v1.4 docs

site/content/en/latest/api/gateway_api/backendtlspolicy.md

@@ -14,7 +14,7 @@ of the connection from the Gateway to a backend pod/s via the Service API object
 
 `BackendTLSPolicy` specifically addresses the configuration of TLS in order to convey HTTPS from the Gateway
 dataplane to the backend.  This is referred to as "backend TLS termination" and enables the Gateway to know
-how to connect to a backend pod that has its own certificate.  
+how to connect to a backend pod that has its own certificate.
 
 While there are other API objects provided for TLS to be configured for **passthrough** and **edge** termination,
 this API object allows users to specifically configure **backend** TLS termination.  For more information on TLS
@@ -25,7 +25,7 @@ configuration in Gateway API, see [TLS Configuration](https://gateway-api.sigs.k
 BackendTLSPolicy is a Direct [PolicyAttachment](https://gateway-api.sigs.k8s.io/reference/policy-attachment/) without defaults or overrides,
 applied to a Service that accesses a backend, where the BackendTLSPolicy resides in the same namespace as the
 Service to which it is applied. The BackendTLSPolicy and the Service must reside in the same namespace in order
-to prevent the complications involved with sharing trust across namespace boundaries.  
+to prevent the complications involved with sharing trust across namespace boundaries.
 
 All Gateway API Routes that point to a referenced Service should respect a configured BackendTLSPolicy.
 
@@ -137,10 +137,10 @@ Status defines the observed state of the BackendTLSPolicy and is not user-config
 way you do for other Gateway API objects to verify correct operation.  Note that the status in BackendTLSPolicy
 uses `PolicyAncestorStatus` to allow you to know which parentReference set that particular status.
 
-[backendtlspolicy]: https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicy
-[validation]: https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicy.Validation
-[caCertificateRefs]: https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicyValidation.CACertificateRefs
-[wellKnownCACertificates]: https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicyValidation.WellKnownCACertificates
-[hostname]: https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.PreciseHostname
+[backendtlspolicy]: https://gateway-api.sigs.k8s.io/references/spec#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicy
+[validation]: https://gateway-api.sigs.k8s.io/references/spec#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicy.Validation
+[caCertificateRefs]: https://gateway-api.sigs.k8s.io/references/spec#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicyValidation.CACertificateRefs
+[wellKnownCACertificates]: https://gateway-api.sigs.k8s.io/references/spec#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicyValidation.WellKnownCACertificates
+[hostname]: https://gateway-api.sigs.k8s.io/references/spec#gateway.networking.k8s.io/v1.PreciseHostname
 [rfc-3986]: https://tools.ietf.org/html/rfc3986
-[targetRefs]: https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1alpha2.PolicyTargetReference
+[targetRefs]: https://gateway-api.sigs.k8s.io/references/spec#gateway.networking.k8s.io/v1alpha2.PolicyTargetReference

