diff --git a/.circleci/config.yml b/.circleci/config.yml
index 44cda2859..56927191d 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -98,7 +98,7 @@ executors:
   docker:
     working_directory: /opt/app-root/apicast
     docker:
-    - image: docker:23.0.2-cli-alpine3.17
+    - image: mirror.gcr.io/library/docker:23.0.2-cli-alpine3.17
     environment:
       COMPOSE_TLS_VERSION: "TLSv1_2"
 
@@ -106,7 +106,7 @@ executors:
     working_directory: /opt/app-root/apicast
     docker:
       - image: quay.io/3scale/apicast-ci:openresty-1.21.4-1
-      - image: redis:3.2.8-alpine
+      - image: mirror.gcr.io/library/redis
     environment:
       TEST_NGINX_BINARY: openresty
       LUA_BIN_PATH: /opt/app-root/bin
@@ -230,6 +230,7 @@ jobs:
             JUNIT_OUTPUT_FILE: tmp/junit/prove/report.xml
             TEST_NGINX_ERROR_LOG: tmp/junit/prove/error.log
             HARNESS: TAP::Harness::JUnit
+            NPROC: 2
       - report-codecov:
           suite: prove
           flags: -f 'luacov.report.*.out'
diff --git a/Brewfile b/Brewfile
index ade6c85c4..1e4c8e41b 100644
--- a/Brewfile
+++ b/Brewfile
@@ -1,5 +1,3 @@
 tap "3scale/openresty"
-tap "3scale/opentracing"
 
-brew "3scale/opentracing/openresty", args: ["with-debug"], link: true
 brew "3scale/openresty/luarocks", link: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb441a759..a5ed26d81 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 - Fixed Mutual TLS between APIcast and the Backend API fails when using a Forward Proxy [PR #1499](https://github.com/3scale/APIcast/pull/1499) [THREESCALE-5105](https://issues.redhat.com/browse/THREESCALE-5105)
 - Fixed dns cache miss [PR #1500](https://github.com/3scale/APIcast/pull/1500) [THEESCALE-9301](https://issues.redhat.com/browse/THREESCALE-9301)
 - Fixed APIcast panic when parsing invalid base64 encoded value [PR #1505](https://github.com/3scale/APIcast/pull/1505) [THEESCALE-11435](https://issues.redhat.com/browse/THREESCALE-11435)
+- Fixed Financial-grade API (FAPI) policy not showing up in the admin portal [PR #1528](https://github.com/3scale/APIcast/pull/1528) [THREESCALE-11620](https://issues.redhat.com/browse/THREESCALE-11620)
 
 ### Added
 
diff --git a/Dockerfile b/Dockerfile
index 9719cb222..1537c7c5a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,7 +30,7 @@ RUN dnf install -y 'dnf-command(config-manager)'
 
 RUN yum config-manager --add-repo http://packages.dev.3sca.net/dev_packages_3sca_net.repo
 
-RUN PKGS="openresty-resty-${OPENRESTY_RPM_VERSION} openresty-opentelemetry-${OPENRESTY_RPM_VERSION} openresty-opentracing-${OPENRESTY_RPM_VERSION} openresty-${OPENRESTY_RPM_VERSION} luarocks-${LUAROCKS_VERSION} opentracing-cpp-devel-1.3.0 libopentracing-cpp1-1.3.0 jaegertracing-cpp-client-${JAEGERTRACING_CPP_CLIENT_RPM_VERSION}" && \
+RUN PKGS="openresty-resty-${OPENRESTY_RPM_VERSION} openresty-opentelemetry-${OPENRESTY_RPM_VERSION} openresty-${OPENRESTY_RPM_VERSION} luarocks-${LUAROCKS_VERSION}" && \
     mkdir -p "$HOME" && \
     yum -y --setopt=tsflags=nodocs install $PKGS && \
     rpm -V $PKGS && \
diff --git a/Dockerfile.devel b/Dockerfile.devel
index 6e983b9a8..e992c634a 100644
--- a/Dockerfile.devel
+++ b/Dockerfile.devel
@@ -1,8 +1,9 @@
 FROM registry.access.redhat.com/ubi8:8.5
 
 ARG OPENRESTY_RPM_VERSION="1.21.4-1.el8"
-ARG LUAROCKS_VERSION="2.3.0"
+ARG LUAROCKS_VERSION="3.11.1"
 ARG JAEGERTRACING_CPP_CLIENT_RPM_VERSION="0.3.1-13.el8"
+ARG LUAROVER_VERSION="0.2.1"
 
 WORKDIR /tmp
 
@@ -19,22 +20,19 @@ RUN dnf install -y 'dnf-command(config-manager)'
 
 RUN yum install -y \
         gcc make git which curl iputils bind-utils expat-devel kernel-headers openssl-devel m4 \
-        libyaml libyaml-devel perl-local-lib perl-App-cpanminus
+        libyaml libyaml-devel perl-local-lib perl-App-cpanminus perl-LWP-Protocol-https
 
 # perl-Test-Nginx
 RUN cpanm --notest IPC::Run && \
-    cpanm https://cpan.metacpan.org/authors/id/A/AG/AGENT/Test-Nginx-0.29.tar.gz
+    cpanm https://cpan.metacpan.org/authors/id/A/AG/AGENT/Test-Nginx-0.29.tar.gz && \
+    cpanm https://cpan.metacpan.org/authors/id/O/OA/OALDERS/LWP-Protocol-https-6.14.tar.gz
 
 RUN yum config-manager --add-repo http://packages.dev.3sca.net/dev_packages_3sca_net.repo
 
 RUN yum install -y \
         openresty-${OPENRESTY_RPM_VERSION} \
         openresty-resty-${OPENRESTY_RPM_VERSION} \
-        openresty-opentelemetry-${OPENRESTY_RPM_VERSION} \
-        openresty-opentracing-${OPENRESTY_RPM_VERSION} \
-        opentracing-cpp-devel-1.3.0 \
-        libopentracing-cpp1-1.3.0 \
-        jaegertracing-cpp-client-${JAEGERTRACING_CPP_CLIENT_RPM_VERSION}
+        openresty-opentelemetry-${OPENRESTY_RPM_VERSION}
 
