From d6218bddc68ae438b814c9e6bc88b38d0750e714 Mon Sep 17 00:00:00 2001
From: Jukie <10012479+Jukie@users.noreply.github.com>
Date: Mon, 7 Jul 2025 18:00:44 -0600
Subject: [PATCH 1/6] initial wip

Signed-off-by: Jukie <10012479+Jukie@users.noreply.github.com>
---
 internal/gatewayapi/globalresources.go        |   6 +-
 internal/gatewayapi/proxyinfracluster.go      |  92 +++++++++++++
 internal/gatewayapi/route.go                  |  30 +++--
 .../testdata/accesslog-als-backend.out.yaml   |  11 ++
 .../gatewayapi/testdata/accesslog.out.yaml    |  11 ++
 .../backend-invalid-feature-disabled.out.yaml |  11 ++
 .../backend-with-endpoint-zones.out.yaml      |  11 ++
 .../testdata/backend-with-fallback.out.yaml   |  11 ++
 .../backend-with-skip-tls-verify.out.yaml     |  11 ++
 .../backendtlspolicy-across-ns.out.yaml       |  11 ++
 .../backendtlspolicy-ca-only-secret.out.yaml  |  11 ++
 .../backendtlspolicy-ca-only.out.yaml         |  11 ++
 ...ndtlspolicy-default-ns-targetrefs.out.yaml |  20 +++
 .../backendtlspolicy-default-ns.out.yaml      |  11 ++
 .../backendtlspolicy-invalid-ca.out.yaml      |  11 ++
 ...backendtlspolicy-multiple-targets.out.yaml |  11 ++
 ...endtlspolicy-serviceimport-target.out.yaml |  11 ++
 .../backendtlspolicy-subjectaltnames.out.yaml |  11 ++
 ...ackendtlspolicy-system-truststore.out.yaml |  11 ++
 ...y-buffer-limit-out-of-range-error.out.yaml |  20 +++
 ...y-buffer-limit-with-invalid-value.out.yaml |  20 +++
 ...backendtrafficpolicy-buffer-limit.out.yaml |  20 +++
 .../backendtrafficpolicy-compression.out.yaml |  11 ++
 ...ackendtrafficpolicy-connect-proxy.out.yaml |  11 ++
 ...ndtrafficpolicy-connect-terminate.out.yaml |  11 ++
 ...ndtrafficpolicy-dns-lookup-family.out.yaml |  11 ++
 ...ndtrafficpolicy-http-upgrade-spdy.out.yaml |  11 ++
 ...fficpolicy-http-upgrade-websocket.out.yaml |  11 ++
 ...endtrafficpolicy-override-replace.out.yaml |  11 ++
 ...ckendtrafficpolicy-request-buffer.out.yaml |  20 +++
 ...ndtrafficpolicy-status-conditions.out.yaml |  29 ++++
 ...fficpolicy-status-fault-injection.out.yaml |  20 +++
 ...-strategic-merge-global-ratelimit.out.yaml |  18 +++
 ...y-strategic-merge-local-ratelimit.out.yaml |  20 +++
 ...policy-strategic-merge-only-gw-rl.out.yaml |  19 +++
 ...strategic-merge-only-httproute-rl.out.yaml |  18 +++
 ...trategic-merge-with-multi-parents.out.yaml |  20 +++
 ...kendtrafficpolicy-strategic-merge.out.yaml |  11 ++
 .../backendtrafficpolicy-tracing.out.yaml     |  11 ++
 ...trafficpolicy-use-client-protocol.out.yaml |  11 ++
 ...policy-with-circuitbreakers-error.out.yaml |  20 +++
 ...rafficpolicy-with-circuitbreakers.out.yaml |  20 +++
 ...ndtrafficpolicy-with-dns-settings.out.yaml |  20 +++
 ...endtrafficpolicy-with-healthcheck.out.yaml |  20 +++
 .../backendtrafficpolicy-with-http2.out.yaml  |  20 +++
 ...fficpolicy-with-httproute-timeout.out.yaml |  11 ++
 ...nvalid-consistent-hash-table-size.out.yaml |  11 ++
 ...ndtrafficpolicy-with-loadbalancer.out.yaml |  20 +++
 ...telimit-default-route-level-limit.out.yaml |  11 ++
 ...cal-ratelimit-distinct-match-type.out.yaml |  11 ++
 ...ocal-ratelimit-invalid-limit-unit.out.yaml |  11 ++
 ...valid-multiple-route-level-limits.out.yaml |  11 ++
 ...rafficpolicy-with-local-ratelimit.out.yaml |  11 ++
 ...rafficpolicy-with-panic-threshold.out.yaml |  20 +++
 ...dtrafficpolicy-with-proxyprotocol.out.yaml |  20 +++
 ...ratelimit-invalid-distinct-invert.out.yaml |  11 ++
 ...licy-with-ratelimit-invalid-regex.out.yaml |  11 ++
 ...ckendtrafficpolicy-with-ratelimit.out.yaml |  18 +++
 ...esponse-override-invalid-valueref.out.yaml |  20 +++
 ...fficpolicy-with-response-override.out.yaml |  20 +++
 ...backendtrafficpolicy-with-retries.out.yaml |  20 +++
 ...olicy-with-same-prefix-httproutes.out.yaml |  11 ++
 ...afficpolicy-with-shared-ratelimit.out.yaml |  18 +++
 ...cp-udp-listeners-apply-on-gateway.out.yaml |  11 ++
 ...-tcp-udp-listeners-apply-on-route.out.yaml |  11 ++
 ...ndtrafficpolicy-with-tcpkeepalive.out.yaml |  20 +++
 ...dtrafficpolicy-with-timeout-error.out.yaml |  11 ++
 ...ficpolicy-with-timeout-targetrefs.out.yaml |  20 +++
 ...backendtrafficpolicy-with-timeout.out.yaml |  20 +++
 ...cy-buffer-limit-with-format-error.out.yaml |  11 ++
 ...fer-limit-with-out-of-range-error.out.yaml |  11 ++
 .../clienttrafficpolicy-buffer-limit.out.yaml |  11 ++
 ...trafficpolicy-client-ip-detection.out.yaml |  11 ++
 ...fficpolicy-connection-limit-error.out.yaml |  11 ++
 ...enttrafficpolicy-connection-limit.out.yaml |  11 ++
 ...nttrafficpolicy-for-tcp-listeners.out.yaml |  11 ++
 ...clienttrafficpolicy-headers-error.out.yaml |  11 ++
 .../clienttrafficpolicy-headers.out.yaml      |  11 ++
 ...nttrafficpolicy-http-health-check.out.yaml |  11 ++
 .../clienttrafficpolicy-http10.out.yaml       |  11 ++
 .../clienttrafficpolicy-http2.out.yaml        |  11 ++
 .../clienttrafficpolicy-http3.out.yaml        |  11 ++
 ...ficpolicy-idle-timeout-with-error.out.yaml |  11 ++
 .../clienttrafficpolicy-idle-timeout.out.yaml |  11 ++
 ...enttrafficpolicy-invalid-settings.out.yaml |  11 ++
 ...icpolicy-mtls-client-verification.out.yaml |  29 ++++
 ...s-forward-client-cert-custom-data.out.yaml |  47 +++++++
 ...icpolicy-mtls-forward-client-cert.out.yaml |  47 +++++++
 .../clienttrafficpolicy-mtls.out.yaml         |  20 +++
 ...clienttrafficpolicy-path-settings.out.yaml |  11 ++
 ...cy-preserve-case-multiple-targets.out.yaml |  20 +++
 ...clienttrafficpolicy-preserve-case.out.yaml |  11 ++
 ...clienttrafficpolicy-proxyprotocol.out.yaml |  11 ++
 ...enttrafficpolicy-ratelimitheaders.out.yaml |  11 ++
 ...nttrafficpolicy-status-conditions.out.yaml |  38 ++++++
 ...clienttrafficpolicy-tcp-keepalive.out.yaml |  11 ++
 ...ttrafficpolicy-timeout-with-error.out.yaml |  11 ++
 .../clienttrafficpolicy-timeout.out.yaml      |  11 ++
 .../clienttrafficpolicy-tls-settings.out.yaml |  29 ++++
 .../clienttrafficpolicy-trailers.out.yaml     |  11 ++
 .../testdata/conflicting-policies.out.yaml    |  11 ++
 .../testdata/custom-filter-order.out.yaml     |  10 ++
 .../testdata/disable-accesslog.out.yaml       |  11 ++
 ...ensionpolicy-invalid-cross-ns-ref.out.yaml |  11 ++
 ...yextensionpolicy-override-replace.out.yaml |  11 ++
 ...extensionpolicy-status-conditions.out.yaml |  29 ++++
 ...-extproc-invalid-no-matching-port.out.yaml |  11 ++
 ...licy-with-extproc-invalid-no-port.out.yaml |  11 ++
 ...xtproc-invalid-no-reference-grant.out.yaml |  11 ++
 ...y-with-extproc-invalid-no-service.out.yaml |  11 ++
 ...ith-extproc-with-backendtlspolicy.out.yaml |  11 ++
 ...th-extproc-with-mixed-backendrefs.out.yaml |  11 ++
 ...extproc-with-multiple-backendrefs.out.yaml |  11 ++
 ...ith-extproc-with-traffic-features.out.yaml |  11 ++
 ...h-invalid-lua-validation-disabled.out.yaml |  11 ++
 ...yextensionpolicy-with-invalid-lua.out.yaml |  11 ++
 ...xtensionpolicy-with-lua-configmap.out.yaml |  11 ++
 .../envoyextensionpolicy-with-lua.out.yaml    |  11 ++
 ...xtensionpolicy-with-wasm-env-vars.out.yaml |  10 ++
 ...ensionpolicy-with-wasm-targetrefs.out.yaml |  10 ++
 .../envoyextensionpolicy-with-wasm.out.yaml   |  10 ++
 .../envoypatchpolicy-cross-ns-target.out.yaml |  11 ++
 ...chpolicy-invalid-feature-disabled.out.yaml |  11 ++
 ...nvalid-target-kind-merge-gateways.out.yaml |  11 ++
 ...oypatchpolicy-invalid-target-kind.out.yaml |  11 ++
 ...ypatchpolicy-valid-merge-gateways.out.yaml |  11 ++
 .../testdata/envoypatchpolicy-valid.out.yaml  |  11 ++
 .../envoyproxy-accesslog-als-json.out.yaml    |  11 ++
 ...oyproxy-accesslog-backend-invalid.out.yaml |  11 ++
 .../envoyproxy-accesslog-backend.out.yaml     |  11 ++
 ...yproxy-accesslog-cel-with-invalid.out.yaml |  11 ++
 .../envoyproxy-accesslog-cel.out.yaml         |  11 ++
 ...oxy-accesslog-file-json-no-format.out.yaml |  11 ++
 .../envoyproxy-accesslog-file-json.out.yaml   |  11 ++
 .../envoyproxy-accesslog-types.out.yaml       |  11 ++
 ...voyproxy-accesslog-with-bad-sinks.out.yaml |  11 ++
 ...envoyproxy-accesslog-with-traffic.out.yaml |  11 ++
 ...voyproxy-accesslog-without-format.out.yaml |  11 ++
 .../testdata/envoyproxy-accesslog.out.yaml    |  11 ++
 ...roxy-endpoint-routing-for-gateway.out.yaml |  11 ++
 .../envoyproxy-endpoint-routing.out.yaml      |  11 ++
 ...envoyproxy-metric-backend-invalid.out.yaml |  11 ++
 .../envoyproxy-metric-backend.out.yaml        |  11 ++
 ...envoyproxy-metric-enabled-backend.out.yaml |  11 ++
 .../envoyproxy-preserve-route-order.out.yaml  |  11 ++
 .../envoyproxy-priority-backend.out.yaml      |  11 ++
 ...proxy-service-routing-for-gateway.out.yaml |  11 ++
 .../envoyproxy-service-routing.out.yaml       |  11 ++
 ...nvoyproxy-tls-settings-invalid-ns.out.yaml |  11 ++
 .../envoyproxy-tls-settings-invalid.out.yaml  |  11 ++
 .../testdata/envoyproxy-tls-settings.out.yaml |  11 ++
 ...nvoyproxy-tracing-backend-invalid.out.yaml |  11 ++
 .../envoyproxy-tracing-backend-uds.out.yaml   |  11 ++
 .../envoyproxy-tracing-backend.out.yaml       |  11 ++
 .../testdata/envoyproxy-valid.out.yaml        |  11 ++
 .../envoyproxy-with-statname.out.yaml         |  11 ++
 ...-namespace-with-allowed-httproute.out.yaml |  11 ++
 ...mespace-with-disallowed-httproute.out.yaml |  11 ++
 ...stener-with-hostname-intersection.out.yaml |  11 ++
 .../testdata/gateway-infrastructure.out.yaml  |  11 ++
 ...ay-namespace-mode-infra-httproute.out.yaml |  29 ++++
 ...way-with-addresses-with-ipaddress.out.yaml |  11 ++
 ...with-infrastructure-parametersref.out.yaml |  11 ++
 ...ture-parametersref-does-not-exist.out.yaml |  11 ++
 ...astructure-parametersref-fallback.out.yaml |  11 ++
 ...valid-allowed-namespaces-selector.out.yaml |  11 ++
 ...with-invalid-allowed-routes-group.out.yaml |  11 ++
 ...allowed-routes-kind-and-supported.out.yaml |  11 ++
 ...-with-invalid-allowed-routes-kind.out.yaml |  11 ++
 ...th-invalid-allowed-tls-route-kind.out.yaml |  11 ++
 ...nvalid-multiple-tls-configuration.out.yaml |  11 ++
 ...id-tls-configuration-invalid-mode.out.yaml |  11 ++
 ...configuration-no-certificate-refs.out.yaml |  11 ++
 ...ion-no-valid-certificate-for-fqdn.out.yaml |  11 ++
 ...nfiguration-secret-does-not-exist.out.yaml |  11 ++
 ...uration-secret-in-other-namespace.out.yaml |  11 ++
 ...configuration-secret-is-not-valid.out.yaml |  11 ++
 ...ssing-allowed-namespaces-selector.out.yaml |  11 ++
 ...h-listener-with-tcp-with-hostname.out.yaml |  11 ++
 ...route-with-mismatch-port-protocol.out.yaml |  11 ++
 ...h-tcproute-with-multiple-backends.out.yaml |  11 ++
 ...with-tcproute-with-multiple-rules.out.yaml |  11 ++
 ...her-namespace-allowed-by-refgrant.out.yaml |  11 ++
 ...ith-tls-terminate-and-passthrough.out.yaml |  11 ++
 ...h-listener-with-udp-with-hostname.out.yaml |  11 ++
 ...route-with-mismatch-port-protocol.out.yaml |  11 ++
 ...h-udproute-with-multiple-backends.out.yaml |  11 ++
 ...with-udproute-with-multiple-rules.out.yaml |  11 ++
 ...-listener-with-unmatched-tcproute.out.yaml |  11 ++
 ...-listener-with-unmatched-udproute.out.yaml |  11 ++
 ...istener-with-unsupported-protocol.out.yaml |  11 ++
 ...ith-same-algorithm-different-fqdn.out.yaml |  11 ++
 ...-valid-multiple-tls-configuration.out.yaml |  11 ++
 ...ener-with-valid-tls-configuration.out.yaml |  11 ++
 ...-listeners-with-overlapping-certs.out.yaml |  11 ++
 ...stnames-and-certs-merged-gateways.out.yaml |  11 ++
 ...h-overlapping-hostnames-and-certs.out.yaml |  11 ++
 ...lapping-hostnames-merged-gateways.out.yaml |  11 ++
 ...teners-with-overlapping-hostnames.out.yaml |  11 ++
 ...with-preexisting-status-condition.out.yaml |  11 ++
 ...-listener-with-multiple-tcproutes.out.yaml |  11 ++
 ...-listener-with-multiple-udproutes.out.yaml |  11 ++
 ...teway-with-stale-status-condition.out.yaml |  11 ++
 ...listeners-on-same-tcp-or-tls-port.out.yaml |  11 ++
 ...th-two-listeners-on-same-udp-port.out.yaml |  11 ++
 ...d-tlsroute-same-hostname-and-port.out.yaml |  11 ++
 ...isteners-with-multiple-httproutes.out.yaml |  11 ++
 ...eners-with-same-port-and-hostname.out.yaml |  11 ++
 ...me-port-and-incompatible-protocol.out.yaml |  11 ++
 ...-with-same-port-http-tcp-protocol.out.yaml |  11 ++
 ...-with-same-port-http-udp-protocol.out.yaml |  11 ++
 ...s-with-tcproutes-with-sectionname.out.yaml |  11 ++
 ...ith-tcproutes-without-sectionname.out.yaml |  11 ++
 ...s-with-udproutes-with-sectionname.out.yaml |  11 ++
 ...ith-udproutes-without-sectionname.out.yaml |  11 ++
 .../testdata/grpcroute-with-backend.out.yaml  |  11 ++
 .../grpcroute-with-empty-backends.out.yaml    |  11 ++
 .../grpcroute-with-header-match.out.yaml      |  11 ++
 ...ute-with-method-and-service-match.out.yaml |  11 ++
 .../grpcroute-with-method-match.out.yaml      |  11 ++
 ...oute-with-request-header-modifier.out.yaml |  11 ++
 .../grpcroute-with-service-match.out.yaml     |  11 ++
 ...dtrafficpolicy-with-timeout-error.out.yaml |  11 ++
 ...backendtrafficpolicy-with-timeout.out.yaml |  20 +++
 ...way-with-more-different-listeners.out.yaml |  11 ++
 ...ng-to-gateway-with-more-listeners.out.yaml |  11 ++
 ...wo-listeners-with-different-ports.out.yaml |  11 ++
 ...ing-to-gateway-with-two-listeners.out.yaml |  11 ++
 .../httproute-attaching-to-gateway.out.yaml   |  11 ++
 ...taching-to-listener-matching-port.out.yaml |  11 ++
 ...ner-on-gateway-with-two-listeners.out.yaml |  11 ++
 ...with-backend-and-core-backendrefs.out.yaml |  11 ++
 ...end-backendref-mixed-address-type.out.yaml |  11 ++
 ...-listener-with-backend-backendref.out.yaml |  11 ++
 ...end-backendrefs-diff-address-type.out.yaml |  11 ++
 ...end-backendrefs-same-address-type.out.yaml |  11 ++
 ...ort-backendrefs-diff-address-type.out.yaml |  11 ++
 ...ort-backendrefs-same-address-type.out.yaml |  11 ++
 ...port-backendref-fqdn-address-type.out.yaml |  11 ++
 ...ort-backendref-mixed-address-type.out.yaml |  11 ++
 ...ner-with-serviceimport-backendref.out.yaml |  11 ++
 .../httproute-attaching-to-listener.out.yaml  |  11 ++
 ...httproute-backend-request-timeout.out.yaml |  11 ++
 ...c-resolver-with-mutliple-backends.out.yaml |  11 ++
 .../httproute-dynamic-resolver.out.yaml       |  11 ++
 ...ing-to-listener-non-matching-port.out.yaml |  11 ++