site/content/en/latest/api/gateway_api/gatewayclass.md

@@ -2,7 +2,7 @@
 title = "GatewayClass"
 +++
 
-    
+
     The `GatewayClass` resource is GA and has been part of the Standard Channel since
     `v0.5.0`. For more information on release channels, refer to our [versioning
     guide](https://gateway-api.sigs.k8s.io/concepts/versioning).
@@ -142,5 +142,5 @@ example.net/gateway/v2.1 // Use version 2.1
 example.net/gateway      // Use the default version
 ```
 
-[gatewayclass]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.GatewayClass
+[gatewayclass]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.GatewayClass
 [ingress-class-api]: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class

site/content/en/latest/api/gateway_api/grpcroute.md

@@ -368,12 +368,12 @@ Multiple GRPCRoutes can be attached to a single Gateway resource. Importantly,
 only one Route rule may match each request. For more information on how conflict
 resolution applies to merging, refer to the [API specification][grpcrouterule].
 
-[grpcroute]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.GRPCRoute
-[grpcrouterule]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.GRPCRouteRule
-[hostname]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Hostname
+[grpcroute]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.GRPCRoute
+[grpcrouterule]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.GRPCRouteRule
+[hostname]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.Hostname
 [rfc-3986]: https://tools.ietf.org/html/rfc3986
-[matches]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.GRPCRouteMatch
-[filters]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.GRPCRouteFilter
-[backendRef]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.GRPCBackendRef
-[parentRef]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.ParentRef
-[name]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.SectionName
+[matches]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.GRPCRouteMatch
+[filters]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.GRPCRouteFilter
+[backendRef]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.GRPCBackendRef
+[parentRef]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.ParentRef
+[name]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.SectionName

site/content/en/latest/api/gateway_api/httproute.md

@@ -232,9 +232,16 @@ unspecified, the rule performs no forwarding. If unspecified and no filters
 are specified that would result in a response being sent, a 404 error code
 is returned.
 
-The following example forwards HTTP requests for prefix `/bar` to service
-"my-service1" on port `8080` and HTTP requests for prefix `/some/thing` with
-header `magic: foo` to service "my-service2" on port `8080`:
+The following example forwards HTTP requests for path prefix `/bar` to service
+"my-service1" on port `8080`, and HTTP requests fulfilling _all_ four of the
+following criteria
+
+- header `magic: foo`
+- query param `great: example`
+- path prefix `/some/thing`
+- method `GET`
+
+to service "my-service2" on port `8080`:
 ```yaml
 #$ Used in:
 #$ - site-src/api-types/httproute.md
@@ -343,7 +350,7 @@ There are 2 kinds of timeouts that can be configured in an HTTPRoute Rule:
 
 Because the `request` timeout encompasses the `backendRequest` timeout, the value of `backendRequest` must not be greater than the value of `request` timeout.
 
-Timeouts are optional, and their fields are of type [Duration](https://gateway-api.sigs.k8s.io/geps/gep-2257/). A zero-valued timeout ("0s") MUST be interpreted as disabling the timeout. A valid non-zero-valued timeout MUST be >= 1ms.
+Timeouts are optional, and their fields are of type [Duration](https://gateway-api.sigs.k8s.io/geps/gep-2257). A zero-valued timeout ("0s") MUST be interpreted as disabling the timeout. A valid non-zero-valued timeout MUST be >= 1ms.
 
 The following example uses the `request` field which will cause a timeout if a client request is taking longer than 10 seconds to complete. The example also defines a 2s `backendRequest` which specifies a timeout for an individual request from the gateway to a backend service `timeout-svc`:
 
@@ -450,7 +457,7 @@ metadata:
 ...
 status:
   parents:
-  - parentRefs:
+  - parentRef:
       name: gw-example
       namespace: gw-example-ns
     conditions:
@@ -464,14 +471,14 @@ only one Route rule may match each request. For more information on how conflict
 resolution applies to merging, refer to the [API specification][httprouterule].
 
 
-[httproute]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRoute
-[httprouterule]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteRule
-[hostname]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Hostname
+[httproute]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.HTTPRoute
+[httprouterule]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.HTTPRouteRule
+[hostname]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.Hostname
 [rfc-3986]: https://tools.ietf.org/html/rfc3986
-[matches]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteMatch
-[filters]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteFilter
-[backendRef]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPBackendRef
-[parentRef]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.ParentRef
-[timeouts]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteTimeouts
+[matches]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.HTTPRouteMatch
+[filters]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.HTTPRouteFilter
+[backendRef]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.HTTPBackendRef
+[parentRef]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.ParentRef
+[timeouts]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.HTTPRouteTimeouts
 [appProtocol]: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol
-[sectionName]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.SectionName
+[sectionName]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.SectionName

site/content/en/latest/api/gateway_api/referencegrant.md

@@ -3,7 +3,7 @@ title = "ReferenceGrant"
 +++
 
 
-    The `ReferenceGrant` resource is Beta and part of the 
+    The `ReferenceGrant` resource is Beta and part of the
     Standard Channel since `v0.6.0`. For more information on release
     channels, refer to our [versioning guide](https://gateway-api.sigs.k8s.io/concepts/versioning).
 