 RUN ln -sf /dev/stdout /usr/local/openresty/nginx/logs/access.log \
     && ln -sf /dev/stderr /usr/local/openresty/nginx/logs/error.log \
@@ -49,16 +47,24 @@ ENV PATH="./lua_modules/bin:/usr/local/openresty/luajit/bin/:${PATH}" \
     LUA_CPATH="./lua_modules/lib/lua/5.1/?.so;/opt/app-root/lua_modules/lib64/lua/5.1/?.so;/opt/app-root/lua_modules/lib64/lua/5.1/?/?.so;;" \
     LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/opt/app-root/lib"
 
-RUN yum install -y luarocks-${LUAROCKS_VERSION} && \
-    luarocks install luaossl 20200709 --tree ${APP_ROOT}/lua_modules CFLAGS="-O2 -fPIC -DHAVE_EVP_KDF_CTX=1" && \
-    luarocks install http --tree ${APP_ROOT}/lua_modules && \
-    luarocks install --server=http://luarocks.org/dev lua-rover && \
-    rover -v && \
-    yum -y remove luarocks && \
-    ln -s /usr/bin/rover /usr/local/openresty/luajit/bin/ && \
-    chmod g+w "${HOME}/.cache" && \
-    rm -rf /var/cache/yum && yum clean all -y && \
-    rm -rf "${HOME}/.cache/luarocks" ./*
+RUN cd /tmp \
+    && curl -fSL https://luarocks.github.io/luarocks/releases/luarocks-${LUAROCKS_VERSION}.tar.gz -o luarocks-${LUAROCKS_VERSION}.tar.gz \
+    && tar xzf luarocks-${LUAROCKS_VERSION}.tar.gz \
+    && cd luarocks-${LUAROCKS_VERSION} \
+    && ./configure \
+        --prefix=/usr/local/openresty/luajit \
+        --with-lua=/usr/local/openresty/luajit \
+        --with-lua-include=/usr/local/openresty/luajit/include/luajit-2.1 \
+    && make build \
+    && make install \
+    && cd /tmp \
+    && rm -rf luarocks-${LUAROCKS_VERSION} luarocks-${LUAROCKS_VERSION}.tar.gz \
+    && curl -fSL https://github.com/3scale/lua-rover/archive/refs/tags/v${LUAROVER_VERSION}.tar.gz -o lua-rover-v${LUAROVER_VERSION}.tar.gz \
+    && tar xzf lua-rover-v${LUAROVER_VERSION}.tar.gz \
+    && cd lua-rover-${LUAROVER_VERSION} \
+    && luarocks make \
+    && yum -y remove luarocks \
+    && rm -rf /var/cache/yum && yum clean all -y 
 
 # Directory with the sources is set as the working directory so all STI scripts
 # can execute relative to this path.
diff --git a/Makefile b/Makefile
index 79fa72cdb..b77767fe0 100644
--- a/Makefile
+++ b/Makefile
@@ -70,7 +70,7 @@ export COMPOSE_PROJECT_NAME
 # * update .circleci/config.yaml openresty executor with the image URL
 .PHONY: dev-build
 dev-build: export OPENRESTY_RPM_VERSION?=1.21.4
-dev-build: export LUAROCKS_VERSION?=2.3.0
+dev-build: export LUAROCKS_VERSION?=3.11.1
 dev-build: IMAGE_NAME ?= apicast-development:latest
 dev-build: ## Build development image
 	$(DOCKER) build --platform linux/amd64 -t $(IMAGE_NAME) \
@@ -165,9 +165,6 @@ gateway-logs: export IMAGE_NAME = does-not-matter
 gateway-logs:
 	$(DOCKER) compose logs gateway
 
-opentracing-gateway: ## run gateway instrumented with opentracing
-	$(DOCKER) compose run opentracing-instrumented-gateway
-
 test-runtime-image: export IMAGE_NAME ?= $(RUNTIME_IMAGE)
 test-runtime-image: clean-containers ## Smoke test the runtime image. Pass any docker image in IMAGE_NAME parameter.
 	$(DOCKER) compose --version
diff --git a/README.md b/README.md
index c3841631a..7cec1733b 100644
--- a/README.md
+++ b/README.md
@@ -59,7 +59,7 @@ oc new-app -f https://raw.githubusercontent.com/3scale/apicast/master/openshift/
 - Performance: it is fast because it's built on top of [NGINX](https://www.nginx.com/) and uses [LuaJIT](https://luajit.org/).
 - Scalability: APIcast is stateless, so it scales horizontally.
 - Request transformation: allows to modify the headers, the path and the arguments of a request.
-- Rate-limit: can apply limits based on a header, [JWT](https://jwt.io/) claims, the IP of the request and many more.
+- Rate-limit: can apply limits based on a header, [JWT](https://datatracker.ietf.org/doc/html/rfc7519) claims, the IP of the request and many more.
 - Modular and extensible: thanks to the APIcast [policies framework](doc/policies.md).
 - Monitoring with [Prometheus](https://prometheus.io/).
 - [NGINX instrumentation](https://github.com/open-telemetry/opentelemetry-cpp-contrib) using [OpenTelemetry](https://opentelemetry.io/). Works with [Jaeger](https://www.jaegertracing.io/).
diff --git a/dev-environments/camel-proxy/Makefile b/dev-environments/camel-proxy/Makefile
index ae88a493b..eae7d89f8 100644
--- a/dev-environments/camel-proxy/Makefile
+++ b/dev-environments/camel-proxy/Makefile
@@ -24,12 +24,12 @@ $(WORKDIR)/cert/keystore.jks: ## use same JVM version as camel-netty-proxy, curr
 	$(DOCKER) run -t --rm \
 		-v $(WORKDIR)/cert:/tmp/cert \
 		--user $(USER):$(GROUP) \
-		openjdk:11.0.9 \
+		registry.access.redhat.com/ubi8/openjdk-11:1.21-1.1733300800 \
 		keytool -genkeypair -keystore /tmp/cert/keystore.jks -dname "CN=tls.camel.proxy" -keypass changeit -storepass changeit -alias camel -keyalg RSA -ext SAN=dns:tls.camel.proxy
 	$(DOCKER) run -t --rm \
 		-v $(WORKDIR)/cert:/tmp/cert \
 		--user $(USER):$(GROUP) \
-		openjdk:11.0.9 \
+		registry.access.redhat.com/ubi8/openjdk-11:1.21-1.1733300800 \
 		keytool -list -v -keystore /tmp/cert/keystore.jks -storepass changeit
 