 .../httproute-request-timeout.out.yaml        |  11 ++
 .../testdata/httproute-retry.out.yaml         |  20 +++
 ...ith-empty-backends-and-no-filters.out.yaml |  11 ++
 ...-multiple-backends-and-no-weights.out.yaml |  11 ++
 ...ith-multiple-backends-and-weights.out.yaml |  11 ++
 ...ervice-backends-and-app-protocols.out.yaml |  11 ++
 ...-non-service-backends-and-weights.out.yaml |  11 ++
 ...h-api-key-auth-duplicated-api-key.out.yaml |  11 ++
 ...h-backendref-add-multiple-filters.out.yaml |  11 ++
 ...her-namespace-allowed-by-refgrant.out.yaml |  11 ++
 ...her-namespace-allowed-by-refgrant.out.yaml |  11 ++
 .../httproute-with-cors-filter.out.yaml       |  11 ++
 ...tproute-with-credential-injection.out.yaml |  11 ++
 .../httproute-with-direct-response.out.yaml   |  11 ++
 .../httproute-with-empty-matches.out.yaml     |  11 ++
 ...proute-with-enable-zone-discovery.out.yaml |  23 +++-
 ...er-duplicate-add-multiple-filters.out.yaml |  11 ++
 ...with-header-filter-duplicate-adds.out.yaml |  11 ++
 ...duplicate-remove-multiple-filters.out.yaml |  11 ++
 ...h-header-filter-duplicate-removes.out.yaml |  11 ++
 ...header-filter-empty-header-values.out.yaml |  11 ++
 ...-with-header-filter-empty-headers.out.yaml |  11 ++
 ...ader-filter-invalid-header-values.out.yaml |  11 ++
 ...ith-header-filter-invalid-headers.out.yaml |  11 ++
 ...ute-with-header-filter-no-headers.out.yaml |  11 ++
 ...th-header-filter-no-valid-headers.out.yaml |  11 ++
 ...tproute-with-header-filter-remove.out.yaml |  11 ++
 ...ute-with-header-match-diff-number.out.yaml |  11 ++
 ...route-with-header-match-diff-type.out.yaml |  11 ++
 ...headless-service-endpoint-routing.out.yaml |  11 ++
 ...-headless-service-service-routing.out.yaml |  11 ++
 ...with-invalid-backend-ref-bad-port.out.yaml |  11 ++
 ...invalid-backend-ref-invalid-group.out.yaml |  11 ++
 ...-invalid-backend-ref-invalid-kind.out.yaml |  11 ++
 ...id-backend-ref-invalid-mixed-kind.out.yaml |  11 ++
 ...-with-invalid-backend-ref-no-port.out.yaml |  11 ++
 ...lid-backend-ref-no-service.import.out.yaml |  11 ++
 ...th-invalid-backend-ref-no-service.out.yaml |  11 ++
 ...id-backend-ref-unsupported-filter.out.yaml |  11 ++
 ...lid-backendref-in-other-namespace.out.yaml |  11 ++
 .../httproute-with-invalid-regex.out.yaml     |  20 +++
 .../testdata/httproute-with-metadata.out.yaml |  11 ++
 ...ute-with-mirror-filter-duplicates.out.yaml |  11 ++
 ...route-with-mirror-filter-multiple.out.yaml |  11 ++
 ...irror-filter-percentage-mirroring.out.yaml |  11 ++
 ...ith-mirror-filter-service-no-port.out.yaml |  11 ++
 ...h-mirror-filter-service-not-found.out.yaml |  11 ++
 .../httproute-with-mirror-filter.out.yaml     |  11 ++
 ...oute-with-multi-gateways-notmatch.out.yaml |  20 +++
 ...ith-multi-gateways-with-same-name.out.yaml |  20 +++
 ...ltiple-gateways-from-different-ns.out.yaml |  20 +++
 ...th-multiple-gateways-from-same-ns.out.yaml |  20 +++
 ...route-with-multiple-invalid-rules.out.yaml |  11 ++
 ...to-gateway-with-wildcard-hostname.out.yaml |  11 ++
 ...oute-with-query-match-diff-number.out.yaml |  11 ++
 ...proute-with-query-match-diff-type.out.yaml |  11 ++
 ...ct-filter-full-path-replace-https.out.yaml |  11 ++
 ...ute-with-redirect-filter-hostname.out.yaml |  11 ++
 ...direct-filter-invalid-filter-type.out.yaml |  11 ++
 ...th-redirect-filter-invalid-scheme.out.yaml |  11 ++
 ...th-redirect-filter-invalid-status.out.yaml |  11 ++
 ...ter-prefix-replace-with-port-http.out.yaml |  11 ++
 ...-with-response-header-filter-adds.out.yaml |  11 ++
 ...er-duplicate-add-multiple-filters.out.yaml |  11 ++
 ...onse-header-filter-duplicate-adds.out.yaml |  11 ++
 ...duplicate-remove-multiple-filters.out.yaml |  11 ++
 ...e-header-filter-duplicate-removes.out.yaml |  11 ++
 ...header-filter-empty-header-values.out.yaml |  11 ++
 ...ponse-header-filter-empty-headers.out.yaml |  11 ++
 ...ader-filter-invalid-header-values.out.yaml |  11 ++
 ...nse-header-filter-invalid-headers.out.yaml |  11 ++
 ...response-header-filter-no-headers.out.yaml |  11 ++
 ...se-header-filter-no-valid-headers.out.yaml |  11 ++
 ...ith-response-header-filter-remove.out.yaml |  11 ++
 ...single-rule-with-exact-path-match.out.yaml |  11 ++
 ...ingle-rule-with-http-method-match.out.yaml |  11 ++
 ...h-single-rule-with-multiple-rules.out.yaml |  11 ++
 ...h-prefix-and-exact-header-matches.out.yaml |  11 ++
 ...e-invalid-backend-refs-no-service.out.yaml |  11 ++
 ...to-gateway-with-wildcard-hostname.out.yaml |  11 ++
 ...to-gateway-with-wildcard-hostname.out.yaml |  11 ++
 ...ite-filter-full-path-replace-http.out.yaml |  11 ++
 ...te-filter-hostname-prefix-replace.out.yaml |  11 ++
 ...e-with-urlrewrite-filter-hostname.out.yaml |  11 ++
 ...ewrite-filter-invalid-filter-type.out.yaml |  11 ++
 ...rlrewrite-filter-invalid-hostname.out.yaml |  11 ++
 ...e-filter-invalid-multiple-filters.out.yaml |  11 ++
 ...lrewrite-filter-invalid-path-type.out.yaml |  11 ++
 ...th-urlrewrite-filter-invalid-path.out.yaml |  11 ++
 ...th-urlrewrite-filter-missing-path.out.yaml |  11 ++
 ...ewrite-filter-prefix-replace-http.out.yaml |  11 ++
 ...e-filter-regex-match-replace-http.out.yaml |  11 ++
 ...ilter-regex-match-replace-invalid.out.yaml |  11 ++
 ...rlrewrite-hostname-filter-invalid.out.yaml |  11 ++
 ...e-with-urlrewrite-hostname-filter.out.yaml |  11 ++
 ...ng-to-gateway-with-unset-hostname.out.yaml |  11 ++
 .../httproutes-with-multiple-matches.out.yaml |  11 ++
 .../merge-invalid-multiple-gateways.out.yaml  |  11 ++
 ...ays-multiple-listeners-same-ports.out.yaml |  11 ++
 ...multiple-gateways-multiple-routes.out.yaml |  11 ++
 .../merge-valid-multiple-gateways.out.yaml    |  11 ++
 .../merge-with-isolated-policies-2.out.yaml   |  11 ++
 .../merge-with-isolated-policies.out.yaml     |  11 ++
 ...curitypolicy-invalid-cross-ns-ref.out.yaml |  11 ++
 ...-invalid-no-section-name-listener.out.yaml |  11 ++
 .../securitypolicy-override-replace.out.yaml  |  11 ++
 .../securitypolicy-status-conditions.out.yaml |  20 +++
 ...icy-with-authoriztion-client-cidr.out.yaml |  11 ++
 ...-authoriztion-headers-and-methods.out.yaml |  11 ++
 ...olicy-with-authoriztion-jwt-claim.out.yaml |  11 ++
 .../securitypolicy-with-basic-auth.out.yaml   |  11 ++
 ...curitypolicy-with-cors-targetrefs.out.yaml |  29 ++++
 .../securitypolicy-with-cors.out.yaml         |  29 ++++
 ...curitypolicy-with-extauth-backend.out.yaml |  11 ++
 ...itypolicy-with-extauth-backendref.out.yaml |  11 ++
 .../securitypolicy-with-extauth-body.out.yaml |  11 ++
 ...-extauth-invalid-no-matching-port.out.yaml |  11 ++
 ...licy-with-extauth-invalid-no-port.out.yaml |  11 ++
 ...xtauth-invalid-no-reference-grant.out.yaml |  11 ++
 ...y-with-extauth-invalid-no-service.out.yaml |  11 ++
 ...policy-with-extauth-recomputation.out.yaml |  11 ++
 ...ith-extauth-with-backendtlspolicy.out.yaml |  11 ++
 .../securitypolicy-with-extauth.out.yaml      |  11 ++
 ...ypolicy-with-jwt-and-invalid-oidc.out.yaml |  11 ++
 ...itypolicy-with-jwt-backendcluster.out.yaml |  11 ++
 ...ecuritypolicy-with-jwt-local-jwks.out.yaml |  11 ++
 .../securitypolicy-with-jwt-optional.out.yaml |  20 +++
 ...cy-with-jwt-with-custom-extractor.out.yaml |  20 +++
 .../testdata/securitypolicy-with-jwt.out.yaml |  20 +++
 ...icy-with-oidc-and-jwt-passthrough.out.yaml |  11 ++
 ...typolicy-with-oidc-backendcluster.out.yaml |  11 ++
 ...with-oidc-custom-cookies-samesite.out.yaml |  11 ++
 ...typolicy-with-oidc-custom-cookies.out.yaml |  11 ++
 ...itypolicy-with-oidc-deny-redirect.out.yaml |  11 ++
 ...typolicy-with-oidc-invalid-issuer.out.yaml |  11 ++
 ...olicy-with-oidc-invalid-secretref.out.yaml |  29 ++++
 .../securitypolicy-with-oidc.out.yaml         |  11 ++
 ...teway-with-listener-tls-terminate.out.yaml |  11 ++
 ...ultiple-backends-and-zero-weights.out.yaml |  11 ++
 .../testdata/tcproute-with-backend.out.yaml   |  11 ++
 .../tlsroute-attaching-to-gateway.out.yaml    |  11 ++
 .../tlsroute-invalid-reference-grant.out.yaml |  11 ++
 .../testdata/tlsroute-multiple.out.yaml       |  11 ++
 ...attaching-to-gateway-with-no-mode.out.yaml |  11 ++
 .../testdata/tlsroute-with-backend.out.yaml   |  11 ++
 ...her-namespace-allowed-by-refgrant.out.yaml |  11 ++
 .../tlsroute-with-empty-hostname.out.yaml     |  11 ++
 ...oute-with-empty-listener-hostname.out.yaml |  11 ++
 ...er-both-passthrough-and-cert-data.out.yaml |  11 ++
 .../tracing-merged-multiple-routes.out.yaml   |  11 ++
 .../testdata/tracing-multiple-routes.out.yaml |  20 +++
 .../tracing-sampling-fraction.out.yaml        |  11 ++
 ...ultiple-backends-and-zero-weights.out.yaml |  11 ++
 .../testdata/udproute-with-backend.out.yaml   |  11 ++
 internal/gatewayapi/translator.go             |   2 +-
 internal/gatewayapi/translator_test.go        | 126 ++++++++++++++++++
 .../kubernetes/proxy/resource.go              |  12 +-
 .../testdata/daemonsets/component-level.yaml  |   4 +
 .../proxy/testdata/daemonsets/custom.yaml     |   4 +
 .../testdata/daemonsets/default-env.yaml      |   4 +
 .../proxy/testdata/daemonsets/default.yaml    |   4 +
 .../daemonsets/disable-prometheus.yaml        |   4 +
 .../testdata/daemonsets/extension-env.yaml    |   4 +
 .../daemonsets/gateway-namespace-mode.yaml    |   4 +
 .../override-labels-and-annotations.yaml      |   4 +
 .../testdata/daemonsets/patch-daemonset.yaml  |   4 +
 .../testdata/daemonsets/shutdown-manager.yaml |   4 +
 .../proxy/testdata/daemonsets/volumes.yaml    |   4 +
 .../testdata/daemonsets/with-annotations.yaml |   4 +
 .../testdata/daemonsets/with-concurrency.yaml |   4 +
 .../testdata/daemonsets/with-extra-args.yaml  |   4 +
 .../daemonsets/with-image-pull-secrets.yaml   |   4 +
 .../proxy/testdata/daemonsets/with-name.yaml  |   4 +
 .../daemonsets/with-node-selector.yaml        |   4 +
 .../with-topology-spread-constraints.yaml     |   4 +
 .../proxy/testdata/deployments/bootstrap.yaml |   4 +
 .../testdata/deployments/component-level.yaml |   4 +
 .../proxy/testdata/deployments/custom-sa.yaml |   4 +
 .../proxy/testdata/deployments/custom.yaml    |   4 +
 .../custom_with_initcontainers.yaml           |   4 +
 .../testdata/deployments/default-env.yaml     |   4 +
 .../proxy/testdata/deployments/default.yaml   |   4 +
 .../deployments/disable-prometheus.yaml       |   4 +
 .../testdata/deployments/dual-stack.yaml      |   4 +
 .../testdata/deployments/extension-env.yaml   |   4 +
 .../deployments/gateway-namespace-mode.yaml   |   4 +
 .../proxy/testdata/deployments/ipv6.yaml      |   4 +
 .../override-labels-and-annotations.yaml      |   4 +
 .../deployments/patch-deployment.yaml         |   4 +
 .../deployments/shutdown-manager.yaml         |   4 +
 .../proxy/testdata/deployments/volumes.yaml   |   4 +
 .../deployments/with-annotations.yaml         |   4 +
 .../deployments/with-concurrency.yaml         |   4 +
 .../deployments/with-empty-memory-limits.yaml |   4 +
 .../testdata/deployments/with-extra-args.yaml |   4 +
 .../deployments/with-image-pull-secrets.yaml  |   4 +
 .../proxy/testdata/deployments/with-name.yaml |   4 +
 .../deployments/with-node-selector.yaml       |   4 +
 .../with-topology-spread-constraints.yaml     |   4 +
 .../gateway-namespace-mode/deployment.yaml    |   8 ++
 internal/ir/xds.go                            |  67 ++++++++--
 internal/ir/xds_test.go                       |  12 +-
 internal/ir/zz_generated.deepcopy.go          |  96 +++++++++++--
 internal/provider/kubernetes/controller.go    |  54 ++++++++
 internal/provider/kubernetes/predicates.go    |  31 ++++-
 internal/xds/translator/cluster.go            |  67 +++++++---
 internal/xds/translator/globalresources.go    |  17 ++-
 internal/xds/translator/route.go              |  10 +-
 .../http-route-proxy-cluster-infra.yaml       |  33 +++++
 .../xds-ir/http-route-zonal-lb-routing.yaml   |  69 ++++++++++
 ...route-zonal-routing-weighted-clusters.yaml |   6 +-
 .../in/xds-ir/http-route-zonal-routing.yaml   |   6 +-
 ...tp-route-proxy-cluster-infra.clusters.yaml |  48 +++++++
 ...p-route-proxy-cluster-infra.endpoints.yaml |  30 +++++
 ...p-route-proxy-cluster-infra.listeners.yaml |  33 +++++
 ...http-route-proxy-cluster-infra.routes.yaml |  14 ++
 .../http-route-zonal-lb-routing.clusters.yaml |  77 +++++++++++
 ...http-route-zonal-lb-routing.endpoints.yaml |  58 ++++++++
 ...http-route-zonal-lb-routing.listeners.yaml |  33 +++++
 .../http-route-zonal-lb-routing.routes.yaml   |  36 +++++
 ...al-routing-weighted-clusters.clusters.yaml |  31 +----
 ...l-routing-weighted-clusters.endpoints.yaml |  10 +-
 ...onal-routing-weighted-clusters.routes.yaml |   8 +-
 .../http-route-zonal-routing.clusters.yaml    |   5 +-
 .../http-route-zonal-routing.endpoints.yaml   |   6 +-
 internal/xds/translator/translator.go         |   3 +-
 472 files changed, 6155 insertions(+), 127 deletions(-)
 create mode 100644 internal/gatewayapi/proxyinfracluster.go
 create mode 100644 internal/xds/translator/testdata/in/xds-ir/http-route-proxy-cluster-infra.yaml
 create mode 100644 internal/xds/translator/testdata/in/xds-ir/http-route-zonal-lb-routing.yaml
 create mode 100644 internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.clusters.yaml
 create mode 100644 internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.endpoints.yaml
 create mode 100644 internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.listeners.yaml
 create mode 100644 internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.routes.yaml
 create mode 100644 internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.clusters.yaml
 create mode 100644 internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.endpoints.yaml
 create mode 100644 internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.listeners.yaml
 create mode 100644 internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.routes.yaml

diff --git a/internal/gatewayapi/globalresources.go b/internal/gatewayapi/globalresources.go
index ce252f75a5..d2f6c07a09 100644
--- a/internal/gatewayapi/globalresources.go
+++ b/internal/gatewayapi/globalresources.go
@@ -18,7 +18,7 @@ import (
 const envoyTLSSecretName = "envoy"
 