site/content/en/latest/concepts/concepts_overview.md

@@ -42,9 +42,9 @@ There are several resources that play a part in enabling you to meet your Kubern
 [2]:	https://gateway-api.sigs.k8s.io/api-types/gateway/
 [3]:	https://gateway-api.sigs.k8s.io/api-types/httproute/
 [4]:	https://gateway-api.sigs.k8s.io/api-types/grpcroute/
-[5]:	https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.TLSRoute
-[6]:	https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.TCPRoute
-[7]:	https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.UDPRoute
+[5]:	https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1alpha2.TLSRoute
+[6]:	https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1alpha2.TCPRoute
+[7]:	https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1alpha2.UDPRoute
 [8]:	../tasks/traffic/backend
 [9]:	../api/extension_types#clienttrafficpolicy
 [10]:	../api/extension_types#backendtrafficpolicy

site/content/en/latest/concepts/introduction/gateway_api_extensions/client-traffic-policy.md

@@ -34,7 +34,7 @@ Think of `ClientTrafficPolicy` as a set of rules for your Gateway's entry points
 
 ## ClientTrafficPolicy in Envoy Gateway
 
-`ClientTrafficPolicy` is part of the Envoy Gateway API suite, which extends the Kubernetes Gateway API with additional capabilities. It's implemented as a Custom Resource Definition (CRD) that you can use to configure how Envoy Gateway manages incoming client traffic. 
+`ClientTrafficPolicy` is part of the Envoy Gateway API suite, which extends the Kubernetes Gateway API with additional capabilities. It's implemented as a Custom Resource Definition (CRD) that you can use to configure how Envoy Gateway manages incoming client traffic.
 
 You can attach it to Gateway API resources in two ways:
 
@@ -84,5 +84,5 @@ In this case:
 - [Connection Limit](../../../tasks/traffic/connection-limit.md)
 - [HTTP Request Headers](../../../tasks/traffic/http-request-headers)
 - [HTTP/3](../../../tasks/traffic/http3)
-- [Mutual TLS: External Clients to the Gateway](../../../tasks/security/mutual-tls.md)
+- [Mutual TLS: External Clients to the Gateway](../../../tasks/security/mutual-tls/)
 - [ClientTrafficPolicy API Reference](../../../api/extension_types#clienttrafficpolicy)

site/content/en/latest/tasks/security/cors.md

@@ -271,4 +271,4 @@ Checkout the [Developer Guide](../../../contributions/develop) to get involved i
 [Gateway]: https://gateway-api.sigs.k8s.io/api-types/gateway
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute
 [GRPCRoute]: https://gateway-api.sigs.k8s.io/api-types/grpcroute
-[HTTPCORSFilter]: https://gateway-api.sigs.k8s.io/reference/spec/#httpcorsfilter
+[HTTPCORSFilter]: https://gateway-api.sigs.k8s.io/reference/spec#httpcorsfilter

site/content/en/latest/tasks/security/credential-injection.md

@@ -257,5 +257,5 @@ kubectl delete secret/jwt-credential
 Check out the [Developer Guide](../../../contributions/develop) to get involved in the project.
 
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute
-[BackendRef]: https://gateway-api.sigs.k8s.io/reference/spec/#httpbackendref
+[BackendRef]: https://gateway-api.sigs.k8s.io/reference/spec#httpbackendref
 [HTTPRouteFilter]: ../../../api/extension_types#httproutefilter

site/content/en/latest/tasks/traffic/backend.md

@@ -295,12 +295,12 @@ curl -HHost:httpbin.org http://${GATEWAY_HOST}/get
 
 [Backend]: ../../../api/extension_types#backend
 [routing to cluster-external backends]: ./../../tasks/traffic/routing-outside-kubernetes.md
-[BackendObjectReference]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.BackendObjectReference
+[BackendObjectReference]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.BackendObjectReference
 [extension resource]: https://gateway-api.sigs.k8s.io/guides/migrating-from-ingress/#approach-to-extensibility
 [CVE-2021-25740]: https://nvd.nist.gov/vuln/detail/CVE-2021-25740
 [upstream recommendations]: https://github.com/kubernetes/kubernetes/issues/103675
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute
-[TLSRoute]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.TLSRoute
+[TLSRoute]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1alpha2.TLSRoute
 [Envoy Extension Policy]: ../../../api/extension_types#envoyextensionpolicy
 [Security Policy]: ../../../api/extension_types#oidcprovider
 [Backend TLS Policy]: https://gateway-api.sigs.k8s.io/api-types/backendtlspolicy/

site/content/en/latest/tasks/traffic/connection-limit.md

@@ -8,15 +8,15 @@ When the [connection limit][] is reached, new connections are closed immediately
 Users may want to limit the number of connections for several reasons:
 * Protect resources like CPU and Memory.
 * Ensure that different listeners can receive a fair share of global resources.
-* Protect from malicious activity like DoS attacks. 
+* Protect from malicious activity like DoS attacks.
 