 .PHONY: certs
diff --git a/dev-environments/camel-proxy/docker-compose.yml b/dev-environments/camel-proxy/docker-compose.yml
index 14674ec1d..a6a932e44 100644
--- a/dev-environments/camel-proxy/docker-compose.yml
+++ b/dev-environments/camel-proxy/docker-compose.yml
@@ -27,12 +27,12 @@ services:
     volumes:
       - ./apicast-config.json:/tmp/config.json
   proxy.socat:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: proxy
     restart: unless-stopped
     command: "-d -v -d TCP-LISTEN:8080,reuseaddr,fork TCP:camel.proxy:8080"
   camel.proxy:
-    image: zregvart/camel-netty-proxy
+    image: quay.io/zregvart/camel-netty-proxy
     container_name: camel.proxy
     expose:
       - "8080:8080"
@@ -50,14 +50,14 @@ services:
     volumes:
       - ./cert/keystore.jks:/tls/keystore.jks
   example.com:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: example.com
-    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:actual.upstream:80"
+    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:actual.upstream:8080"
     expose:
       - "443"
     restart: unless-stopped
   actual.upstream:
-    image: kennethreitz/httpbin
+    image: quay.io/kuadrant/authorino-examples:talker-api
     container_name: actual.upstream
     expose:
-      - "80"
+      - "8080"
diff --git a/dev-environments/grpc/docker-compose.yml b/dev-environments/grpc/docker-compose.yml
index 4156764c7..a4667885c 100644
--- a/dev-environments/grpc/docker-compose.yml
+++ b/dev-environments/grpc/docker-compose.yml
@@ -28,7 +28,7 @@ services:
       - ./apicast-config.json:/tmp/config.json
       - ./gateway-cert:/var/run/secrets/apicast
   one.upstream:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: one.upstream
     command: "-v openssl-listen:443,reuseaddr,fork,cert=/etc/pki/upstream.example.com.pem,verify=0,openssl-max-proto-version=TLS1.3 ssl:two.upstream:8005,verify=0"
     expose:
@@ -37,6 +37,8 @@ services:
     volumes:
       - ./upstream-cert/upstream.example.com.pem:/etc/pki/upstream.example.com.pem
   two.upstream:
-    image: kalmhq/echoserver
+    container_name: two.upstream
+    build:
+      dockerfile: ./echoserver.Dockerfile
     expose:
       - "8005"
diff --git a/dev-environments/grpc/echoserver.Dockerfile b/dev-environments/grpc/echoserver.Dockerfile
new file mode 100644
index 000000000..751501bed
--- /dev/null
+++ b/dev-environments/grpc/echoserver.Dockerfile
@@ -0,0 +1,23 @@
+FROM registry.access.redhat.com/ubi8/go-toolset:1.13.4 as builder
+
+WORKDIR /workspace
+
+RUN cd /tmp \
+    && curl -fSL https://github.com/kalmhq/echoserver/archive/refs/tags/v0.1.1.tar.gz -o echoserver-v0.1.1.tar.gz \
+    && tar xzf echoserver-v0.1.1.tar.gz \
+    && cd echoserver-0.1.1 \
+    && go mod download \
+    && GOOS=linux GOARCH=amd64 go build -ldflags "-s -w" -o server . \
+    && cp server /workspace \
+    && cp default.key /workspace \
+    && cp default.pem /workspace
+
+FROM mirror.gcr.io/library/alpine
+RUN apk update && apk add --no-cache curl
+WORKDIR /workspace
+# Collect binaries and assets
+RUN mkdir /lib64 && ln -s /lib/libc.musl-x86_64.so.1 /lib64/ld-linux-x86-64.so.2
+COPY --from=builder /workspace/server .
+COPY --from=builder /workspace/default.key .
+COPY --from=builder /workspace/default.pem .
+CMD /workspace/server
diff --git a/dev-environments/http-proxy-plain-http-upstream/docker-compose.yml b/dev-environments/http-proxy-plain-http-upstream/docker-compose.yml
index c74a32a59..f7b311a51 100644
--- a/dev-environments/http-proxy-plain-http-upstream/docker-compose.yml
+++ b/dev-environments/http-proxy-plain-http-upstream/docker-compose.yml
@@ -26,7 +26,7 @@ services:
     volumes:
       - ./apicast-config.json:/tmp/config.json
   proxy:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: proxy
     command: "-d -v -d TCP-LISTEN:8080,reuseaddr,fork TCP:actual.proxy:443"
     expose:
@@ -42,13 +42,13 @@ services:
     volumes:
       - ./tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf
   example.com:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: example.com
-    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:80"
+    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:8080"
     expose:
       - "443"
     restart: unless-stopped
   two.upstream:
-    image: kennethreitz/httpbin
+    image: quay.io/kuadrant/authorino-examples:talker-api
     expose:
-      - "80"
+      - "8080"
diff --git a/dev-environments/http-proxy-plain-http-upstream/tinyproxy.Dockerfile b/dev-environments/http-proxy-plain-http-upstream/tinyproxy.Dockerfile
index ce848c62f..b5cb61709 100644
--- a/dev-environments/http-proxy-plain-http-upstream/tinyproxy.Dockerfile
+++ b/dev-environments/http-proxy-plain-http-upstream/tinyproxy.Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3
+FROM mirror.gcr.io/library/alpine:3
 