 // ProcessGlobalResources processes global resources that are not tied to a specific listener or route
-func (t *Translator) ProcessGlobalResources(resources *resource.Resources, xdsIRs resource.XdsIRMap) error {
+func (t *Translator) ProcessGlobalResources(acceptedGateways []*GatewayContext, resources *resource.Resources, xdsIRs resource.XdsIRMap) error {
 	// Get the envoy client TLS secret. It is used for envoy to establish a TLS connection with control plane components,
 	// including the rate limit server and the wasm HTTP server.
 	envoyTLSSecret := resources.GetSecret(t.ControllerNamespace, envoyTLSSecretName)
@@ -36,6 +36,10 @@ func (t *Translator) ProcessGlobalResources(resources *resource.Resources, xdsIR
 			}
 		}
 	}
+
+	// Process Cluster for EnvoyProxy service
+	t.ProcessProxyCluster(acceptedGateways, resources, xdsIRs)
+
 	return nil
 }
 
diff --git a/internal/gatewayapi/proxyinfracluster.go b/internal/gatewayapi/proxyinfracluster.go
new file mode 100644
index 0000000000..59ef829b77
--- /dev/null
+++ b/internal/gatewayapi/proxyinfracluster.go
@@ -0,0 +1,92 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package gatewayapi
+
+import (
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/utils/ptr"
+
+	"github.com/envoyproxy/gateway/internal/envoygateway/config"
+	"github.com/envoyproxy/gateway/internal/gatewayapi/resource"
+	"github.com/envoyproxy/gateway/internal/ir"
+	"github.com/envoyproxy/gateway/internal/utils"
+)
+
+func (t *Translator) ProcessProxyCluster(acceptedGateways []*GatewayContext, resources *resource.Resources, xdsIR resource.XdsIRMap) {
+	for _, g := range acceptedGateways {
+		if g == nil || g.Gateway == nil {
+			continue
+		}
+
+		irKey := t.getIRKey(g.Gateway)
+		/*
+			if xdsIR[irKey].ProxyInfraCluster != nil {
+				continue
+			}
+		*/
+		if ptr.Deref(xdsIR[irKey].GlobalResources, ir.GlobalResources{}).ProxyInfraCluster != nil {
+			continue
+		}
+
+		var svcName string
+		if t.MergeGateways {
+			svcName = t.expectedResourceHashedName(string(t.GatewayClassName))
+		} else {
+			svcName = t.expectedResourceHashedName(fmt.Sprintf("%s/%s", g.Namespace, g.Name))
+		}
+
+		svc := resources.GetService(t.ControllerNamespace, svcName)
+		if svc == nil {
+			return
+		}
+
+		ds := t.processEnvoyServiceDestinationSetting(svc.Name, svc, resources)
+		ds.IPFamily = getServiceIPFamily(svc)
+
+		if xdsIR[irKey].GlobalResources == nil {
+			xdsIR[irKey].GlobalResources = &ir.GlobalResources{}
+		}
+		xdsIR[irKey].GlobalResources.ProxyInfraCluster = &ir.ProxyInfraCluster{
+			Name:        svc.Name,
+			Destination: ds,
+		}
+
+		if t.MergeGateways {
+			return
+		}
+	}
+}
+
+// expectedResourceHashedName returns expected resource hashed name including up to the 48 characters of the original name.
+func (t *Translator) expectedResourceHashedName(name string) string {
+	hashedName := utils.GetHashedName(name, 48)
+	return fmt.Sprintf("%s-%s", config.EnvoyPrefix, hashedName)
+}
+
+func (t *Translator) processEnvoyServiceDestinationSetting(
+	name string,
+	service *corev1.Service,
+	resources *resource.Resources,
+) *ir.DestinationSetting {
+	var (
+		endpoints []*ir.DestinationEndpoint
+		addrType  *ir.DestinationAddressType
+	)
+
+	endpointSlices := resources.GetEndpointSlicesForBackend(service.Namespace, service.Name, resource.KindService)
+	endpoints, addrType = getIREndpointsFromEndpointSlices(endpointSlices, service.Spec.Ports[0].Name, service.Spec.Ports[0].Protocol)
+
+	return &ir.DestinationSetting{
+		Name:        name,
+		Protocol:    ir.HTTP,
+		Endpoints:   endpoints,
+		AddressType: addrType,
+		// might need to come back to this
+		// ZoneAwareRoutingEnabled: true,
+	}
+}
diff --git a/internal/gatewayapi/route.go b/internal/gatewayapi/route.go
index 974f2cebc4..eddb2dd692 100644
--- a/internal/gatewayapi/route.go
+++ b/internal/gatewayapi/route.go
@@ -1418,7 +1418,7 @@ func (t *Translator) processDestination(name string, backendRefContext BackendRe
 		ds = t.processServiceDestinationSetting(name, backendRef.BackendObjectReference, backendNamespace, protocol, resources, envoyProxy)
 		svc := resources.GetService(backendNamespace, string(backendRef.Name))
 		ds.IPFamily = getServiceIPFamily(svc)
-		ds.ZoneAwareRouting = processZoneAwareRouting(svc)
+		ds.PreferLocal = processPreferLocalZone(svc)
 
 	case egv1a1.KindBackend:
 		ds = t.processBackendDestinationSetting(name, backendRef.BackendObjectReference, backendNamespace, protocol, resources)
@@ -1591,12 +1591,12 @@ func (t *Translator) processServiceDestinationSetting(
 	}
 
 	return &ir.DestinationSetting{
-		Name:             name,
-		Protocol:         protocol,
-		Endpoints:        endpoints,
-		AddressType:      addrType,
-		ZoneAwareRouting: processZoneAwareRouting(service),
-		Metadata:         buildResourceMetadata(service, ptr.To(gwapiv1.SectionName(strconv.Itoa(int(*backendRef.Port))))),
+		Name:        name,
+		Protocol:    protocol,
+		Endpoints:   endpoints,
+		AddressType: addrType,
+		PreferLocal: processPreferLocalZone(service),
+		Metadata:    buildResourceMetadata(service, ptr.To(gwapiv1.SectionName(strconv.Itoa(int(*backendRef.Port))))),
 	}
 }
 
@@ -1616,14 +1616,17 @@ func getBackendFilters(routeType gwapiv1.Kind, backendRefContext BackendRefConte
 	return nil
 }
 
-func processZoneAwareRouting(svc *corev1.Service) *ir.ZoneAwareRouting {
+func processPreferLocalZone(svc *corev1.Service) *ir.PreferLocalZone {
 	if svc == nil {
 		return nil
 	}
 
 	if trafficDist := svc.Spec.TrafficDistribution; trafficDist != nil {
-		return &ir.ZoneAwareRouting{
-			MinSize: 1,
+		return &ir.PreferLocalZone{
+			MinEndpointsThreshold: ptr.To[uint64](1),
+			Force: &ir.ForceLocalZone{
+				MinEndpointsInZoneThreshold: ptr.To[uint32](1),
+			},
 		}
 	}
 
@@ -1632,8 +1635,11 @@ func processZoneAwareRouting(svc *corev1.Service) *ir.ZoneAwareRouting {
 	// https://kubernetes.io/docs/concepts/services-networking/topology-aware-routing/#enabling-topology-aware-routing
 	// https://github.com/kubernetes/kubernetes/blob/9d9e1afdf78bce0a517cc22557457f942040ca19/staging/src/k8s.io/endpointslice/utils.go#L355-L368
 	if val, ok := svc.Annotations[corev1.AnnotationTopologyMode]; ok && val == "Auto" || val == "auto" {
-		return &ir.ZoneAwareRouting{
-			MinSize: 3,
+		return &ir.PreferLocalZone{
+			MinEndpointsThreshold: ptr.To[uint64](3),
+			Force: &ir.ForceLocalZone{
+				MinEndpointsInZoneThreshold: ptr.To[uint32](3),
+			},
 		}
 	}
 