 Envoy Gateway introduces a new CRD called [Client Traffic Policy][] that allows the user to describe their desired connection limit settings.
 This instantiated resource can be linked to a [Gateway][].
 
 The Envoy [connection limit][] implementation is distributed: counters are not synchronized between different envoy proxies.
 
-When a [Client Traffic Policy][] is attached to a gateway, the connection limit will apply differently based on the 
-[Listener][] protocol in use: 
+When a [Client Traffic Policy][] is attached to a gateway, the connection limit will apply differently based on the
+[Listener][] protocol in use:
 - HTTP: all HTTP listeners in a [Gateway][] will share a common connection counter, and a limit defined by the policy.
 - HTTPS/TLS: each HTTPS/TLS listener will have a dedicated connection counter, and a limit defined by the policy.
 
@@ -53,9 +53,9 @@ Status code distribution:
   [200]	100 responses
 ```
 
-There are no connection limits, and so all 100 requests succeed. 
+There are no connection limits, and so all 100 requests succeed.
 
-Next, we apply a limit of 5 connections. 
+Next, we apply a limit of 5 connections.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
@@ -74,7 +74,7 @@ spec:
       name: eg
   connection:
     connectionLimit:
-      value: 5    
+      value: 5
 EOF
 ```
 
@@ -96,7 +96,7 @@ spec:
       name: eg
   connection:
     connectionLimit:
-      value: 5    
+      value: 5
 ```
 
 {{% /tab %}}
@@ -116,7 +116,7 @@ Summary:
   Average:	0.0088 secs
   Requests/sec:	9.0640
 
-[...] 
+[...]
 
 Status code distribution:
   [200]	50 responses
@@ -125,11 +125,11 @@ Error distribution:
   [50]	Get "http://localhost:8888/get": EOF
 ```
 
-With the new connection limit, only 5 of 10 connections are established, and so only 50 requests succeed.  
+With the new connection limit, only 5 of 10 connections are established, and so only 50 requests succeed.
 
 
 [Client Traffic Policy]: ../../../api/extension_types#clienttrafficpolicy
 [Hey project]: https://github.com/rakyll/hey
 [connection limit]: https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/network_filters/connection_limit_filter
-[listener]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Listener
-[gateway]:  https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.Gateway
+[listener]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.Listener
+[gateway]:  https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1alpha2.Gateway

site/content/en/latest/tasks/traffic/gateway-address.md

@@ -14,10 +14,10 @@ Depending on the Service Type, the addresses of gateway can be used as:
 
 ## External IPs
 
-Using the addresses in `Gateway.Spec.Addresses` as the [External IPs][] of Envoy Proxy Service, 
+Using the addresses in `Gateway.Spec.Addresses` as the [External IPs][] of Envoy Proxy Service,
 this will __require__ the address to be of type `IPAddress` and the [ServiceType][] to be of `LoadBalancer` or `NodePort`.
 
-The Envoy Gateway deploys Envoy Proxy Service as `LoadBalancer` by default, 
+The Envoy Gateway deploys Envoy Proxy Service as `LoadBalancer` by default,
 so you can set the address of the Gateway directly (the address settings here are for reference only):
 
 ```shell
@@ -62,7 +62,7 @@ Using the addresses in `Gateway.Spec.Addresses` as the [Cluster IP][] of Envoy P
 this will __require__ the address to be of type `IPAddress` and the [ServiceType][] to be of `ClusterIP`.
 
 
-[Addresses]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.GatewayAddress
+[Addresses]: https://gateway-api.sigs.k8s.io/reference/spec#gateway.networking.k8s.io/v1.GatewayAddress
 [External IPs]: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
 [Cluster IP]: https://kubernetes.io/docs/concepts/services-networking/service/#type-clusterip
 [ServiceType]: ../../../api/extension_types#servicetype