 LABEL summary="Forward proxy based on tinyproxy for development purposes" \
       description="Forward proxy based on tinyproxy for development purposes" \
diff --git a/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml b/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml
index af418aca1..25a49c528 100644
--- a/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml
+++ b/dev-environments/https-proxy-upstream-tlsv1.3/docker-compose.yml
@@ -33,15 +33,15 @@ services:
     volumes:
       - ./tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf
   example.com:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: example.com
-    command: "-v openssl-listen:443,reuseaddr,fork,cert=/etc/pki/example.com.pem,verify=0,openssl-min-proto-version=TLS1.3,openssl-max-proto-version=TLS1.3 TCP:two.upstream:80"
+    command: "-v openssl-listen:443,reuseaddr,fork,cert=/etc/pki/example.com.pem,verify=0,openssl-min-proto-version=TLS1.3,openssl-max-proto-version=TLS1.3 TCP:two.upstream:8080"
     expose:
       - "443"
     restart: unless-stopped
     volumes:
       - ./cert/example.com.pem:/etc/pki/example.com.pem
   two.upstream:
-    image: kennethreitz/httpbin
+    image: quay.io/kuadrant/authorino-examples:talker-api
     expose:
-      - "80"
+      - "8080"
diff --git a/dev-environments/https-proxy-upstream-tlsv1.3/tinyproxy.Dockerfile b/dev-environments/https-proxy-upstream-tlsv1.3/tinyproxy.Dockerfile
index ce848c62f..b5cb61709 100644
--- a/dev-environments/https-proxy-upstream-tlsv1.3/tinyproxy.Dockerfile
+++ b/dev-environments/https-proxy-upstream-tlsv1.3/tinyproxy.Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3
+FROM mirror.gcr.io/library/alpine:3
 
 LABEL summary="Forward proxy based on tinyproxy for development purposes" \
       description="Forward proxy based on tinyproxy for development purposes" \
diff --git a/dev-environments/keycloak-env/docker-compose.yml b/dev-environments/keycloak-env/docker-compose.yml
index b43318662..3af7e33fa 100644
--- a/dev-environments/keycloak-env/docker-compose.yml
+++ b/dev-environments/keycloak-env/docker-compose.yml
@@ -25,16 +25,16 @@ services:
     volumes:
       - ./apicast-config.json:/tmp/config.json
   example.com:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: example.com
-    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:80"
+    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:8080"
     expose:
       - "80"
     restart: unless-stopped
   two.upstream:
-    image: kennethreitz/httpbin
+    image: quay.io/kuadrant/authorino-examples:talker-api
     expose:
-      - "80"
+      - "8080"
   keycloak:
     image: quay.io/keycloak/keycloak:23.0.4
     container_name: keycloak
diff --git a/dev-environments/listen-tls/docker-compose.yml b/dev-environments/listen-tls/docker-compose.yml
index 6d89464fa..476ca81f6 100644
--- a/dev-environments/listen-tls/docker-compose.yml
+++ b/dev-environments/listen-tls/docker-compose.yml
@@ -28,13 +28,13 @@ services:
       - ./apicast-config.json:/tmp/config.json
       - ./cert:/var/run/secrets/apicast
   one.upstream:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: one.upstream
-    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:80"
+    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:8080"
     expose:
       - "80"
     restart: unless-stopped
   two.upstream:
-    image: kennethreitz/httpbin
+    image: quay.io/kuadrant/authorino-examples:talker-api
     expose:
-      - "80"
+      - "8080"
diff --git a/dev-environments/opentelemetry-instrumented-gateway/docker-compose.yml b/dev-environments/opentelemetry-instrumented-gateway/docker-compose.yml
index 15e5fb42a..e3cada328 100644
--- a/dev-environments/opentelemetry-instrumented-gateway/docker-compose.yml
+++ b/dev-environments/opentelemetry-instrumented-gateway/docker-compose.yml
@@ -28,18 +28,18 @@ services:
       - ./apicast-config.json:/tmp/config.json
       - ./otel.toml:/opt/app-root/src/tracing-configs/otel.toml
   example.com:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: example.com
-    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:80"
+    command: "-d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:8080"
     expose:
       - "80"
     restart: unless-stopped
   two.upstream:
-    image: kennethreitz/httpbin
+    image: quay.io/kuadrant/authorino-examples:talker-api
     expose:
-      - "80"
+      - "8080"
   jaeger:
-    image: jaegertracing/all-in-one:latest
+    image: quay.io/ducna/jaegertracing/all-in-one:1.60
     environment:
       JAEGER_DISABLED: "false"
       COLLECTOR_OTLP_ENABLED: "true"
diff --git a/dev-environments/plain-http-upstream/docker-compose.yml b/dev-environments/plain-http-upstream/docker-compose.yml
index 97c31805d..ebf84ebc8 100644
--- a/dev-environments/plain-http-upstream/docker-compose.yml
+++ b/dev-environments/plain-http-upstream/docker-compose.yml
@@ -24,7 +24,7 @@ services:
     volumes:
       - ./apicast-config.json:/tmp/config.json
   example.com:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: example.com
     command: "-d -d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:two.upstream:3000"
     expose:
@@ -37,7 +37,7 @@ services:
     expose:
       - "3000"
   backend:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: backend
     command: "-d -d -v -d TCP-LISTEN:80,reuseaddr,fork TCP:3scale.backend:3000"
     expose:
diff --git a/dev-environments/upstream-tlsv1.3/docker-compose.yml b/dev-environments/upstream-tlsv1.3/docker-compose.yml
index 5daf958f5..2f38cbd62 100644
--- a/dev-environments/upstream-tlsv1.3/docker-compose.yml
+++ b/dev-environments/upstream-tlsv1.3/docker-compose.yml
@@ -24,15 +24,15 @@ services:
     volumes:
       - ./apicast-config.json:/tmp/config.json
   example.com:
-    image: alpine/socat:1.7.4.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: example.com
-    command: "-v openssl-listen:443,reuseaddr,fork,cert=/etc/pki/example.com.pem,verify=0,openssl-min-proto-version=TLS1.3,openssl-max-proto-version=TLS1.3 TCP:two.upstream:80"
+    command: "-v openssl-listen:443,reuseaddr,fork,cert=/etc/pki/example.com.pem,verify=0,openssl-min-proto-version=TLS1.3,openssl-max-proto-version=TLS1.3 TCP:two.upstream:8080"
     expose:
       - "443"
     restart: unless-stopped
     volumes:
       - ./cert/example.com.pem:/etc/pki/example.com.pem
   two.upstream:
-    image: kennethreitz/httpbin
+    image: quay.io/kuadrant/authorino-examples:talker-api
     expose:
-      - "80"
+      - "8080"
diff --git a/doc/parameters.md b/doc/parameters.md
index ab1e0f4fe..1a7e82314 100644
--- a/doc/parameters.md
+++ b/doc/parameters.md
@@ -345,37 +345,6 @@ When `THREESCALE_PORTAL_ENDPOINT` environment variable is provided, the gateway
 