diff --git a/internal/gatewayapi/testdata/accesslog-als-backend.out.yaml b/internal/gatewayapi/testdata/accesslog-als-backend.out.yaml
index 1d655683d0..233a345cf4 100644
--- a/internal/gatewayapi/testdata/accesslog-als-backend.out.yaml
+++ b/internal/gatewayapi/testdata/accesslog-als-backend.out.yaml
@@ -198,6 +198,17 @@ xdsIR:
           k8s.cluster.name: cluster-1
         text: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/accesslog.out.yaml b/internal/gatewayapi/testdata/accesslog.out.yaml
index 550830780f..1da3bc882a 100644
--- a/internal/gatewayapi/testdata/accesslog.out.yaml
+++ b/internal/gatewayapi/testdata/accesslog.out.yaml
@@ -124,6 +124,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backend-invalid-feature-disabled.out.yaml b/internal/gatewayapi/testdata/backend-invalid-feature-disabled.out.yaml
index 91c33b5200..ade109e71c 100644
--- a/internal/gatewayapi/testdata/backend-invalid-feature-disabled.out.yaml
+++ b/internal/gatewayapi/testdata/backend-invalid-feature-disabled.out.yaml
@@ -156,6 +156,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backend-with-endpoint-zones.out.yaml b/internal/gatewayapi/testdata/backend-with-endpoint-zones.out.yaml
index 5ad240562e..6c4ce85868 100644
--- a/internal/gatewayapi/testdata/backend-with-endpoint-zones.out.yaml
+++ b/internal/gatewayapi/testdata/backend-with-endpoint-zones.out.yaml
@@ -142,6 +142,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backend-with-fallback.out.yaml b/internal/gatewayapi/testdata/backend-with-fallback.out.yaml
index cf6beeb9ad..ff661c092f 100644
--- a/internal/gatewayapi/testdata/backend-with-fallback.out.yaml
+++ b/internal/gatewayapi/testdata/backend-with-fallback.out.yaml
@@ -141,6 +141,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backend-with-skip-tls-verify.out.yaml b/internal/gatewayapi/testdata/backend-with-skip-tls-verify.out.yaml
index e27e840eb2..b472c00883 100644
--- a/internal/gatewayapi/testdata/backend-with-skip-tls-verify.out.yaml
+++ b/internal/gatewayapi/testdata/backend-with-skip-tls-verify.out.yaml
@@ -157,6 +157,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-across-ns.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-across-ns.out.yaml
index 3ef92d1f08..3936a9ee47 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-across-ns.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-across-ns.out.yaml
@@ -125,6 +125,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-ca-only-secret.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-ca-only-secret.out.yaml
index 225f41449a..74c29bce6a 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-ca-only-secret.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-ca-only-secret.out.yaml
@@ -135,6 +135,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml
index 03a7fd0b0c..a39ce0b8f9 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml
@@ -135,6 +135,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml
index cf47473dda..26fb343e0d 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml
@@ -273,6 +273,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
@@ -351,6 +365,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-btls2-41698b8b
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls2-41698b8b
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml
index c00a0389f8..612f4d5d54 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml
@@ -230,6 +230,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
index e5abcf72b2..261e2dff38 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
@@ -136,6 +136,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-multiple-targets.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-multiple-targets.out.yaml
index f420579c9f..5d12bce2c2 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-multiple-targets.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-multiple-targets.out.yaml
@@ -177,6 +177,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml
index 777965f8f6..b969769191 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml
@@ -143,6 +143,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-subjectaltnames.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-subjectaltnames.out.yaml
index 0471bdf09f..ddc3948daf 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-subjectaltnames.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-subjectaltnames.out.yaml
@@ -140,6 +140,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml
index b1fe3c44c3..bcec1faf77 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml
@@ -132,6 +132,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml
index 48a6fe789b..fc629eab77 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml
@@ -256,6 +256,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -313,6 +319,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml
index 70bc1add68..4e93a0f7c1 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml
@@ -256,6 +256,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -313,6 +319,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml
index b388d8ddc1..eb9275aa1d 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml
@@ -260,6 +260,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -317,6 +323,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-compression.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-compression.out.yaml
index 045267de97..7c939bb7e8 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-compression.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-compression.out.yaml
@@ -133,6 +133,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-connect-proxy.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-connect-proxy.out.yaml
index 303e76cec0..01ec77b222 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-connect-proxy.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-connect-proxy.out.yaml
@@ -132,6 +132,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-connect-terminate.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-connect-terminate.out.yaml
index 37fd704b24..44e6201dca 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-connect-terminate.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-connect-terminate.out.yaml
@@ -134,6 +134,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
index c598de6872..7d2fd94068 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
@@ -378,6 +378,17 @@ xdsIR:
       - format: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
         path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-spdy.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-spdy.out.yaml
index b28929d6ea..286b465497 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-spdy.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-spdy.out.yaml
@@ -132,6 +132,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-websocket.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-websocket.out.yaml
index df214b9750..2fb37903b5 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-websocket.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-websocket.out.yaml
@@ -133,6 +133,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-override-replace.out.yaml
index be383014b5..e82fd54c69 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-override-replace.out.yaml
@@ -275,6 +275,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml
index b5029d8353..16a111b7f9 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml
@@ -256,6 +256,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -313,6 +319,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
index 839a7ce902..3b7adbe71b 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
@@ -532,6 +532,23 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-another-namespace-not-same-namespace-gateway-8778384d
+          protocol: HTTP
+        name: envoy-another-namespace-not-same-namespace-gateway-8778384d
     http:
     - address: 0.0.0.0
       hostnames:
@@ -556,6 +573,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -612,6 +635,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
index c0abf0effe..2be9bac303 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
@@ -336,6 +336,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -394,6 +400,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml
index 05ec4c39f0..48548290b0 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml
@@ -311,6 +311,11 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -403,6 +408,19 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml
index f738bc2e2e..bae38f9222 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml
@@ -304,6 +304,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -392,6 +398,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml
index aa1c8a7c6f..d96b4b3dd6 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml
@@ -306,6 +306,11 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -396,6 +401,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml
index 8e373838e5..34e3bee389 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml
@@ -306,6 +306,11 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -401,6 +406,19 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml
index 340b6fc3d0..3adb11bf69 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml
@@ -280,6 +280,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -346,6 +352,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge.out.yaml
index 7ea51b707a..5728824a9a 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge.out.yaml
@@ -257,6 +257,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-tracing.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-tracing.out.yaml
index dfa695646c..e1e7ad4086 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-tracing.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-tracing.out.yaml
@@ -150,6 +150,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-use-client-protocol.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-use-client-protocol.out.yaml
index 2f1a5f7adc..ca01222993 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-use-client-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-use-client-protocol.out.yaml
@@ -130,6 +130,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
index 995c65225a..5c4a0cdc6a 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
@@ -318,6 +318,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -370,6 +376,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
index f96906fa1b..56305cab5f 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
@@ -260,6 +260,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -317,6 +323,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml
index 8a65d72148..37508158fe 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml
@@ -325,6 +325,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -383,6 +389,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
index e7433b7dae..31cfa9270c 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
@@ -686,6 +686,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -827,6 +833,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml
index be1cf81063..cb980e6906 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml
@@ -258,6 +258,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -314,6 +320,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-httproute-timeout.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-httproute-timeout.out.yaml
index ace5479bbc..c2062cda6f 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-httproute-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-httproute-timeout.out.yaml
@@ -211,6 +211,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer-invalid-consistent-hash-table-size.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer-invalid-consistent-hash-table-size.out.yaml
index b4ebed9fb1..8ecd0cd277 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer-invalid-consistent-hash-table-size.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer-invalid-consistent-hash-table-size.out.yaml
@@ -204,6 +204,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
index a203cdb788..f2c59c0ad0 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
@@ -428,6 +428,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -481,6 +487,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
index f7cd9a449e..8b6837b885 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
@@ -153,6 +153,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-distinct-match-type.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-distinct-match-type.out.yaml
index f3569071b3..a40e86348e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-distinct-match-type.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-distinct-match-type.out.yaml
@@ -153,6 +153,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
index eed4a47cae..499218bb65 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
@@ -157,6 +157,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
index ac24fe90ad..2954ad1fd0 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
@@ -160,6 +160,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
index ffbf08f59b..bc2b349872 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
@@ -156,6 +156,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml
index 0796c24972..9f9a8e3758 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml
@@ -322,6 +322,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -379,6 +385,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
index 79cbdc8fc4..3c92b93f26 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
@@ -252,6 +252,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -305,6 +311,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-distinct-invert.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-distinct-invert.out.yaml
index b434227aaf..56bcb80457 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-distinct-invert.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-distinct-invert.out.yaml
@@ -138,6 +138,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-966d2c13
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-966d2c13
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
index 9d371c8393..93ac090862 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
@@ -139,6 +139,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
index dac03a71a3..ba5ce4ad81 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
@@ -289,6 +289,11 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -362,6 +367,19 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml
index 7f6ad9abd5..3bdcc0948a 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml
@@ -301,6 +301,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
@@ -353,6 +359,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-2-5e70ed84
+          protocol: HTTP
+        name: envoy-default-gateway-2-5e70ed84
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml
index b60b4342be..06ed7e0075 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml
@@ -448,6 +448,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
@@ -522,6 +528,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-2-5e70ed84
+          protocol: HTTP
+        name: envoy-default-gateway-2-5e70ed84
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
index 49f939ba57..73c965204d 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
@@ -410,6 +410,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -470,6 +476,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
index 811ecba92e..c938f29ad4 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
@@ -172,6 +172,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml
index c433276023..fa1e29cdeb 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml
@@ -290,6 +290,11 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -364,6 +369,19 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml
index 9e98f03241..94e1577f95 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml
@@ -236,6 +236,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-tcp-gateway-1ec60381
+          protocol: HTTP
+        name: envoy-default-tcp-gateway-1ec60381
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml
index c6074b303e..e408d51c0e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml
@@ -309,6 +309,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-tcp-gateway-1ec60381
+          protocol: HTTP
+        name: envoy-default-tcp-gateway-1ec60381
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
index 32ab0d1af2..166222cb6e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
@@ -256,6 +256,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -311,6 +317,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
index b76c76fd40..3c60c49f90 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
@@ -130,6 +130,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml
index 2b9a66db58..7c51784ebd 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml
@@ -244,6 +244,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -302,6 +308,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
index 64fe0b76e3..9d21ad9684 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
@@ -264,6 +264,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -322,6 +328,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-format-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-format-error.out.yaml
index 4a72f28057..46177b8d7e 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-format-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-format-error.out.yaml
@@ -162,6 +162,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-out-of-range-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-out-of-range-error.out.yaml
index 5234f9f21d..b0c3bc5187 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-out-of-range-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-out-of-range-error.out.yaml
@@ -163,6 +163,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit.out.yaml
index 1a068ce8a8..950abc3e54 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit.out.yaml
@@ -167,6 +167,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       connection:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.out.yaml
index c5f3736a3b..543e7d9b4a 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.out.yaml
@@ -265,6 +265,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       clientIPDetection:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.out.yaml
index 4792808e1e..e0b412648d 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.out.yaml
@@ -164,6 +164,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit.out.yaml
index e36dc727f1..4b845e8e82 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit.out.yaml
@@ -164,6 +164,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       connection:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-for-tcp-listeners.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-for-tcp-listeners.out.yaml
index 4345a30879..2fac2f3f46 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-for-tcp-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-for-tcp-listeners.out.yaml
@@ -187,6 +187,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml
index 8dad31c9da..b19ac49d6a 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml
@@ -120,6 +120,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       headers:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml
index 9d76b964c0..989c5a7648 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml
@@ -144,6 +144,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       headers:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml
index 302860832b..51e4e94145 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml
@@ -92,6 +92,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       healthCheck:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
index 09ad2067aa..59ff2433df 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
@@ -457,6 +457,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml
index ffb5eda2bc..8a1a59ac95 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml
@@ -166,6 +166,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml
index 55ba1580d6..9bf6d2c145 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml
@@ -134,6 +134,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout-with-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout-with-error.out.yaml
index 1b4adb72eb..86f7ddcbe5 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout-with-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout-with-error.out.yaml
@@ -93,6 +93,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-966d2c13
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-966d2c13
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout.out.yaml
index 8fd8b7e739..5c5456d9f4 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout.out.yaml
@@ -131,6 +131,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-966d2c13
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-966d2c13
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml
index 498c4393c5..a2221cc050 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml
@@ -389,6 +389,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       headers:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml
index d7fd002afc..254cd9713f 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml
@@ -486,6 +486,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -536,6 +542,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -571,6 +583,23 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml
index a08caec04f..fa6bfdd444 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml
@@ -563,6 +563,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       headers:
@@ -621,6 +627,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       headers:
@@ -661,6 +673,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       headers:
@@ -703,6 +721,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-4-a293650b
     http:
     - address: 0.0.0.0
       headers:
@@ -747,6 +771,29 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-5-e35ee57f
     http:
     - address: 0.0.0.0
       headers:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml
index 75aa4ac362..30bf1cdb37 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml
@@ -550,6 +550,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       headers:
@@ -608,6 +614,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       headers:
@@ -648,6 +660,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       headers:
@@ -688,6 +706,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-4-a293650b
     http:
     - address: 0.0.0.0
       headers:
@@ -728,6 +752,29 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-5-e35ee57f
     http:
     - address: 0.0.0.0
       headers:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml
index 0bf546dc4c..6df8fd0ef2 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml
@@ -238,6 +238,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -288,6 +294,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-path-settings.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-path-settings.out.yaml
index f0f25f8e1e..a7f3c897ce 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-path-settings.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-path-settings.out.yaml
@@ -129,6 +129,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml
index 02d33decf5..b5b7ee3e1e 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml
@@ -205,6 +205,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -232,6 +238,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case.out.yaml
index cb238c66ae..a6066e45f3 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case.out.yaml
@@ -129,6 +129,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol.out.yaml
index 5a33f4837e..3240cb1aca 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol.out.yaml
@@ -129,6 +129,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       enableProxyProtocol: true
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-ratelimitheaders.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-ratelimitheaders.out.yaml
index 7870406536..e9136150c7 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-ratelimitheaders.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-ratelimitheaders.out.yaml
@@ -129,6 +129,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       headers:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
index e4086f621f..2f21fad0bd 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
@@ -517,6 +517,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -541,6 +547,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -569,6 +581,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
@@ -593,6 +611,26 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-not-same-namespace-not-same-namespace-gateway-f21c7840
+          protocol: HTTP
+        name: envoy-not-same-namespace-not-same-namespace-gateway-f21c7840
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-tcp-keepalive.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-tcp-keepalive.out.yaml
index 829a19a83d..45a52c9b79 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-tcp-keepalive.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-tcp-keepalive.out.yaml
@@ -164,6 +164,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout-with-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout-with-error.out.yaml
index 550da47bc8..afe041ba53 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout-with-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout-with-error.out.yaml
@@ -93,6 +93,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-966d2c13
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-966d2c13
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml
index c6b88230fc..7b7f62a505 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml
@@ -131,6 +131,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-966d2c13
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-966d2c13
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml
index 50f18206e3..e7f7b355f5 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml
@@ -333,6 +333,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -390,6 +396,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -422,6 +434,23 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-trailers.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-trailers.out.yaml
index b93193ecd4..7359f5a74c 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-trailers.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-trailers.out.yaml
@@ -128,6 +128,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/conflicting-policies.out.yaml b/internal/gatewayapi/testdata/conflicting-policies.out.yaml
index dc4830c2b3..71b9ba7b36 100644
--- a/internal/gatewayapi/testdata/conflicting-policies.out.yaml
+++ b/internal/gatewayapi/testdata/conflicting-policies.out.yaml
@@ -268,6 +268,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/custom-filter-order.out.yaml b/internal/gatewayapi/testdata/custom-filter-order.out.yaml
index ecd3827acc..452d19e6d9 100644
--- a/internal/gatewayapi/testdata/custom-filter-order.out.yaml
+++ b/internal/gatewayapi/testdata/custom-filter-order.out.yaml
@@ -233,6 +233,16 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/disable-accesslog.out.yaml b/internal/gatewayapi/testdata/disable-accesslog.out.yaml
index d27a6b0c9b..8169fd0585 100644
--- a/internal/gatewayapi/testdata/disable-accesslog.out.yaml
+++ b/internal/gatewayapi/testdata/disable-accesslog.out.yaml
@@ -122,6 +122,17 @@ infraIR:
       namespace: envoy-gateway-system
 xdsIR:
   envoy-gateway/gateway-1:
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
index 76aac404e6..38764bc6a4 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
@@ -82,6 +82,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
index aeef477a02..bf03529c61 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
@@ -271,6 +271,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
index c76c137b0a..f1dfd50d08 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
@@ -532,6 +532,23 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-another-namespace-not-same-namespace-gateway-8778384d
+          protocol: HTTP
+        name: envoy-another-namespace-not-same-namespace-gateway-8778384d
     http:
     - address: 0.0.0.0
       hostnames:
@@ -556,6 +573,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -612,6 +635,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
index 6e6c4b1430..82fc327406 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
@@ -133,6 +133,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
index 1045a3b315..dd430428e3 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
@@ -133,6 +133,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
index 25298d0d74..0df0031657 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
@@ -135,6 +135,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
index 98727d7849..4b16b5ea20 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
@@ -134,6 +134,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
index d0b17187ee..6945b1b6ab 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
@@ -294,6 +294,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml
index 2266c1df4a..424e55f90e 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml
@@ -177,6 +177,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
index 56fe0a5f9e..599407e306 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
@@ -283,6 +283,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml
index bfa487328f..2bd14f825f 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml
@@ -312,6 +312,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml
index c825c8f25a..6936c17b23 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml
@@ -145,6 +145,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml
index 4747ef8a9b..f0b750fb92 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml
@@ -210,6 +210,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml
index 3e4cacd7f4..f1b5f7b2fd 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml
@@ -391,6 +391,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml
index cfbe145cd1..8bcc44afc3 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml
@@ -212,6 +212,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-env-vars.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-env-vars.out.yaml
index 8190076e67..010c19c431 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-env-vars.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-env-vars.out.yaml
@@ -247,6 +247,16 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-targetrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-targetrefs.out.yaml
index a682678855..01a02913f5 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-targetrefs.out.yaml
@@ -215,6 +215,16 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm.out.yaml
index 003991cc51..fa3266a92b 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm.out.yaml
@@ -249,6 +249,16 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-cross-ns-target.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-cross-ns-target.out.yaml
index bcc920e1e5..a8b448e942 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-cross-ns-target.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-cross-ns-target.out.yaml
@@ -64,6 +64,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
index 7cf39316cf..60e3870c65 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
@@ -90,6 +90,17 @@ xdsIR:
