https://xpto.com",
+					"xpto.com",
+				},
+			},
+		},
+		{
+			name:       "An origin as http://*.com should be accepted",
+			wantErrors: nil,
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowOrigins: []gatewayv1.CORSOrigin{
+					"https://*.com",
+				},
+			},
+		},
+		{
+			name:       "An origin with an invalid port should be denied",
+			wantErrors: []string{"Invalid value: \"https://xpto.com:notaport\": spec.rules[0].filters[0].cors.allowOrigins[0] in body should match"},
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowOrigins: []gatewayv1.CORSOrigin{
+					"https://xpto.com:notaport",
+				},
+			},
+		},
+		{
+			name:       "An origin with an value before the scheme definition should be denied",
+			wantErrors: []string{"Invalid value: \"xpto/https://xpto.com\""},
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowOrigins: []gatewayv1.CORSOrigin{
+					"xpto/https://xpto.com",
+				},
+			},
+		},
+		{
+			name:       "Using an invalid HTTP method should be denied",
+			wantErrors: []string{"Unsupported value: \"BAZINGA\""},
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowMethods: []gatewayv1.HTTPMethodWithWildcard{
+					"BAZINGA",
+				},
+			},
+		},
+		{
+			name:       "Using wildcard and a valid method should be denied",
+			wantErrors: []string{"AllowMethods cannot contain '*' alongside other methods"},
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowMethods: []gatewayv1.HTTPMethodWithWildcard{
+					"GET",
+					"*",
+					"POST",
+				},
+			},
+		},
+		{
+			name:       "Using an array of valid methods should be accepted",
+			wantErrors: nil,
+			corsfilter: &gatewayv1.HTTPCORSFilter{
+				AllowMethods: []gatewayv1.HTTPMethodWithWildcard{
+					"GET",
+					"OPTIONS",
+					"POST",
+				},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			route := &gatewayv1.HTTPRoute{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      fmt.Sprintf("foo-%v", time.Now().UnixNano()),
+					Namespace: metav1.NamespaceDefault,
+				},
+				Spec: gatewayv1.HTTPRouteSpec{Rules: []gatewayv1.HTTPRouteRule{
+					{
+						Filters: []gatewayv1.HTTPRouteFilter{
+							{
+								Type: gatewayv1.HTTPRouteFilterCORS,
+								CORS: tc.corsfilter,
+							},
+						},
+					},
+				}},
+			}
+			validateHTTPRoute(t, route, tc.wantErrors)
+		})
+	}
+}
+
 func TestHTTPRouteTimeouts(t *testing.T) {
 	tests := []struct {
 		name       string