 It is **required** to provide either `THREESCALE_PORTAL_ENDPOINT` or `THREESCALE_CONFIG_FILE` (takes precedence) for the gateway to run successfully.
 
-
-### `OPENTRACING_TRACER`
-
-**Deprecated:** Check out [OPENTELEMETRY](#opentelemetry) configuration instead.
-**Example:** `jaeger`
-
-This environment variable controls which tracing library will be loaded, right now, there's only one opentracing tracer available, `jaeger`.
-
-If empty, opentracing support will be disabled.
-
-
-### `OPENTRACING_CONFIG`
-
-**Deprecated:** Check out [OPENTELEMETRY](#opentelemetry) configuration instead.
-
-This environment variable is used to determine the config file for the opentracing tracer, if `OPENTRACING_TRACER` is not set, this variable will be ignored.
-
-Each tracer has a default configuration file:
-    * `jaeger`: `conf.d/opentracing/jaeger.example.json`
-
-You can choose to mount a different configuration than the provided by default by setting the file path using this variable.
-
-**Example:** `/tmp/jaeger/jaeger.json`
-
-### `OPENTRACING_FORWARD_HEADER`
-
-**Deprecated:** Check out [OPENTELEMETRY](#opentelemetry) configuration instead.
-**Default:** `uber-trace-id`
-
-This environment variable controls the HTTP header used for forwarding opentracing information, this HTTP header will be forwarded to upstream servers.
-
 ### `APICAST_HTTPS_PORT`
 
 **Default:** no value
diff --git a/docker-compose-devel.yml b/docker-compose-devel.yml
index 6e1185605..81ceada0f 100644
--- a/docker-compose-devel.yml
+++ b/docker-compose-devel.yml
@@ -22,4 +22,4 @@ services:
       GIT_COMMITTER_NAME: ${GIT_COMMITTER_NAME:-${USER}}
       GIT_COMMITTER_EMAIL: ${GIT_COMMITTER_EMAIL:-""}
   redis:
-    image: redis
+    image: mirror.gcr.io/library/redis
diff --git a/docker-compose.benchmark.yml b/docker-compose.benchmark.yml
index 0f54d3106..9441d0403 100644
--- a/docker-compose.benchmark.yml
+++ b/docker-compose.benchmark.yml
@@ -10,7 +10,7 @@ services:
     cpuset: "0"
     cpu_count: 1
   wrk:
-    image: skandyla/wrk
+    image: quay.io/skupper/wrk
     environment:
       - WRK_REPORT=/tmp/wrk/${WRK_REPORT:-report.csv}
     depends_on:
@@ -23,7 +23,7 @@ services:
     command: "--script /tmp/wrk/report.lua --threads ${THREADS:-10} --connections ${CONNECTIONS:-100} --duration ${DURATION:-60} -H 'Host: localhost' http://apicast:8080/echo?user_key=foo"
 