             status: "False"
             type: Accepted
           controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
index 253f4350cf..8487721fbf 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
@@ -92,6 +92,17 @@ xdsIR:
             status: "False"
             type: Accepted
           controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
index 428d54ae1b..c01881a53f 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
@@ -83,6 +83,17 @@ xdsIR:
             status: "False"
             type: Accepted
           controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
index 05fb4d576b..3384b17244 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
@@ -119,6 +119,17 @@ xdsIR:
             status: "True"
             type: Accepted
           controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-valid.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-valid.out.yaml
index bc9f47e444..8a51b955a6 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-valid.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-valid.out.yaml
@@ -113,6 +113,17 @@ xdsIR:
             status: "True"
             type: Accepted
           controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml
index d903d96603..9ff21d8cd8 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml
@@ -205,6 +205,17 @@ xdsIR:
             protocol: GRPC
         name: envoy-gateway-system/test
         type: TCP
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-backend-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-backend-invalid.out.yaml
index b4686d9514..48f7e4195a 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-backend-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-backend-invalid.out.yaml
@@ -145,6 +145,17 @@ infraIR:
       namespace: envoy-gateway-system
 xdsIR:
   envoy-gateway/gateway-1:
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-backend.out.yaml
index 4bcdc29f5d..1fb23f97f1 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-backend.out.yaml
@@ -165,6 +165,17 @@ xdsIR:
       - format: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
         path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.out.yaml
index 9bc128427d..ac0b112627 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.out.yaml
@@ -146,6 +146,17 @@ infraIR:
       namespace: envoy-gateway-system
 xdsIR:
   envoy-gateway/gateway-1:
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel.out.yaml
index 078d94a6ce..12f4d4d568 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel.out.yaml
@@ -196,6 +196,17 @@ xdsIR:
         format: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
         path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
index 54d161e1be..b41bc7198f 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
@@ -131,6 +131,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json.out.yaml
index 52a2dead69..41506085fc 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json.out.yaml
@@ -137,6 +137,17 @@ xdsIR:
           duration: '%DURATION%'
           protocol: '%PROTOCOL%'
         path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-types.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-types.out.yaml
index a3f6cc0073..49aba1d1ab 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-types.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-types.out.yaml
@@ -508,6 +508,17 @@ xdsIR:
       - format: |
           this is a Global log
         path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
index dc3d16f95a..5b29655ee8 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
@@ -131,6 +131,17 @@ infraIR:
 xdsIR:
   envoy-gateway/gateway-1:
     accessLog: {}
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml
index e457ac11ee..ff7e9dc944 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml
@@ -339,6 +339,17 @@ xdsIR:
       - format: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
         path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-without-format.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-without-format.out.yaml
index 53e836c775..b8d80eaf34 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-without-format.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-without-format.out.yaml
@@ -223,6 +223,17 @@ xdsIR:
             weight: 1
         resources:
           k8s.cluster.name: cluster-1
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog.out.yaml
index 33e103ae05..a6629d4f2b 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog.out.yaml
@@ -235,6 +235,17 @@ xdsIR:
       - format: |
           [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
         path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml
index 13ec7edfe8..dde8928c34 100644
--- a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml
@@ -115,6 +115,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml
index 2b9c50ff16..7bab55618f 100644
--- a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml
@@ -110,6 +110,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-metric-backend-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-metric-backend-invalid.out.yaml
index 2f6ab10cb7..9277838ba1 100644
--- a/internal/gatewayapi/testdata/envoyproxy-metric-backend-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-metric-backend-invalid.out.yaml
@@ -138,6 +138,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-metric-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-metric-backend.out.yaml
index 1a27fc8f2e..2033adafe7 100644
--- a/internal/gatewayapi/testdata/envoyproxy-metric-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-metric-backend.out.yaml
@@ -131,6 +131,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-metric-enabled-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-metric-enabled-backend.out.yaml
index e8f5188c58..192195730a 100644
--- a/internal/gatewayapi/testdata/envoyproxy-metric-enabled-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-metric-enabled-backend.out.yaml
@@ -134,6 +134,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-preserve-route-order.out.yaml b/internal/gatewayapi/testdata/envoyproxy-preserve-route-order.out.yaml
index 7d0e45dc46..1ed76b65dc 100644
--- a/internal/gatewayapi/testdata/envoyproxy-preserve-route-order.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-preserve-route-order.out.yaml
@@ -160,6 +160,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml
index a56756b74a..621550d1f4 100644
--- a/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml
@@ -286,6 +286,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml b/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml
index 32be3c8af1..e9c9f65815 100644
--- a/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml
@@ -115,6 +115,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml b/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml
index 8c319d51b4..6ec375dbd1 100644
--- a/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml
@@ -110,6 +110,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml
index de8d3d5078..1f95311a89 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml
@@ -233,6 +233,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-tls-e5408cf3
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-tls-e5408cf3
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml
index a2282a87db..3fe6a03da2 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml
@@ -232,6 +232,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-tls-e5408cf3
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-tls-e5408cf3
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml
index feb49ffd1f..eb7cc1ea3c 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml
@@ -229,6 +229,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-tls-e5408cf3
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-tls-e5408cf3
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tracing-backend-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tracing-backend-invalid.out.yaml
index d8356d1fc4..4d31590c36 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tracing-backend-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tracing-backend-invalid.out.yaml
@@ -138,6 +138,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tracing-backend-uds.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tracing-backend-uds.out.yaml
index b797b32849..0ed4dbb3db 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tracing-backend-uds.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tracing-backend-uds.out.yaml
@@ -179,6 +179,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml
index d305353ee3..d49cecd062 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml
@@ -158,6 +158,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-valid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-valid.out.yaml
index 53463abc6e..3dc708cc51 100644
--- a/internal/gatewayapi/testdata/envoyproxy-valid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-valid.out.yaml
@@ -122,6 +122,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyproxy-with-statname.out.yaml b/internal/gatewayapi/testdata/envoyproxy-with-statname.out.yaml
index 916e118b86..5754348d91 100644
--- a/internal/gatewayapi/testdata/envoyproxy-with-statname.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-with-statname.out.yaml
@@ -168,6 +168,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
index 721f986244..6ee615cb2c 100644
--- a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
@@ -99,6 +99,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
index fb9b307ad5..3c80546ef9 100644
--- a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
@@ -99,6 +99,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-http-listener-with-hostname-intersection.out.yaml b/internal/gatewayapi/testdata/gateway-http-listener-with-hostname-intersection.out.yaml
index b2ec5319de..c64f2454db 100644
--- a/internal/gatewayapi/testdata/gateway-http-listener-with-hostname-intersection.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-http-listener-with-hostname-intersection.out.yaml
@@ -175,6 +175,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml b/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml
index 2e0598bc0b..42df949952 100644
--- a/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml
@@ -117,6 +117,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml b/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml
index 4f63b9aa46..4077bcb62d 100644
--- a/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml
@@ -288,6 +288,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
@@ -342,6 +348,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-2-5e70ed84
+          protocol: HTTP
+        name: envoy-default-gateway-2-5e70ed84
     http:
     - address: 0.0.0.0
       hostnames:
@@ -396,6 +408,23 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-test-ns-gateway-3-3ac1f097
+          protocol: HTTP
+        name: envoy-test-ns-gateway-3-3ac1f097
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-addresses-with-ipaddress.out.yaml b/internal/gatewayapi/testdata/gateway-with-addresses-with-ipaddress.out.yaml
index 3a22369ee3..c2f98c5b12 100644
--- a/internal/gatewayapi/testdata/gateway-with-addresses-with-ipaddress.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-addresses-with-ipaddress.out.yaml
@@ -69,6 +69,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-infrastructure-parametersref.out.yaml b/internal/gatewayapi/testdata/gateway-with-infrastructure-parametersref.out.yaml
index ed7c237730..a281b54977 100644
--- a/internal/gatewayapi/testdata/gateway-with-infrastructure-parametersref.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-infrastructure-parametersref.out.yaml
@@ -126,6 +126,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-does-not-exist.out.yaml b/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-does-not-exist.out.yaml
index fdd2722631..3fa0a6183c 100644
--- a/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-does-not-exist.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-does-not-exist.out.yaml
@@ -109,6 +109,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-fallback.out.yaml b/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-fallback.out.yaml
index 68ae922686..424af5cb41 100644
--- a/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-fallback.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-fallback.out.yaml
@@ -126,6 +126,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
index 82dc74b2ff..26e1d6f54d 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
@@ -94,6 +94,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
index 0b4895842b..40662f8433 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
@@ -85,6 +85,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
index 80c1de4b8d..25a338280a 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
@@ -87,6 +87,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
index 697df5ef73..56465c120b 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
@@ -85,6 +85,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
index d9350b4037..aebdfa24b3 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
@@ -85,6 +85,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
index 49144915b7..870fb825d8 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
@@ -100,6 +100,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
index 419ec776a7..7c4d7deead 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
@@ -93,6 +93,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
index 9fa6e3c6f2..ed7deba70c 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
@@ -88,6 +88,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
index b3442b5364..3155125f75 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
@@ -95,6 +95,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
index 7c401cd451..690ad904a7 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
@@ -92,6 +92,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
index 17e5f01601..7afdcd0954 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
@@ -94,6 +94,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
index e95bf2ccbb..5c3d31a157 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
@@ -92,6 +92,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
index 75d2740b70..e90bbe127f 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
@@ -87,6 +87,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
index 3a161f81b7..355aa80e4a 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
@@ -50,6 +50,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
index bb6f802021..fe4eea4e49 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
@@ -94,6 +94,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
index 62252bd95c..a8e12e5ceb 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
@@ -98,6 +98,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
index 3fc8d6e19c..bea8b7c5ad 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
@@ -94,6 +94,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
index e8f046066a..4030436c73 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -106,6 +106,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
index 3c1aa5d0e7..e060b74230 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
@@ -175,6 +175,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
index 4bbc07c7ca..2b22da463a 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
@@ -50,6 +50,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
index 91fd896e39..b33160c7b7 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
@@ -94,6 +94,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
index 804b451671..0d6ee4d449 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
@@ -98,6 +98,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
index dd9fcb222e..c0734fa11f 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
@@ -94,6 +94,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
index 114cc9a4c6..b8625d8f6a 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
@@ -62,6 +62,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
index 11ba89124a..b57a3f6c41 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
@@ -62,6 +62,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
index 375e14a24e..616c194486 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
@@ -87,6 +87,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
index a98dd69f8e..04ff13065a 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
@@ -108,6 +108,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
index a33bb1ee5b..21e89cba76 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
@@ -108,6 +108,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
index df9c76a472..99e967932d 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
@@ -105,6 +105,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-certs.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-certs.out.yaml
index 9038771eaf..43cce1fc13 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-certs.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-certs.out.yaml
@@ -192,6 +192,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs-merged-gateways.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs-merged-gateways.out.yaml
index 88fafa6caa..ca583fd9d5 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs-merged-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs-merged-gateways.out.yaml
@@ -179,6 +179,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs.out.yaml
index b18346c99c..f0f1a25883 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs.out.yaml
@@ -156,6 +156,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-merged-gateways.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-merged-gateways.out.yaml
index 4fe6f825a7..85ca6d6585 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-merged-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-merged-gateways.out.yaml
@@ -215,6 +215,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames.out.yaml
index 6d1429b986..77c51b3af1 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames.out.yaml
@@ -192,6 +192,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml b/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml
index bdba15558e..76b84f43ea 100644
--- a/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml
@@ -99,6 +99,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml b/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
index f923f33dbf..1e4c557ec1 100644
--- a/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
@@ -125,6 +125,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml b/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
index 4b45df0b5c..0b38fdb2d3 100644
--- a/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
@@ -125,6 +125,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml b/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml
index 5afe316dfd..77875fe54e 100644
--- a/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml
@@ -105,6 +105,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
index cb96131918..873ee91ae5 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
@@ -118,6 +118,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
index df0462c890..59ad562d31 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
@@ -121,6 +121,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
index 5da18a767f..6db90b59e4 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
@@ -154,6 +154,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
index 001529fd6b..cf41890000 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
@@ -171,6 +171,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
index 30e33d8502..fb19e839d9 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
@@ -122,6 +122,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
index 2dab43a8d8..6723d247d8 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
@@ -122,6 +122,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
index f7879b311a..8f4b136987 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
@@ -166,6 +166,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
index 428617eaa5..eb9297e97a 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
@@ -166,6 +166,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
index 4f276d0b7a..7e6b30d464 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
@@ -163,6 +163,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
index 9296262fad..983126f411 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
@@ -159,6 +159,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
index 01f5f010dc..01cecc4421 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
@@ -163,6 +163,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
index 34425404c9..7ffac9a6e0 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
@@ -159,6 +159,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/grpcroute-with-backend.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-backend.out.yaml
index e4b50f6247..6447053ded 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-backend.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-backend.out.yaml
@@ -126,6 +126,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-empty-backends.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-empty-backends.out.yaml
index 8aa6b80792..5ccc18e6a4 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-empty-backends.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-empty-backends.out.yaml
@@ -99,6 +99,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml
index a607f42a69..e6570b785e 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml
index ad2507a845..b380d8402d 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml
@@ -107,6 +107,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml
index 298758479b..1f19f20772 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml
@@ -105,6 +105,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml
index 6c1c8fde5f..beaccc8987 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml
@@ -109,6 +109,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml
index 1a1e8e005d..b8f58798f6 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml
@@ -105,6 +105,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
index 11353b48c7..7928f14c5a 100644
--- a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
@@ -137,6 +137,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
index fd74fe4fe1..7adbf33127 100644
--- a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
@@ -261,6 +261,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -318,6 +324,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
index 63e951aa68..740759df19 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
@@ -359,6 +359,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
index d1415563c3..c8330506b3 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
@@ -310,6 +310,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
index 252c5058e8..f0760aa458 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
@@ -141,6 +141,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
index 9802bb01d0..88c0ed4a4c 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
@@ -130,6 +130,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
index edb8cf378b..a8b6a47539 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
@@ -99,6 +99,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml
index 2201dbec3e..a19d95ffa0 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
index e7e9e2f33f..45595ff84b 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
@@ -132,6 +132,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-and-core-backendrefs.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-and-core-backendrefs.out.yaml
index 6d76ad7e0b..8b496af1ce 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-and-core-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-and-core-backendrefs.out.yaml
@@ -205,6 +205,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref-mixed-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref-mixed-address-type.out.yaml
index 27901e7b99..8a107920a6 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref-mixed-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref-mixed-address-type.out.yaml
@@ -262,6 +262,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
index 3eb53ee7fc..103ec37be6 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
@@ -345,6 +345,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-diff-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-diff-address-type.out.yaml
index bccfe8ee7c..4ba901a396 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-diff-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-diff-address-type.out.yaml
@@ -285,6 +285,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-same-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-same-address-type.out.yaml
index 8e4d199cce..7908019b29 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-same-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-same-address-type.out.yaml
@@ -294,6 +294,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
index 19722b2552..87ad67caad 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
@@ -107,6 +107,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
index 60764db3c5..fe913cc5bf 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
@@ -107,6 +107,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
index 1f3ba7f381..ed2c06a177 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
index cbf5ba2edc..1ebf1c5004 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
@@ -104,6 +104,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
index 1f5513ade6..f5429403d0 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
index fbd90c2c6c..4174f87333 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
@@ -101,6 +101,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml
index 339b9e2030..262f1e50e5 100644
--- a/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-dynamic-resolver-with-mutliple-backends.out.yaml b/internal/gatewayapi/testdata/httproute-dynamic-resolver-with-mutliple-backends.out.yaml
index 8eeb9fd598..61f13cd437 100644
--- a/internal/gatewayapi/testdata/httproute-dynamic-resolver-with-mutliple-backends.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-dynamic-resolver-with-mutliple-backends.out.yaml
@@ -139,6 +139,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml b/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml
index e2da694bf1..0420e077f6 100644
--- a/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml
@@ -177,6 +177,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml b/internal/gatewayapi/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
index 2c7ad1168d..66ccab5b42 100644
--- a/internal/gatewayapi/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
@@ -102,6 +102,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml
index 93bd80dfe9..645cdbbc4c 100644
--- a/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-retry.out.yaml b/internal/gatewayapi/testdata/httproute-retry.out.yaml
index 5497d156be..38bee8653a 100644
--- a/internal/gatewayapi/testdata/httproute-retry.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-retry.out.yaml
@@ -245,6 +245,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -269,6 +275,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
index 876b9922b6..5394af23d2 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
@@ -96,6 +96,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
index be298bea23..28268678b4 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
index ba3bf49b78..ace58bcfc9 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
@@ -109,6 +109,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-app-protocols.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-app-protocols.out.yaml
index 22d9b51958..32fe94631c 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-app-protocols.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-app-protocols.out.yaml
@@ -178,6 +178,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-weights.out.yaml
index 4e7c011ae4..ad8532cd96 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-weights.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-weights.out.yaml
@@ -176,6 +176,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.out.yaml b/internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.out.yaml
index a904087298..2165fdf00c 100644
--- a/internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.out.yaml
@@ -139,6 +139,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-add-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-add-multiple-filters.out.yaml
index 27774d383d..6ff6606bfe 100644
--- a/internal/gatewayapi/testdata/httproute-with-backendref-add-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-add-multiple-filters.out.yaml
@@ -132,6 +132,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
index e489e0a369..802d45f01b 100644
--- a/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -101,6 +101,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
index fba9f215ab..119a13852b 100644
--- a/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-cors-filter.out.yaml b/internal/gatewayapi/testdata/httproute-with-cors-filter.out.yaml
index f4bc617d03..2f58044860 100644
--- a/internal/gatewayapi/testdata/httproute-with-cors-filter.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-cors-filter.out.yaml
@@ -170,6 +170,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-credential-injection.out.yaml b/internal/gatewayapi/testdata/httproute-with-credential-injection.out.yaml
index c7eb0a3066..6afa25dcd3 100644
--- a/internal/gatewayapi/testdata/httproute-with-credential-injection.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-credential-injection.out.yaml
@@ -167,6 +167,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml b/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml
index dd9b657376..ecc94c5130 100644
--- a/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml
@@ -197,6 +197,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml b/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml
index 7b197cb3c3..5b341c08b1 100644
--- a/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml
@@ -98,6 +98,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-enable-zone-discovery.out.yaml b/internal/gatewayapi/testdata/httproute-with-enable-zone-discovery.out.yaml
index 726f586356..488788c438 100644
--- a/internal/gatewayapi/testdata/httproute-with-enable-zone-discovery.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-enable-zone-discovery.out.yaml
@@ -121,6 +121,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -157,10 +168,12 @@ xdsIR:
               namespace: default
               sectionName: "8080"
             name: httproute/default/httproute-1/rule/1/backend/0
+            preferLocal:
+              force:
+                minEndpointsInZoneThreshold: 1
+              minEndpointsThreshold: 1
             protocol: HTTP
             weight: 1
-            zoneAwareRouting:
-              minSize: 1
         headerMatches:
         - distinct: false
           exact: bar
@@ -195,10 +208,12 @@ xdsIR:
               namespace: default
               sectionName: "8080"
             name: httproute/default/httproute-1/rule/0/backend/0
+            preferLocal:
+              force:
+                minEndpointsInZoneThreshold: 1
+              minEndpointsThreshold: 1
             protocol: HTTP
             weight: 1
-            zoneAwareRouting:
-              minSize: 1
         hostname: '*'