   curl:
-    image: byrnedo/alpine-curl
+    image: quay.io/curl/curl
     links:
       - apicast
     depends_on:
diff --git a/docker-compose.prove.yml b/docker-compose.prove.yml
index 0afb77d32..f7b3c7475 100644
--- a/docker-compose.prove.yml
+++ b/docker-compose.prove.yml
@@ -10,4 +10,4 @@ services:
     depends_on:
       - redis
   redis:
-    image: redis
+    image: mirror.gcr.io/library/redis
diff --git a/docker-compose.yml b/docker-compose.yml
index 300f8c93f..4a553c412 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -45,34 +45,12 @@ services:
     dns_search:
       - example.com
   redis:
-    image: redis
+    image: mirror.gcr.io/library/redis
   keycloak:
-    image: jboss/keycloak:3.1.0.Final
+    image: quay.io/keycloak/keycloak:23.0.4
     environment:
-      KEYCLOAK_USER: keycloak
-      KEYCLOAK_PASSWORD: keycloak
+      KEYCLOAK_ADMIN: keycloak
+      KEYCLOAK_ADMIN_PASSWORD: keycloak
       KEYCLOAK_LOGLEVEL: INFO
     ports:
       - "8080"
-  opentracing-instrumented-gateway:
-    image: ${IMAGE_NAME:-apicast-test}
-    depends_on:
-    - jaeger
-    environment:
-      THREESCALE_CONFIG_FILE: /tmp/config.json
-      THREESCALE_DEPLOYMENT_ENV: staging
-      APICAST_CONFIGURATION_LOADER: lazy
-      APICAST_LOG_LEVEL: debug
-      APICAST_CONFIGURATION_CACHE: "0"
-      OPENTRACING_TRACER: jaeger
-      OPENTRACING_CONFIG: /opt/app-root/src/tracing-configs/tracing-config-jaeger-jaeger-config.json
-    volumes:
-      - ./examples/opentracing/apicast-config.json:/tmp/config.json
-      - ./examples/opentracing/jaeger-config.json:/opt/app-root/src/tracing-configs/tracing-config-jaeger-jaeger-config.json
-  jaeger:
-    image: jaegertracing/all-in-one:latest
-    environment:
-      JAEGER_DISABLED: "false"
-      COLLECTOR_OTLP_ENABLED: "true"
-    ports:
-      - 16686:16686
diff --git a/examples/configuration/standalone.yml b/examples/configuration/standalone.yml
index 5961a20c4..4dc284245 100644
--- a/examples/configuration/standalone.yml
+++ b/examples/configuration/standalone.yml
@@ -2,7 +2,6 @@ global:
   log_level: debug
   error_log: stderr
   access_log: stdout
-  opentracing_tracer: jaeger
   upstream:
     load_balancer: least_conn
     retry: 5xx
diff --git a/gateway/conf.d/opentracing/jaeger.conf.liquid b/gateway/conf.d/opentracing/jaeger.conf.liquid
deleted file mode 100644
index 351e0d404..000000000
--- a/gateway/conf.d/opentracing/jaeger.conf.liquid
+++ /dev/null
@@ -1,12 +0,0 @@
-opentracing on;
-
-{% if opentracing_config == nil or opentracing_config == empty %}
-    {% assign opentracing_config = "conf.d/opentracing/jaeger.example.json" | filesystem | first%}
-{% endif %}
-
-{% if platform == "OSX" %}
-    opentracing_load_tracer libjaegertracing.dylib {{ opentracing_config }};
-{% else %}
-    opentracing_load_tracer libjaegertracing.so {{ opentracing_config }};
-{% endif %}
-
diff --git a/gateway/conf.d/opentracing/jaeger.example.json b/gateway/conf.d/opentracing/jaeger.example.json
deleted file mode 100644
index 3b4efc724..000000000
--- a/gateway/conf.d/opentracing/jaeger.example.json
+++ /dev/null
@@ -1,25 +0,0 @@
- {
-    "service_name": "apicast",
-    "disabled": false,
-    "sampler": {
-      "type": "const",
-      "param": 1
-    },
-    "reporter": {
-      "queueSize": 100,
-      "bufferFlushInterval": 10,
-      "logSpans": false,
-      "localAgentHostPort": "127.0.0.1:6831"
-    },
-    "headers": {
-      "jaegerDebugHeader": "debug-id",
-      "jaegerBaggageHeader": "baggage",
-      "TraceContextHeaderName": "uber-trace-id",
-      "traceBaggageHeaderPrefix": "testctx-"
-    },
-    "baggage_restrictions": {
-        "denyBaggageOnInitializationFailure": false,
-        "hostPort": "127.0.0.1:5778",
-        "refreshInterval": 60
-    }
- }
diff --git a/gateway/conf/nginx.conf.liquid b/gateway/conf/nginx.conf.liquid
index 87fda8569..2ad5bcf9a 100644
--- a/gateway/conf/nginx.conf.liquid
+++ b/gateway/conf/nginx.conf.liquid
@@ -5,11 +5,7 @@ env RESOLVER;
 env BACKEND_ENDPOINT_OVERRIDE;
 env OPENSSL_VERIFY;
 
-{% if opentracing_tracer != empty %}
-  {% for file in "modules/ngx_http_opentracing_module.so" | filesystem %}
-load_module {{file}};
-  {% endfor %}
-{% elsif opentelemetry != empty %}
+{% if opentelemetry != empty %}
   {% for file in "modules/otel_ngx_module.so" | filesystem %}
 load_module {{file}};
   {% endfor %}
@@ -80,11 +76,6 @@ http {
     ## end {{ file }}
   {% endfor %}
 
-  {% if opentracing_tracer != empty %}
-    {%- capture tracer_conf %}conf.d/opentracing/{{ opentracing_tracer }}.conf.liquid{%- endcapture -%}
-    {% include tracer_conf %}
-  {% endif %}
-
   {% if opentelemetry != empty %}
     {%- capture otel_conf %}conf.d/opentelemetry/otel.conf.liquid{%- endcapture -%}
     {% include otel_conf %}
diff --git a/gateway/http.d/apicast.conf.liquid b/gateway/http.d/apicast.conf.liquid
index 3a76f9c09..e22832821 100644
--- a/gateway/http.d/apicast.conf.liquid
+++ b/gateway/http.d/apicast.conf.liquid
@@ -28,11 +28,6 @@ server {
   listen {{ port.management | default: 8090 }};
   server_name {{ server_name.management | default: 'management _' }};
 
-  {% if opentracing_tracer != empty %}
-  opentracing_operation_name "apicast_management";
-  opentracing_trace_locations off;
-  {% endif %}
-
   {% if opentelemetry != empty %}
   opentelemetry_operation_name apicast_management;
   {% endif %}
@@ -44,11 +39,6 @@ server {
   listen {{ port.backend | default: 8081 }};
   server_name backend;
 
-  {% if opentracing_tracer != empty %}
-  opentracing_operation_name "apicast_mockbackend";
-  opentracing_trace_locations off;
-  {% endif %}
-
   {% if opentelemetry != empty %}
   opentelemetry_operation_name apicast_mockbackend;
   {% endif %}
@@ -65,11 +55,6 @@ server {
   listen {{ port.echo | default: 8081 }} default_server;
   server_name echo _;
 
-  {% if opentracing_tracer != empty %}
-  opentracing_operation_name "apicast_echo";
-  opentracing_trace_locations off;
-  {% endif %}
-
   {% if opentelemetry != empty %}
   opentelemetry_operation_name apicast_echo;
   {% endif %}
@@ -121,12 +106,6 @@ server {
       keepalive_timeout {{ http_keepalive_timeout}};
   {% endif %}
 
-  {% if opentracing_tracer != empty %}
-  opentracing_operation_name "apicast";
-  opentracing_trace_locations on;
-  opentracing_tag original_request_uri $original_request_uri;
-  {% endif %}
-
   {% if opentelemetry != empty %}
   opentelemetry_operation_name apicast;
   opentelemetry_attribute original_request_uri $original_request_uri;
diff --git a/gateway/src/apicast/cli/environment.lua b/gateway/src/apicast/cli/environment.lua
index 4b201f28a..95de38cb4 100644
--- a/gateway/src/apicast/cli/environment.lua
+++ b/gateway/src/apicast/cli/environment.lua
@@ -100,16 +100,6 @@ local function env_value_ref(name)
     return setmetatable({ name = name }, env_value_mt)
 end
 
-local function read_opentracing_tracer(varname)
-    local opentracing_tracer = env_value_ref(varname)
-
-    if tostring(opentracing_tracer) ~= nil then
-        ngx.log(ngx.WARN, 'opentracing use is DEPRECATED. Use Opentelemetry instead with OPENTELEMETRY env var')
-    end
-
-    return opentracing_tracer
-end
-
 local _M = {}
 ---
 -- @field default_environment Default environment name.
@@ -122,9 +112,6 @@ _M.default_environment = 'production'
 -- @tfield ?string proxy_ssl_certificate_key path to SSL certificate key
 -- @tfield ?string proxy_ssl_session_reuse whether SSL sessions can be reused
 -- @tfield ?string proxy_ssl_password_file path to a file with passphrases for the certificate keys
--- @tfield ?string opentracing_tracer loads an opentracing tracer library, for example: jaeger
--- @tfield ?string opentracing_config opentracing config file to load
--- @tfield ?string opentracing_forward_header opentracing http header to forward upstream
 -- @tfield ?string opentelemetry enables server instrumentation using opentelemetry SDKs
 -- @tfield ?string opentelemetry_config_file opentelemetry config file to load
 -- @tfield ?string upstream_retry_cases error cases where the call to the upstream should be retried
@@ -142,9 +129,6 @@ _M.default_config = {
     proxy_ssl_session_reuse = env_value_ref('APICAST_PROXY_HTTPS_SESSION_REUSE'),
     proxy_ssl_password_file = env_value_ref('APICAST_PROXY_HTTPS_PASSWORD_FILE'),
     proxy_ssl_verify = resty_env.enabled('OPENSSL_VERIFY'),
-    opentracing_tracer = read_opentracing_tracer('OPENTRACING_TRACER'),
-    opentracing_config = env_value_ref('OPENTRACING_CONFIG'),
-    opentracing_forward_header = env_value_ref('OPENTRACING_FORWARD_HEADER'),
     opentelemetry = env_value_ref('OPENTELEMETRY'),
     opentelemetry_config_file = env_value_ref('OPENTELEMETRY_CONFIG'),
     upstream_retry_cases = env_value_ref('APICAST_UPSTREAM_RETRY_CASES'),
diff --git a/gateway/src/apicast/policy/fapi/apicast-config.json b/gateway/src/apicast/policy/fapi/apicast-policy.json
similarity index 100%
rename from gateway/src/apicast/policy/fapi/apicast-config.json
rename to gateway/src/apicast/policy/fapi/apicast-policy.json
diff --git a/gateway/src/apicast/policy/token_introspection/README.md b/gateway/src/apicast/policy/token_introspection/README.md
index 329a1c701..a0ad0cc11 100644
--- a/gateway/src/apicast/policy/token_introspection/README.md
+++ b/gateway/src/apicast/policy/token_introspection/README.md
@@ -51,7 +51,8 @@ The policy enables caching of the tokens to avoid calling the Token Introspectio
     "client_id": "myclient",
     "client_secret": "mysecret",
     "introspection_url": "http://red_hat_single_sign-on/token/introspection",
-    "client_jwt_assertion_audience": "http://red_hat_single_sign-on/auth/realms/basic"
+    "client_jwt_assertion_audience": "http://red_hat_single_sign-on/auth/realms/basic",
+    "client_jwt_assertion_expires_in": 60
   }
 }
 ```
@@ -64,10 +65,11 @@ The policy enables caching of the tokens to avoid calling the Token Introspectio
   "configuration": {
     "auth_type": "private_key_jwt",
     "client_id": "myclient",
-    "client_secret": "mysecret",
-    "introspection_url": "http://red_hat_single_sign-on/token/introspection"
+    "introspection_url": "http://red_hat_single_sign-on/token/introspection",
+    "client_jwt_assertion_audience": "http://red_hat_single_sign-on/auth/realms/basic",
+    "client_jwt_assertion_expires_in": 60,
     "certificate_type": "embedded",
-    "certificate": "data:application/x-x509-ca-cert;name=rsa.pem;base64,XXXXXXXXXxx",
+    "certificate": "data:application/x-x509-ca-cert;name=rsa.pem;base64,XXXXXXXXX"
   }
 }
 ```
diff --git a/script/install/openresty.sh b/script/install/openresty.sh
index 79681c032..4b43651c7 100755
--- a/script/install/openresty.sh
+++ b/script/install/openresty.sh
@@ -18,11 +18,7 @@ yum -y install \
     openresty-resty-${OPENRESTY_RPM_VERSION} \
     openresty-debuginfo-${OPENRESTY_RPM_VERSION} \
     openresty-debugsource-${OPENRESTY_RPM_VERSION} \
-    openresty-opentelemetry-${OPENRESTY_RPM_VERSION} \
-    openresty-opentracing-${OPENRESTY_RPM_VERSION} \
-    opentracing-cpp-devel-1.3.0 \
-    libopentracing-cpp1-1.3.0 \
-    jaegertracing-cpp-client-${JAEGERTRACING_CPP_CLIENT_RPM_VERSION}\
+    openresty-opentelemetry-${OPENRESTY_RPM_VERSION}
 