         isHTTP2: false
         metadata:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
index 6875858642..bd560dac02 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -119,6 +119,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
index 7671dfc2db..aeac921a32 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
@@ -129,6 +129,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
index d28eef2ab4..9d405bb01e 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -115,6 +115,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
index 4296b3f03b..d158e9be26 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
@@ -110,6 +110,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml
index 50a1f2dc99..e7c9cf017a 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml
@@ -114,6 +114,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-headers.out.yaml
index 2a3130f6b1..e68741289c 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-headers.out.yaml
@@ -115,6 +115,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-header-values.out.yaml
index 930befc4ce..c6e12c8e9a 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-header-values.out.yaml
@@ -115,6 +115,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-headers.out.yaml
index 89e2b726ff..40a08c7484 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-headers.out.yaml
@@ -209,6 +209,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml
index 191f1013c8..3a8e13c96a 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml
@@ -107,6 +107,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-no-valid-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
index 8dc0255c37..c060f6c205 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
@@ -111,6 +111,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml
index 75cc156c6b..c42ef161ce 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml
@@ -111,6 +111,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-match-diff-number.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-match-diff-number.out.yaml
index 100bb38f85..0d2186e4c8 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-match-diff-number.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-match-diff-number.out.yaml
@@ -155,6 +155,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-match-diff-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-match-diff-type.out.yaml
index 15a4a8438c..e53d79e676 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-match-diff-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-match-diff-type.out.yaml
@@ -152,6 +152,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml b/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml
index 7f9eabb8d9..7ab249860c 100644
--- a/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml
@@ -107,6 +107,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-headless-service-service-routing.out.yaml b/internal/gatewayapi/testdata/httproute-with-headless-service-service-routing.out.yaml
index a34b879430..c1f5807683 100644
--- a/internal/gatewayapi/testdata/httproute-with-headless-service-service-routing.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-headless-service-service-routing.out.yaml
@@ -108,6 +108,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
index e1a3a8bd7b..2d39e2c8dd 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
@@ -101,6 +101,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
index d203e5f48b..ea4da9e6e7 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
@@ -105,6 +105,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
index ec6b3fd3f9..66190e16a9 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
@@ -102,6 +102,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml
index 65acf7d743..c4823beaba 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml
@@ -124,6 +124,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
index f17aa724c3..9557bbe82e 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
@@ -100,6 +100,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
index 8dbd37e34d..14cc7dc48e 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
index 6ba0272a48..c91cf7b824 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
@@ -101,6 +101,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
index 28f83a0c6d..cf7e9a40e5 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
@@ -108,6 +108,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
index 1458a2fe52..1565872c71 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
@@ -102,6 +102,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml
index c1decd8f3d..e5ea6f1259 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml
@@ -160,6 +160,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -184,6 +190,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml b/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml
index da9ffd2be0..14d27cc508 100644
--- a/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml
@@ -111,6 +111,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml
index d1478b62af..9de7949218 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml
@@ -117,6 +117,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml
index 245aa6e211..980c80337a 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml
@@ -129,6 +129,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-percentage-mirroring.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-percentage-mirroring.out.yaml
index 24e0d6e379..594fe8a459 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-percentage-mirroring.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-percentage-mirroring.out.yaml
@@ -121,6 +121,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
index 99feb8f195..eadbb2c4f6 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
@@ -111,6 +111,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
index 5800254e9f..4260dd9642 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
@@ -112,6 +112,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml
index caa6567158..099bff53ba 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml
@@ -111,6 +111,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml b/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml
index 9ac76b9749..331ab86f9a 100644
--- a/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml
@@ -123,6 +123,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -147,6 +153,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml b/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml
index 596e8b9c85..96b04d6ebd 100644
--- a/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml
@@ -156,6 +156,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
@@ -210,6 +224,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml
index 898582a1e2..7cb5121790 100644
--- a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml
@@ -188,6 +188,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-a-573db404
+          protocol: HTTP
+        name: envoy-default-gateway-a-573db404
     http:
     - address: 0.0.0.0
       hostnames:
@@ -247,6 +253,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-b-3a004b3a
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-b-3a004b3a
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml
index e16aaa1435..cbe983dfff 100644
--- a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml
@@ -183,6 +183,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-a-37c12ef1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-a-37c12ef1
     http:
     - address: 0.0.0.0
       hostnames:
@@ -225,6 +231,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-b-3a004b3a
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-b-3a004b3a
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-multiple-invalid-rules.out.yaml b/internal/gatewayapi/testdata/httproute-with-multiple-invalid-rules.out.yaml
index 3ad7d9d73d..a11f92afb7 100644
--- a/internal/gatewayapi/testdata/httproute-with-multiple-invalid-rules.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multiple-invalid-rules.out.yaml
@@ -124,6 +124,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
index e68ae4921b..5c47abfe1f 100644
--- a/internal/gatewayapi/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-query-match-diff-number.out.yaml b/internal/gatewayapi/testdata/httproute-with-query-match-diff-number.out.yaml
index 15e9a6b75d..77cf3b4c4b 100644
--- a/internal/gatewayapi/testdata/httproute-with-query-match-diff-number.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-query-match-diff-number.out.yaml
@@ -155,6 +155,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-query-match-diff-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-query-match-diff-type.out.yaml
index 17edc41e8e..757aa003d5 100644
--- a/internal/gatewayapi/testdata/httproute-with-query-match-diff-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-query-match-diff-type.out.yaml
@@ -152,6 +152,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
index 92f7dfaf36..a61d83aec2 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
@@ -109,6 +109,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml
index 805aa7d1cc..12493f47fc 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml
@@ -107,6 +107,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
index 47e0bd90b3..d05424af1f 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
@@ -110,6 +110,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
index 8b38fe5c89..326f314e0c 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
@@ -107,6 +107,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-status.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
index 42378afa0d..f00500d19f 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
@@ -106,6 +106,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
index 046f1f2ee6..49341a8cb9 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
@@ -110,6 +110,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml
index 01d7268233..7b79dd714f 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml
@@ -125,6 +125,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
index 6eb052e838..879a68dd55 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -119,6 +119,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
index 8fb5922cda..d55a1cde2e 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
@@ -129,6 +129,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
index d688c1f011..91ec3fef72 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -115,6 +115,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
index cfbeeb9fdc..a2e0a61d80 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
@@ -110,6 +110,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
index b6e1dea538..214a88516b 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
@@ -114,6 +114,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
index c1677e9bda..f0c67fdd57 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
@@ -115,6 +115,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-header-values.out.yaml
index 7e0426cde8..3ce870826d 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-header-values.out.yaml
@@ -115,6 +115,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
index 151a297ebf..b4fbe42d17 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
@@ -207,6 +207,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml
index 28efd561e6..5ebec2948f 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml
@@ -107,6 +107,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
index f569f87c6c..d161745283 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
@@ -111,6 +111,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml
index 91432f6510..9c96daf31e 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml
@@ -111,6 +111,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
index 75fcaae1d2..535f1e63d6 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
@@ -100,6 +100,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
index f1c310a844..d1160f1cb4 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
@@ -98,6 +98,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
index 8b838e5e17..140d02e60e 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
@@ -131,6 +131,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
index 72ca225c6b..63efa5b39e 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
@@ -104,6 +104,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml b/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
index d4dd06ccc7..6f9f2fcb00 100644
--- a/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
@@ -106,6 +106,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
index 0bb3b69bb3..9754452a8e 100644
--- a/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -102,6 +102,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
index 3b35cbfa0f..8f08f25c67 100644
--- a/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -103,6 +103,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
index 08bd878ed5..e37a8bf5f3 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
@@ -110,6 +110,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
index 00bb80c45e..a9f7ee21cf 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
@@ -111,6 +111,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
index 957a27b3d0..ee5e07fff9 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
@@ -108,6 +108,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
index 471931f229..79630af376 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
@@ -108,6 +108,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
index cb1975f1cf..96b4b0868d 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
@@ -114,6 +114,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
index a94b54e97e..db646bef4e 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
@@ -116,6 +116,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
index 5d41c1ae69..9d3d839b59 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
@@ -112,6 +112,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
index b0d45963dd..54826ecbd6 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
@@ -111,6 +111,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
index 7e7a412f7a..65a190d701 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
@@ -109,6 +109,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
index 154b33514b..6e7ef878b4 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
@@ -110,6 +110,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-http.out.yaml
index 70d124e477..4326f5c2d4 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-http.out.yaml
@@ -248,6 +248,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-invalid.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-invalid.out.yaml
index 48fd34be74..8ddde8ac90 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-invalid.out.yaml
@@ -345,6 +345,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.out.yaml
index 6ad4a1c5b1..5dd0f8f588 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.out.yaml
@@ -351,6 +351,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml
index 15a17b99c3..ab4fcd32cb 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml
@@ -252,6 +252,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
index ae420d85a5..4ff2739d3d 100644
--- a/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
@@ -101,6 +101,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml b/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml
index 786618f52f..542c8f479b 100644
--- a/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml
+++ b/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml
@@ -286,6 +286,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/merge-invalid-multiple-gateways.out.yaml b/internal/gatewayapi/testdata/merge-invalid-multiple-gateways.out.yaml
index 3b11346c63..ebce0daea8 100644
--- a/internal/gatewayapi/testdata/merge-invalid-multiple-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/merge-invalid-multiple-gateways.out.yaml
@@ -139,6 +139,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
index faf676e406..9bb0541a21 100644
--- a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
+++ b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
@@ -175,6 +175,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
index 875425aede..de633d0e13 100644
--- a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
+++ b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
@@ -226,6 +226,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/merge-valid-multiple-gateways.out.yaml b/internal/gatewayapi/testdata/merge-valid-multiple-gateways.out.yaml
index bce4deb322..4d5a589bdc 100644
--- a/internal/gatewayapi/testdata/merge-valid-multiple-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/merge-valid-multiple-gateways.out.yaml
@@ -148,6 +148,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml b/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml
index 4b28b5a0c1..6cbb413e39 100644
--- a/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml
+++ b/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml
@@ -504,6 +504,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml b/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml
index 27dfa1d93f..6469b2954a 100644
--- a/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml
+++ b/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml
@@ -296,6 +296,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml b/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
index 14af4c95df..72689e65ea 100644
--- a/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
@@ -93,6 +93,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-listener.out.yaml b/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-listener.out.yaml
index 3f896cfafc..3a65eeef37 100644
--- a/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-listener.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-listener.out.yaml
@@ -135,6 +135,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml
index b256fcd587..648ed206d1 100644
--- a/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml
@@ -515,6 +515,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
index c5eead5d0f..84ffbfd88b 100644
--- a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
@@ -423,6 +423,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -468,6 +474,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-client-cidr.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-client-cidr.out.yaml
index 6a994b3898..dd03e105f7 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-client-cidr.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-client-cidr.out.yaml
@@ -288,6 +288,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-headers-and-methods.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-headers-and-methods.out.yaml
index 9cf6b62c8f..99f4ffcc15 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-headers-and-methods.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-headers-and-methods.out.yaml
@@ -144,6 +144,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-jwt-claim.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-jwt-claim.out.yaml
index bd493eaa9b..ebe198049d 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-jwt-claim.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-jwt-claim.out.yaml
@@ -157,6 +157,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml
index 2d01613558..3b733f84b4 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml
@@ -220,6 +220,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
index b16eb74b52..ad248dcaaf 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
@@ -353,6 +353,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -409,6 +415,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -447,6 +459,23 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
index d9212c35ec..c12b72177e 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
@@ -413,6 +413,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -485,6 +491,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -558,6 +570,23 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml
index f12b79a416..4e152f11ce 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml
@@ -366,6 +366,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml
index 7e9840bcea..b7f2de2e97 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml
@@ -231,6 +231,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml
index dc34fb936b..d3ec9167e1 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml
@@ -206,6 +206,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
index 77e21c3e5c..6a4adeb1df 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
@@ -139,6 +139,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
index e899d2fa5a..d5b39433be 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
@@ -139,6 +139,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
index dba0b2bb25..edcdd43af9 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
@@ -140,6 +140,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
index 8405eaf3f5..2090e18a00 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
@@ -139,6 +139,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
index 586b306976..071c336b9a 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
@@ -205,6 +205,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
index 3d040373bb..c4223ca7ae 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
@@ -284,6 +284,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
index f6bf47856b..d1c412c6ed 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
@@ -225,6 +225,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
index bedb450446..40695d70b1 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
@@ -237,6 +237,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-backendcluster.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-backendcluster.out.yaml
index 28e7226e19..671f7b0b92 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-backendcluster.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-backendcluster.out.yaml
@@ -209,6 +209,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-local-jwks.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-local-jwks.out.yaml
index 0da37f13ae..3ebf87dfcb 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-local-jwks.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-local-jwks.out.yaml
@@ -369,6 +369,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml
index 9e9369b53b..81852ab6f4 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml
@@ -288,6 +288,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -359,6 +365,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
index 90ede9685e..a357eeb262 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
@@ -287,6 +287,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -358,6 +364,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
index 50dea3e3e2..cb5e2eb1be 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
@@ -279,6 +279,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -350,6 +356,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-and-jwt-passthrough.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-and-jwt-passthrough.out.yaml
index 3277912885..38585dd628 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-and-jwt-passthrough.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-and-jwt-passthrough.out.yaml
@@ -148,6 +148,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml
index b2d10cce02..745e277509 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml
@@ -214,6 +214,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies-samesite.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies-samesite.out.yaml
index 2927b1a496..238a3f2a53 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies-samesite.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies-samesite.out.yaml
@@ -145,6 +145,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies.out.yaml
index 331ef0d3b8..14d0018e9f 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies.out.yaml
@@ -143,6 +143,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-deny-redirect.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-deny-redirect.out.yaml
index 61da8b5b97..772c2c535e 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-deny-redirect.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-deny-redirect.out.yaml
@@ -159,6 +159,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
index c9904814d8..3feb2689db 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
@@ -100,6 +100,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
index 0ef0d672ac..d41d9c569d 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
@@ -292,6 +292,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-1-bfd08ef4
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
@@ -316,6 +322,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-2-5e70ed84
+          protocol: HTTP
+        name: envoy-default-gateway-2-5e70ed84
     http:
     - address: 0.0.0.0
       hostnames:
@@ -340,6 +352,23 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-3-206418d2
+          protocol: HTTP
+        name: envoy-default-gateway-3-206418d2
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
index 9b1666bf18..ed23eb4d8f 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
@@ -238,6 +238,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml b/internal/gatewayapi/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
index bfd29ea140..b5a6db3e89 100644
--- a/internal/gatewayapi/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
+++ b/internal/gatewayapi/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
@@ -169,6 +169,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tcproute-rule-with-multiple-backends-and-zero-weights.out.yaml b/internal/gatewayapi/testdata/tcproute-rule-with-multiple-backends-and-zero-weights.out.yaml
index 2e239629cf..cda0191ef7 100644
--- a/internal/gatewayapi/testdata/tcproute-rule-with-multiple-backends-and-zero-weights.out.yaml
+++ b/internal/gatewayapi/testdata/tcproute-rule-with-multiple-backends-and-zero-weights.out.yaml
@@ -104,6 +104,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tcproute-with-backend.out.yaml b/internal/gatewayapi/testdata/tcproute-with-backend.out.yaml
index 8bd0812304..ebc77c28ae 100644
--- a/internal/gatewayapi/testdata/tcproute-with-backend.out.yaml
+++ b/internal/gatewayapi/testdata/tcproute-with-backend.out.yaml
@@ -114,6 +114,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tlsroute-attaching-to-gateway.out.yaml b/internal/gatewayapi/testdata/tlsroute-attaching-to-gateway.out.yaml
index 6e1cd5d486..762ee649c4 100644
--- a/internal/gatewayapi/testdata/tlsroute-attaching-to-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-attaching-to-gateway.out.yaml
@@ -97,6 +97,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tlsroute-invalid-reference-grant.out.yaml b/internal/gatewayapi/testdata/tlsroute-invalid-reference-grant.out.yaml
index 49ceacd9e1..8886594ab6 100644
--- a/internal/gatewayapi/testdata/tlsroute-invalid-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-invalid-reference-grant.out.yaml
@@ -100,6 +100,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-gateway-conformance-infra-gateway-tlsroute-refer-1a02781b
+          protocol: HTTP
+        name: envoy-gateway-conformance-infra-gateway-tlsroute-refer-1a02781b
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tlsroute-multiple.out.yaml b/internal/gatewayapi/testdata/tlsroute-multiple.out.yaml
index 327f8be37e..71e77c3a2b 100644
--- a/internal/gatewayapi/testdata/tlsroute-multiple.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-multiple.out.yaml
@@ -131,6 +131,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml b/internal/gatewayapi/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
index f8a0497e55..2b33ed37cf 100644
--- a/internal/gatewayapi/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
@@ -83,6 +83,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tlsroute-with-backend.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-backend.out.yaml
index 8814191b2d..9dd0fb3715 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-backend.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-backend.out.yaml
@@ -117,6 +117,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
index 3486bd59e2..777ce96bb9 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -98,6 +98,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tlsroute-with-empty-hostname.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-empty-hostname.out.yaml
index 13ae2ef0e6..efa4ca1503 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-empty-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-empty-hostname.out.yaml
@@ -96,6 +96,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tlsroute-with-empty-listener-hostname.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-empty-listener-hostname.out.yaml
index 9581eeaed5..43ed8d8635 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-empty-listener-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-empty-listener-hostname.out.yaml
@@ -98,6 +98,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
index ac28b314e1..87cce61528 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
@@ -88,6 +88,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/tracing-merged-multiple-routes.out.yaml b/internal/gatewayapi/testdata/tracing-merged-multiple-routes.out.yaml
index b307872bb3..6ee03992fa 100644
--- a/internal/gatewayapi/testdata/tracing-merged-multiple-routes.out.yaml
+++ b/internal/gatewayapi/testdata/tracing-merged-multiple-routes.out.yaml
@@ -233,6 +233,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml b/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml
index 805cbdb432..ea9c32beef 100644
--- a/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml
+++ b/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml
@@ -262,6 +262,12 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -338,6 +344,20 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/tracing-sampling-fraction.out.yaml b/internal/gatewayapi/testdata/tracing-sampling-fraction.out.yaml
index 5124564f80..18e272ee9b 100644
--- a/internal/gatewayapi/testdata/tracing-sampling-fraction.out.yaml
+++ b/internal/gatewayapi/testdata/tracing-sampling-fraction.out.yaml
@@ -235,6 +235,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-class-3b1df594
+          protocol: HTTP
+        name: envoy-envoy-gateway-class-3b1df594
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/udproute-rule-with-multiple-backends-and-zero-weights.out.yaml b/internal/gatewayapi/testdata/udproute-rule-with-multiple-backends-and-zero-weights.out.yaml
index f72ed4a8ab..319143d515 100644
--- a/internal/gatewayapi/testdata/udproute-rule-with-multiple-backends-and-zero-weights.out.yaml
+++ b/internal/gatewayapi/testdata/udproute-rule-with-multiple-backends-and-zero-weights.out.yaml
@@ -104,6 +104,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/udproute-with-backend.out.yaml b/internal/gatewayapi/testdata/udproute-with-backend.out.yaml
index 4921b911db..ff363ba686 100644
--- a/internal/gatewayapi/testdata/udproute-with-backend.out.yaml
+++ b/internal/gatewayapi/testdata/udproute-with-backend.out.yaml
@@ -114,6 +114,17 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/translator.go b/internal/gatewayapi/translator.go
index d7096d4edc..035d26c1c5 100644
--- a/internal/gatewayapi/translator.go
+++ b/internal/gatewayapi/translator.go
@@ -243,7 +243,7 @@ func (t *Translator) Translate(resources *resource.Resources) (*TranslateResult,
 	}
 