 export PATH="./lua_modules/bin:/usr/local/openresty/luajit/bin/:${PATH}"
 export LUA_PATH="./lua_modules/share/lua/5.1/?.lua;./lua_modules/share/lua/5.1/?/init.lua;/usr/lib64/lua/5.1/?.lua;/usr/share/lua/5.1/?.lua;/opt/app-root/lua_modules/share/lua/5.1/?.lua;/opt/app-root/lua_modules/share/lua/5.1/?/?.lua"
diff --git a/spec/policy/fapi/fapi_spec.lua b/spec/policy/fapi/fapi_spec.lua
index 6e91f39ba..e65ad4bfb 100644
--- a/spec/policy/fapi/fapi_spec.lua
+++ b/spec/policy/fapi/fapi_spec.lua
@@ -92,6 +92,7 @@ end)
 
 describe('fapi_1 advance profile', function()
   local context = {}
+  local ngx_req_headers = {}
   before_each(function()
     context = {
       jwt = {},
@@ -104,6 +105,8 @@ describe('fapi_1 advance profile', function()
     }
 
     ngx.header = {}
+    ngx_req_headers = {}
+    stub(ngx.req, 'get_headers', function() return ngx_req_headers end)
     stub(ngx, 'print')
     stub(ngx, 'exit')
     context.jwt = {}
diff --git a/spec/resty/concurrent/timer_pool_executor_spec.lua b/spec/resty/concurrent/timer_pool_executor_spec.lua
index f45694ebf..621e6a6da 100644
--- a/spec/resty/concurrent/timer_pool_executor_spec.lua
+++ b/spec/resty/concurrent/timer_pool_executor_spec.lua
@@ -6,7 +6,8 @@ local noop = function() end
 
 describe('TimerPoolExecutor', function()
     describe('worker garbage collection', function()
-        it('automatically checks in back old workers', function()
+        --- Flaky test so mark it for now
+        pending('automatically checks in back old workers', function()
             local pool = TimerPoolExecutor.new({ max_timers = 1 })
 
             assert(pool:post(noop):wait(timeout))
@@ -15,7 +16,7 @@ describe('TimerPoolExecutor', function()
             assert(pool:post(noop):wait(timeout))
         end)
 
-        it('puts back worker even when task crashes', function ()
+        pending('puts back worker even when task crashes', function ()
             local pool = TimerPoolExecutor.new({ max_timers = 1 })
 
             assert(pool:post(error, 'message'):wait(timeout))
diff --git a/t/opentracing.t b/t/opentracing.t
deleted file mode 100644
index 9793c77e2..000000000
--- a/t/opentracing.t
+++ /dev/null
@@ -1,141 +0,0 @@
-use lib 't';
-use Test::APIcast::Blackbox 'no_plan';
-
-$ENV{OPENTRACING_TRACER} ||= 'jaeger';
-
-repeat_each(1);
-run_tests();
-
-
-__DATA__
-=== TEST 1: OpenTracing
-Request passing through APIcast should publish OpenTracing info.
---- configuration
-    {
-        "services": [
-        {
-            "proxy": {
-            "policy_chain": [
-            { "name": "apicast.policy.upstream",
-                "configuration":
-                {
-                    "rules": [ { "regex": "/", "url": "http://echo" } ]
-                }
-            }
-            ]
-        }
-        }
-        ]
-    }
---- request
-GET /a_path?
---- response_body eval
-qr/uber-trace-id: /
---- error_code: 200
---- no_error_log
-[error]
---- udp_listen: 6831
---- udp_reply
---- udp_query eval
-qr/jaeger.version/
---- wait: 10
-
-=== TEST 2: OpenTracing forward header
-Opentracing forward header is send to the upstream.
---- env eval
-(
-    'OPENTRACING_FORWARD_HEADER' => "foobar"
-)
---- configuration
-{
-  "services": [
-    {
-      "id": 42,
-      "system_name": "foo",
-      "proxy": {
-        "policy_chain": [
-          {
-            "name": "apicast.policy.upstream",
-            "configuration": {
-              "rules": [
-                {
-                  "regex": "/",
-                  "url": "http://test:$TEST_NGINX_SERVER_PORT"
-                }
-              ]
-            }
-          }
-        ]
-      }
-    }
-  ]
-}
---- upstream
-  location / {
-    content_by_lua_block {
-      local headers  = ngx.req.get_headers()
-      assert(headers["foobar"] == "value")
-    }
-  }
---- request
-GET /a_path?
---- more_headers eval
-"foobar: value"
---- error_code: 200
---- no_error_log
-[error]
---- udp_listen: 6831
---- udp_reply
---- udp_query eval
-qr/jaeger.version/
---- wait: 10
-
-=== TEST 3: original_request_uri tag
-Opentracing custom tag fix for THREESCALE-5669
--- env eval
-(
-    'OPENTRACING_FORWARD_HEADER' => "foobar"
-)
---- configuration
-{
-  "services": [
-    {
-      "id": 42,
-      "system_name": "foo",
-      "proxy": {
-        "policy_chain": [
-          {
-            "name": "apicast.policy.upstream",
-            "configuration": {
-              "rules": [
-                {
-                  "regex": "/",
-                  "url": "http://test:$TEST_NGINX_SERVER_PORT"
-                }
-              ]
-            }
-          }
-        ]
-      }
-    }
-  ]
-}
---- upstream
-  location / {
-    content_by_lua_block {
-      local headers  = ngx.req.get_headers()
-      assert(headers["foobar"] == "value")
-    }
-  }
---- request
-GET /a_path?
---- more_headers eval
-"foobar: value"
---- error_code: 200
---- no_error_log
-[error]
---- udp_listen: 6831
---- udp_reply
---- udp_query eval
-qr/original_request_uri/
---- wait: 10