 	// Process global resources that are not tied to a specific listener or route
-	if err := t.ProcessGlobalResources(resources, xdsIR); err != nil {
+	if err := t.ProcessGlobalResources(acceptedGateways, resources, xdsIR); err != nil {
 		errs = errors.Join(errs, err)
 	}
 
diff --git a/internal/gatewayapi/translator_test.go b/internal/gatewayapi/translator_test.go
index 982a65b6c0..7eb71dac25 100644
--- a/internal/gatewayapi/translator_test.go
+++ b/internal/gatewayapi/translator_test.go
@@ -315,6 +315,69 @@ func TestTranslate(t *testing.T) {
 				},
 			)
 
+			svc := corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      translator.expectedResourceHashedName(string(translator.GatewayClassName)),
+					Namespace: translator.ControllerNamespace,
+				},
+				Spec: corev1.ServiceSpec{
+					ClusterIP: "6.7.8.9",
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       8080,
+							TargetPort: intstr.IntOrString{IntVal: 8080},
+							Protocol:   corev1.ProtocolTCP,
+						},
+					},
+				},
+			}
+
+			endPtSlice := discoveryv1.EndpointSlice{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      svc.Name,
+					Namespace: svc.Namespace,
+					Labels: map[string]string{
+						discoveryv1.LabelServiceName: svc.Name,
+					},
+				},
+				AddressType: discoveryv1.AddressTypeIPv4,
+				Ports: []discoveryv1.EndpointPort{
+					{
+						Name:     ptr.To("http"),
+						Port:     ptr.To[int32](8080),
+						Protocol: ptr.To(corev1.ProtocolTCP),
+					},
+				},
+				Endpoints: []discoveryv1.Endpoint{
+					{
+						Addresses: []string{
+							"7.6.5.4",
+						},
+						Conditions: discoveryv1.EndpointConditions{
+							Ready: ptr.To(true),
+						},
+						Zone: ptr.To("zone1"),
+					},
+				},
+			}
+
+			if translator.MergeGateways {
+
+				resources.Services = append(resources.Services, &svc)
+				resources.EndpointSlices = append(resources.EndpointSlices, &endPtSlice)
+			} else {
+				for _, g := range resources.Gateways {
+					gSvc := svc
+					gSvc.Name = translator.expectedResourceHashedName(fmt.Sprintf("%s/%s", g.Namespace, g.Name))
+					gEndPtSlice := endPtSlice
+					gEndPtSlice.Name = gSvc.Name
+					gEndPtSlice.Labels[discoveryv1.LabelServiceName] = gSvc.Name
+					resources.Services = append(resources.Services, &gSvc)
+					resources.EndpointSlices = append(resources.EndpointSlices, &gEndPtSlice)
+				}
+			}
+
 			resources.Namespaces = append(resources.Namespaces, &corev1.Namespace{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "envoy-gateway",
@@ -514,6 +577,69 @@ func TestTranslateWithExtensionKinds(t *testing.T) {
 				},
 			)
 
+			svc := corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      translator.expectedResourceHashedName(string(translator.GatewayClassName)),
+					Namespace: translator.ControllerNamespace,
+				},
+				Spec: corev1.ServiceSpec{
+					ClusterIP: "6.7.8.9",
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       8080,
+							TargetPort: intstr.IntOrString{IntVal: 8080},
+							Protocol:   corev1.ProtocolTCP,
+						},
+					},
+				},
+			}
+
+			endPtSlice := discoveryv1.EndpointSlice{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      svc.Name,
+					Namespace: svc.Namespace,
+					Labels: map[string]string{
+						discoveryv1.LabelServiceName: svc.Name,
+					},
+				},
+				AddressType: discoveryv1.AddressTypeIPv4,
+				Ports: []discoveryv1.EndpointPort{
+					{
+						Name:     ptr.To("http"),
+						Port:     ptr.To[int32](8080),
+						Protocol: ptr.To(corev1.ProtocolTCP),
+					},
+				},
+				Endpoints: []discoveryv1.Endpoint{
+					{
+						Addresses: []string{
+							"7.6.5.4",
+						},
+						Conditions: discoveryv1.EndpointConditions{
+							Ready: ptr.To(true),
+						},
+						Zone: ptr.To("zone1"),
+					},
+				},
+			}
+
+			if translator.MergeGateways {
+				resources.Services = append(resources.Services, &svc)
+				resources.EndpointSlices = append(resources.EndpointSlices, &endPtSlice)
+			} else {
+				for _, g := range resources.Gateways {
+					gSvc := svc
+					gSvc.Name = translator.expectedResourceHashedName(fmt.Sprintf("%s/%s", g.Namespace, g.Name))
+					fmt.Fprintln(os.Stderr, "service name adding: "+gSvc.Namespace+"/"+gSvc.Name)
+					gEndPtSlice := endPtSlice
+					gEndPtSlice.Name = gSvc.Name
+					gEndPtSlice.Labels[discoveryv1.LabelServiceName] = gSvc.Name
+					resources.Services = append(resources.Services, &gSvc)
+					resources.EndpointSlices = append(resources.EndpointSlices, &gEndPtSlice)
+				}
+			}
+
 			resources.Namespaces = append(resources.Namespaces, &corev1.Namespace{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "envoy-gateway",
diff --git a/internal/infrastructure/kubernetes/proxy/resource.go b/internal/infrastructure/kubernetes/proxy/resource.go
index 19e906404c..b5bf61aa11 100644
--- a/internal/infrastructure/kubernetes/proxy/resource.go
+++ b/internal/infrastructure/kubernetes/proxy/resource.go
@@ -33,6 +33,8 @@ const (
 	envoyPodEnvVar = "ENVOY_POD_NAME"
 	// envoyZoneEnvVar is the Envoy pod locality zone name
 	envoyZoneEnvVar = "ENVOY_SERVICE_ZONE"
+	// envoyInfraNameEnvVar is the name of the envoy proxy infrastructure
+	envoyInfraNameEnvVar = "ENVOY_PROXY_INFRA_NAME"
 )
 
 // ExpectedResourceHashedName returns expected resource hashed name including up to the 48 characters of the original name.
@@ -128,7 +130,7 @@ func expectedProxyContainers(infra *ir.ProxyInfra,
 			ImagePullPolicy:          corev1.PullIfNotPresent,
 			Command:                  []string{"envoy"},
 			Args:                     args,
-			Env:                      expectedContainerEnv(containerSpec),
+			Env:                      expectedContainerEnv(infra, containerSpec),
 			Resources:                *containerSpec.Resources,
 			SecurityContext:          expectedEnvoySecurityContext(containerSpec),
 			Ports:                    ports,
@@ -190,7 +192,7 @@ func expectedProxyContainers(infra *ir.ProxyInfra,
 			ImagePullPolicy:          corev1.PullIfNotPresent,
 			Command:                  []string{"envoy-gateway"},
 			Args:                     expectedShutdownManagerArgs(shutdownConfig),
-			Env:                      expectedContainerEnv(nil),
+			Env:                      expectedContainerEnv(infra, nil),
 			Resources:                *egv1a1.DefaultShutdownManagerContainerResourceRequirements(),
 			TerminationMessagePolicy: corev1.TerminationMessageReadFile,
 			TerminationMessagePath:   "/dev/termination-log",
@@ -400,7 +402,7 @@ func sdsConfigMapItems(gatewayNamespaceMode bool) []corev1.KeyToPath {
 }
 
 // expectedContainerEnv returns expected proxy container envs.
-func expectedContainerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.EnvVar {
+func expectedContainerEnv(infra *ir.ProxyInfra, containerSpec *egv1a1.KubernetesContainerSpec) []corev1.EnvVar {
 	env := []corev1.EnvVar{
 		{
 			Name: envoyNsEnvVar,
@@ -429,6 +431,10 @@ func expectedContainerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev
 				},
 			},
 		},
+		{
+			Name:  envoyInfraNameEnvVar,
+			Value: ExpectedResourceHashedName(infra.Name),
+		},
 	}
 
 	if containerSpec != nil {
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml
index eb41b2ac52..88e697445e 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml
@@ -66,6 +66,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -153,6 +155,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
index 5a56810905..ac0456a5bb 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
@@ -232,6 +232,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: envoyproxy/envoy:v1.2.3
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -313,6 +315,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
index eb3cb2d11a..fc28644e19 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
@@ -231,6 +231,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: envoyproxy/envoy:v1.2.3
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -312,6 +314,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
index 85493cc195..3d5881c41d 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
@@ -216,6 +216,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -303,6 +305,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
index 5798d28861..1933ca9aa3 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
@@ -165,6 +165,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -249,6 +251,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
index 8da12ec97b..128573a4e3 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
@@ -231,6 +231,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         - name: env_a
           value: env_a_value
         - name: env_b
@@ -316,6 +318,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
index 1886746441..a89fb59d2c 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
@@ -232,6 +232,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-1-e11eea07
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -322,6 +324,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-1-e11eea07
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
index 692f9b5b55..666edda5f5 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
@@ -225,6 +225,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -312,6 +314,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
index 4059267689..23cd478887 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
@@ -216,6 +216,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -303,6 +305,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
index 78cc0b6b28..a97ebdf88d 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
@@ -216,6 +216,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -308,6 +310,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: envoyproxy/gateway-dev:v1.2.3
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
index 78da341b7d..6f33966798 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
@@ -231,6 +231,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         - name: env_a
           value: env_a_value
         - name: env_b
@@ -316,6 +318,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
index f13e240054..c6216d0bde 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
@@ -221,6 +221,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -308,6 +310,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml
index cee00906f7..8861bee8a3 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml
@@ -67,6 +67,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -154,6 +156,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
index 6395329313..c5b11805d2 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
@@ -218,6 +218,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -305,6 +307,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
index d3bfde68a7..49ed190d12 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
@@ -216,6 +216,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -303,6 +305,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
index 72939b5755..65cbf90d5f 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
@@ -216,6 +216,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -303,6 +305,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
index 277bee2f37..bb00f4a93c 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
@@ -216,6 +216,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -303,6 +305,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
index 0a174dcbcf..a3b2c1d52b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
@@ -216,6 +216,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -303,6 +305,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
index e22ab6b7b1..c7f5590f8d 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
@@ -70,6 +70,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -157,6 +159,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
index e66ddbdb54..363fafa370 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
@@ -70,6 +70,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -157,6 +159,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml
index ecae105bc0..03c067443d 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml
@@ -236,6 +236,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-1-e11eea07
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -326,6 +328,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-1-e11eea07
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
index e96b837aa4..8b246230f1 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -237,6 +237,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: envoyproxy/envoy:v1.2.3
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -318,6 +320,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
index 0088db13c9..209880f4f5 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -237,6 +237,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: envoyproxy/envoy:v1.2.3
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -320,6 +322,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
index 251f7fecfe..1f369ecad6 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
@@ -236,6 +236,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: envoyproxy/envoy:v1.2.3
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -317,6 +319,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
index 2d104ca9da..0bde2ba679 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
@@ -220,6 +220,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -307,6 +309,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
index 0d988425b2..b271a4c17c 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
@@ -169,6 +169,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -253,6 +255,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
index fa3d0304a2..7d50c0859f 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
@@ -221,6 +221,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -308,6 +310,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
index 2ba927e8fc..0dfc8bcf8b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
@@ -236,6 +236,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         - name: env_a
           value: env_a_value
         - name: env_b
@@ -321,6 +323,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
index abaa6eaa34..6c0d5e49e7 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
@@ -236,6 +236,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-1-e11eea07
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -326,6 +328,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-1-e11eea07
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
index 0b5f26b8ab..e053d18500 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
@@ -221,6 +221,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -308,6 +310,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
index fd8320a490..205d9bc073 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
@@ -229,6 +229,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -316,6 +318,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
index 75b5c0466f..4498073b9c 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
@@ -220,6 +220,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -307,6 +309,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
index 61098fcd53..ea85351567 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
@@ -220,6 +220,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -312,6 +314,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: privaterepo/envoyproxy/gateway-dev:v1.2.3
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
index 57a77172e2..cefb6f9590 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
@@ -236,6 +236,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         - name: env_a
           value: env_a_value
         - name: env_b
@@ -321,6 +323,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
index 1e46ab65a6..3365e32ab7 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
@@ -225,6 +225,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -312,6 +314,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
index 21798b3bb9..8e763c2d0c 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
@@ -71,6 +71,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -158,6 +160,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
index 8fddca291a..663a9e65ce 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
@@ -220,6 +220,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -306,6 +308,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
index b9f6849ae3..b3064615f3 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
@@ -222,6 +222,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -309,6 +311,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
index d40f50a442..019c45896e 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
@@ -220,6 +220,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -307,6 +309,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
index 5dcc3df825..71d9640623 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
@@ -220,6 +220,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -307,6 +309,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
index ef27a5ff95..ff37beab9b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
@@ -220,6 +220,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -307,6 +309,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
index 6d81fc8463..6ed81cd3a8 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
@@ -220,6 +220,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -307,6 +309,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
index 8d1198c7e8..438c2cc425 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
@@ -236,6 +236,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-1-e11eea07
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -326,6 +328,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-1-e11eea07
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -650,6 +654,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-2-159f3c5f
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -740,6 +746,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-gateway-2-159f3c5f
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index c1e6099097..ff43f6e2f5 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -813,6 +813,16 @@ func (h *HTTPRoute) GetRetry() *Retry {
 	return nil
 }
 
+func (r *HTTPRoute) NeedsClusterPerSetting() bool {
+	if r.Traffic != nil &&
+		r.Traffic.LoadBalancer != nil &&
+		r.Traffic.LoadBalancer.ZoneAware != nil &&
+		r.Traffic.LoadBalancer.ZoneAware.PreferLocal != nil {
+		return true
+	}
+	return r.Destination.NeedsClusterPerSetting()
+}
+
 // DNS contains configuration options for DNS resolution.
 // +k8s:deepcopy-gen=true
 type DNS struct {
@@ -1552,7 +1562,7 @@ func (r *RouteDestination) Validate() error {
 func (r *RouteDestination) NeedsClusterPerSetting() bool {
 	return r.HasMixedEndpoints() ||
 		r.HasFiltersInSettings() ||
-		(len(r.Settings) > 1 && r.HasZoneAwareRouting())
+		(len(r.Settings) > 1 && r.HasPreferLocalZone())
 }
 
 // HasMixedEndpoints returns true if the RouteDestination has endpoints of multiple types
@@ -1577,10 +1587,10 @@ func (r *RouteDestination) HasFiltersInSettings() bool {
 	return false
 }
 
-// HasZoneAwareRouting returns true if any setting in the destination has ZoneAwareRoutingEnabled set
-func (r *RouteDestination) HasZoneAwareRouting() bool {
+// HasPreferLocalZone returns true if any setting in the destination has PreferLocalZone set
+func (r *RouteDestination) HasPreferLocalZone() bool {
 	for _, setting := range r.Settings {
-		if setting.ZoneAwareRouting != nil {
+		if setting.PreferLocal != nil {
 			return true
 		}
 	}
@@ -1643,11 +1653,11 @@ type DestinationSetting struct {
 	IPFamily *egv1a1.IPFamily    `json:"ipFamily,omitempty" yaml:"ipFamily,omitempty"`
 	TLS      *TLSUpstreamConfig  `json:"tls,omitempty" yaml:"tls,omitempty"`
 	Filters  *DestinationFilters `json:"filters,omitempty" yaml:"filters,omitempty"`
-	// ZoneAwareRouting specifies whether to enable Zone Aware Routing for this destination's endpoints.
+	// PreferLocal specifies whether to enable Zone Aware Routing for this destination's endpoints.
 	// This is derived from the backend service and depends on having Kubernetes Topology Aware Routing or Traffic Distribution enabled.
 	//
 	// +optional
-	ZoneAwareRouting *ZoneAwareRouting `json:"zoneAwareRouting,omitempty" yaml:"zoneAwareRouting,omitempty"`
+	PreferLocal *PreferLocalZone `json:"preferLocal,omitempty" yaml:"preferLocal,omitempty"`
 	// Metadata is used to enrich envoy route metadata with user and provider-specific information
 	// The primary metadata for DestinationSettings comes from the Backend resource reference in BackendRef
 	Metadata *ResourceMetadata `json:"metadata,omitempty" yaml:"metadata,omitempty"`
@@ -2170,9 +2180,13 @@ type GlobalResources struct {
 	// EnvoyClientCertificate holds the client certificate secret for envoy to use when establishing a TLS connection to
 	// control plane components. For example, the rate limit service, WASM HTTP server, etc.
 	EnvoyClientCertificate *TLSCertificate `json:"envoyClientCertificate,omitempty" yaml:"envoyClientCertificate,omitempty"`
+
 	// HMACSecret holds the HMAC Secret used by the OIDC.
 	// TODO: zhaohuabing move HMACSecret here
 	// HMACSecret PrivateBytes
+
+	// ProxyInfraCluster holds cluster information for the ProxyInfra pods
+	ProxyInfraCluster *ProxyInfraCluster `json:"proxyInfraCluster,omitempty" yaml:"proxyInfraCluster,omitempty"`
 }
 
 // LocalRateLimit holds the local rate limiting configuration.
@@ -2490,6 +2504,8 @@ type LoadBalancer struct {
 	Random *Random `json:"random,omitempty" yaml:"random,omitempty"`
 	// ConsistentHash load balancer policy
 	ConsistentHash *ConsistentHash `json:"consistentHash,omitempty" yaml:"consistentHash,omitempty"`
+	// ZoneAware defines the configuration related to the distribution of requests between locality zones.
+	ZoneAware *ZoneAware `json:"zoneAware,omitempty" yaml:"zoneAware,omitempty"`
 }
 
 // Validate the fields within the LoadBalancer structure
@@ -3162,8 +3178,41 @@ type RequestBuffer struct {
 	Limit resource.Quantity `json:"limit" yaml:"limit"`
 }
 
-// ZoneAwareRouting holds the zone aware routing configuration
+// ZoneAware defines the configuration related to the distribution of requests between locality zones.
+// +k8s:deepcopy-gen=true
+type ZoneAware struct {
+	// PreferLocal configures zone-aware routing to prefer sending traffic to the local locality zone.
+	PreferLocal *PreferLocalZone `json:"preferLocal,omitempty" yaml:"preferLocal,omitempty"`
+}
+
+// PreferLocalZone configures zone-aware routing to prefer sending traffic to the local locality zone.
+// +k8s:deepcopy-gen=true
+type PreferLocalZone struct {
+	// ForceLocalZone defines override configuration for forcing all traffic to stay within the local zone instead of the default behavior
+	// which maintains equal distribution among upstream endpoints while sending as much traffic as possible locally.
+	//
+	// +optional
+	// +notImplementedHide
+	Force *ForceLocalZone `json:"force,omitempty" yaml:"force,omitempty"`
+
+	// MinEndpointsThreshold is the minimum number of total upstream endpoints across all zones required to enable zone-aware routing.
+	//
+	MinEndpointsThreshold *uint64 `json:"minEndpointsThreshold,omitempty" yaml:"minEndpointsThreshold,omitempty"`
+}
+
+// ForceLocalZone defines override configuration for forcing all traffic to stay within the local zone instead of the default behavior
+// which maintains equal distribution among upstream endpoints while sending as much traffic as possible locally.
+// +k8s:deepcopy-gen=true
+type ForceLocalZone struct {
+	// MinEndpointsInZoneThreshold is the minimum number of upstream endpoints in the local zone required to honor the forceLocalZone
+	// override. This is useful for protecting zones with fewer endpoints.
+	//
+	MinEndpointsInZoneThreshold *uint32 `json:"minEndpointsInZoneThreshold,omitempty" yaml:"minEndpointsInZoneThreshold,omitempty"`
+}
+
+// ProxyInfraCluster holds the local cluster of EnvoyProxy instances
 // +k8s:deepcopy-gen=true
-type ZoneAwareRouting struct {
-	MinSize int `json:"minSize" yaml:"minSize"`
+type ProxyInfraCluster struct {
+	Name        string              `json:"name" yaml:"name"`
+	Destination *DestinationSetting `json:"destination,omitempty" yaml:"destination,omitempty"`
 }
diff --git a/internal/ir/xds_test.go b/internal/ir/xds_test.go
index b97dd0d94f..a198c5b795 100644
--- a/internal/ir/xds_test.go
+++ b/internal/ir/xds_test.go
@@ -1124,8 +1124,10 @@ func TestRouteDestination_NeedsClusterPerSetting(t *testing.T) {
 								Port: 8080,
 							},
 						},
-						AddressType:      ptr.To(FQDN),
-						ZoneAwareRouting: &ZoneAwareRouting{MinSize: 1},
+						AddressType: ptr.To(FQDN),
+						PreferLocal: &PreferLocalZone{
+							Force: &ForceLocalZone{MinEndpointsInZoneThreshold: ptr.To[uint32](1)},
+						},
 					},
 					{
 						Endpoints: []*DestinationEndpoint{
@@ -1152,8 +1154,10 @@ func TestRouteDestination_NeedsClusterPerSetting(t *testing.T) {
 								Port: 8080,
 							},
 						},
-						AddressType:      ptr.To(FQDN),
-						ZoneAwareRouting: &ZoneAwareRouting{MinSize: 1},
+						AddressType: ptr.To(FQDN),
+						PreferLocal: &PreferLocalZone{
+							Force: &ForceLocalZone{MinEndpointsInZoneThreshold: ptr.To[uint32](1)},
+						},
 					},
 				},
 			},
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index ab27afd5ac..d6eeb514ca 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -939,10 +939,10 @@ func (in *DestinationSetting) DeepCopyInto(out *DestinationSetting) {
 		*out = new(DestinationFilters)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.ZoneAwareRouting != nil {
-		in, out := &in.ZoneAwareRouting, &out.ZoneAwareRouting
-		*out = new(ZoneAwareRouting)
-		**out = **in
+	if in.PreferLocal != nil {
+		in, out := &in.PreferLocal, &out.PreferLocal
+		*out = new(PreferLocalZone)
+		(*in).DeepCopyInto(*out)
 	}
 	if in.Metadata != nil {
 		in, out := &in.Metadata, &out.Metadata
@@ -1286,6 +1286,26 @@ func (in *FaultInjectionDelay) DeepCopy() *FaultInjectionDelay {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ForceLocalZone) DeepCopyInto(out *ForceLocalZone) {
+	*out = *in
+	if in.MinEndpointsInZoneThreshold != nil {
+		in, out := &in.MinEndpointsInZoneThreshold, &out.MinEndpointsInZoneThreshold
+		*out = new(uint32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ForceLocalZone.
+func (in *ForceLocalZone) DeepCopy() *ForceLocalZone {
+	if in == nil {
+		return nil
+	}
+	out := new(ForceLocalZone)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GRPCExtAuthService) DeepCopyInto(out *GRPCExtAuthService) {
 	*out = *in
@@ -1356,6 +1376,11 @@ func (in *GlobalResources) DeepCopyInto(out *GlobalResources) {
 		*out = new(TLSCertificate)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.ProxyInfraCluster != nil {
+		in, out := &in.ProxyInfraCluster, &out.ProxyInfraCluster
+		*out = new(ProxyInfraCluster)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalResources.
@@ -2264,6 +2289,11 @@ func (in *LoadBalancer) DeepCopyInto(out *LoadBalancer) {
 		*out = new(ConsistentHash)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.ZoneAware != nil {
+		in, out := &in.ZoneAware, &out.ZoneAware
+		*out = new(ZoneAware)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LoadBalancer.
@@ -2619,6 +2649,31 @@ func (in *PerRetryPolicy) DeepCopy() *PerRetryPolicy {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PreferLocalZone) DeepCopyInto(out *PreferLocalZone) {
+	*out = *in
+	if in.Force != nil {
+		in, out := &in.Force, &out.Force
+		*out = new(ForceLocalZone)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.MinEndpointsThreshold != nil {
+		in, out := &in.MinEndpointsThreshold, &out.MinEndpointsThreshold
+		*out = new(uint64)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PreferLocalZone.
+func (in *PreferLocalZone) DeepCopy() *PreferLocalZone {
+	if in == nil {
+		return nil
+	}
+	out := new(PreferLocalZone)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Principal) DeepCopyInto(out *Principal) {
 	*out = *in
@@ -2698,6 +2753,26 @@ func (in *ProxyInfra) DeepCopy() *ProxyInfra {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyInfraCluster) DeepCopyInto(out *ProxyInfraCluster) {
+	*out = *in
+	if in.Destination != nil {
+		in, out := &in.Destination, &out.Destination
+		*out = new(DestinationSetting)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyInfraCluster.
+func (in *ProxyInfraCluster) DeepCopy() *ProxyInfraCluster {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyInfraCluster)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ProxyListener) DeepCopyInto(out *ProxyListener) {
 	*out = *in
@@ -4212,16 +4287,21 @@ func (in *Xds) DeepCopy() *Xds {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ZoneAwareRouting) DeepCopyInto(out *ZoneAwareRouting) {
+func (in *ZoneAware) DeepCopyInto(out *ZoneAware) {
 	*out = *in
+	if in.PreferLocal != nil {
+		in, out := &in.PreferLocal, &out.PreferLocal
+		*out = new(PreferLocalZone)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZoneAwareRouting.
-func (in *ZoneAwareRouting) DeepCopy() *ZoneAwareRouting {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZoneAware.
+func (in *ZoneAware) DeepCopy() *ZoneAware {
 	if in == nil {
 		return nil
 	}
-	out := new(ZoneAwareRouting)
+	out := new(ZoneAware)
 	in.DeepCopyInto(out)
 	return out
 }
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index a4b809f682..9b9dd96b0b 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -18,6 +18,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -43,6 +44,7 @@ import (
 	"github.com/envoyproxy/gateway/internal/gatewayapi"
 	"github.com/envoyproxy/gateway/internal/gatewayapi/resource"
 	"github.com/envoyproxy/gateway/internal/gatewayapi/status"
+	"github.com/envoyproxy/gateway/internal/infrastructure/kubernetes/proxy"
 	"github.com/envoyproxy/gateway/internal/logging"
 	"github.com/envoyproxy/gateway/internal/message"
 	workqueuemetrics "github.com/envoyproxy/gateway/internal/metrics/workqueue"
@@ -1256,6 +1258,14 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 		return err
 	}
 
+	mergedGateways := false
+	if resourceTree.EnvoyProxyForGatewayClass != nil && resourceTree.EnvoyProxyForGatewayClass.Spec.MergeGateways != nil && *resourceTree.EnvoyProxyForGatewayClass.Spec.MergeGateways {
+		mergedGateways = true
+		if err := r.processProxyInfra(ctx, managedGC.Name, resourceTree, resourceMap); err != nil {
+			return fmt.Errorf("failed to process proxy infra: %w", err)
+		}
+	}
+
 	for _, gtw := range gatewayList.Items {
 		gtw := gtw //nolint:copyloopvar
 		if r.namespaceLabel != nil {
@@ -1300,6 +1310,12 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 		}
 
 		gtwNamespacedName := utils.NamespacedName(&gtw).String()
+		if !mergedGateways {
+			if err := r.processProxyInfra(ctx, gtwNamespacedName, resourceTree, resourceMap); err != nil {
+				return err
+			}
+		}
+
 		// Route Processing
 
 		if r.tlsRouteCRDExists {
@@ -1361,6 +1377,44 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 	return nil
 }
 
+func (r *gatewayAPIReconciler) processProxyInfra(ctx context.Context, resourceName string, resourceTree *resource.Resources, resourceMap *resourceMappings) error {
+	proxySvcName := proxy.ExpectedResourceHashedName(resourceName)
+	proxySvc := &corev1.Service{}
+	if err := r.client.Get(ctx, types.NamespacedName{Name: proxySvcName, Namespace: r.namespace}, proxySvc); err != nil {
+		r.log.Info("no associated Services found for ProxyInfra", "name", resourceName, "hashedName", proxySvcName)
+		return err
+	}
+	resourceTree.Services = append(resourceTree.Services, proxySvc)
+	resourceMap.allAssociatedBackendRefs.Insert(gwapiv1.BackendObjectReference{
+		Kind:      ptr.To(gwapiv1.Kind("Service")),
+		Namespace: gatewayapi.NamespacePtr(proxySvc.Namespace),
+		Name:      gwapiv1.ObjectName(proxySvc.Name),
+	})
+	resourceMap.allAssociatedNamespaces.Insert(proxySvc.Namespace)
+
+	proxyEndPtSlices := &discoveryv1.EndpointSliceList{}
+	if err := r.client.List(ctx, proxyEndPtSlices, &client.ListOptions{
+		Namespace: r.namespace,
+		LabelSelector: labels.SelectorFromSet(map[string]string{
+			discoveryv1.LabelServiceName: proxySvcName,
+		}),
+	}); err != nil {
+		r.log.Info("no associated EndpointSlices found for ProxyInfra service", "name", resourceName, "hashedName", proxySvcName)
+		return err
+	}
+	for _, s := range proxyEndPtSlices.Items {
+		key := utils.NamespacedName(&s).String()
+		if !resourceMap.allAssociatedEndpointSlices.Has(key) {
+			resourceMap.allAssociatedEndpointSlices.Insert(key)
+			r.log.Info("added EndpointSlice to resource tree",
+				"namespace", s.Namespace,
+				"name", s.Name)
+			resourceTree.EndpointSlices = append(resourceTree.EndpointSlices, &s)
+		}
+	}
+	return nil
+}
+
 // processEnvoyPatchPolicies adds EnvoyPatchPolicies to the resourceTree
 func (r *gatewayAPIReconciler) processEnvoyPatchPolicies(ctx context.Context, resourceTree *resource.Resources, resourceMap *resourceMappings) error {
 	envoyPatchPolicies := egv1a1.EnvoyPatchPolicyList{}
diff --git a/internal/provider/kubernetes/predicates.go b/internal/provider/kubernetes/predicates.go
index 27b92e5cc9..16c519744b 100644
--- a/internal/provider/kubernetes/predicates.go
+++ b/internal/provider/kubernetes/predicates.go
@@ -333,7 +333,7 @@ func (r *gatewayAPIReconciler) validateServiceForReconcile(obj client.Object) bo
 	gtw := r.findOwningGateway(ctx, labels)
 	if gtw != nil {
 		r.updateGatewayStatus(gtw)
-		return false
+		return true
 	}
 
 	// Merged gateways will have only this label, update status of all Gateways under found GatewayClass.
@@ -405,6 +405,10 @@ func (r *gatewayAPIReconciler) validateBackendForReconcile(obj client.Object) bo
 		}
 	}
 
+	if r.isProxyInfraService(&nsName) {
+		return true
+	}
+
 	return false
 }
 
@@ -578,7 +582,7 @@ func (r *gatewayAPIReconciler) validateObjectForReconcile(obj client.Object) boo
 			r.log.Info("no Gateways found under GatewayClass", "name", gcName)
 			return false
 		}
-		return false
+		return true
 	}
 
 	// There is no need to reconcile the object any further.
@@ -874,6 +878,29 @@ func (r *gatewayAPIReconciler) isRouteReferencingHTTPRouteFilter(nsName *types.N
 	return len(httpRouteList.Items) != 0
 }
 
+func (r *gatewayAPIReconciler) isProxyInfraService(nn *types.NamespacedName) bool {
+	ctx := context.Background()
+	svc := &corev1.Service{}
+	if err := r.client.Get(ctx, *nn, svc); err != nil {
+		r.log.Error(err, "unable to find associated ProxyInfra service")
+		return false
+	}
+
+	svcLabels := svc.GetLabels()
+
+	// Check if the Service belongs to a Gateway, if so, update the Gateway status.
+	if gtw := r.findOwningGateway(ctx, svcLabels); gtw != nil {
+		return true
+	}
+
+	// Merged gateways will have only this label, update status of all Gateways under found GatewayClass.
+	gcName, ok := svcLabels[gatewayapi.OwningGatewayClassLabel]
+	if ok && r.mergeGateways.Has(gcName) {
+		return true
+	}
+	return false
+}
+
 // validateHTTPRouteFilterForReconcile tries finding the referencing HTTPRoute of the filter
 func (r *gatewayAPIReconciler) validateHTTPRouteFilterForReconcile(obj client.Object) bool {
 	hrf, ok := obj.(*egv1a1.HTTPRouteFilter)
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
index 5b24c996bb..6098378e8f 100644
--- a/internal/xds/translator/cluster.go
+++ b/internal/xds/translator/cluster.go
@@ -225,25 +225,7 @@ func buildXdsCluster(args *xdsClusterArgs) (*buildClusterResult, error) {
 		cluster.TypedExtensionProtocolOptions = epo
 	}
 
-	// Set default localityLbConfig
-	localityLbConfig := &commonv3.LocalityLbConfig{
-		LocalityConfigSpecifier: &commonv3.LocalityLbConfig_LocalityWeightedLbConfig_{
-			LocalityWeightedLbConfig: &commonv3.LocalityLbConfig_LocalityWeightedLbConfig{},
-		},
-	}
-
-	// Override LocalityWeightedLbConfig if zone aware routing is enabled.
-	// Zone aware enabled backendRefs always have a single DestinationSetting per-cluster.
-	if len(args.settings) == 1 && args.settings[0].ZoneAwareRouting != nil {
-		localityLbConfig.LocalityConfigSpecifier = &commonv3.LocalityLbConfig_ZoneAwareLbConfig_{
-			ZoneAwareLbConfig: &commonv3.LocalityLbConfig_ZoneAwareLbConfig{
-				MinClusterSize: wrapperspb.UInt64(1),
-				ForceLocalZone: &commonv3.LocalityLbConfig_ZoneAwareLbConfig_ForceLocalZone{
-					MinSize: wrapperspb.UInt32(uint32(args.settings[0].ZoneAwareRouting.MinSize)),
-				},
-			},
-		}
-	}
+	localityLbConfig := buildLocalityLbConfig(args)
 
 	// Set Load Balancer policy
 	//nolint:gocritic
@@ -439,6 +421,51 @@ func buildXdsCluster(args *xdsClusterArgs) (*buildClusterResult, error) {
 	}, nil
 }
 
+func buildLocalityLbConfig(args *xdsClusterArgs) *commonv3.LocalityLbConfig {
+	// Default to LocalityWeightedLbConfig
+	localityLbConfig := &commonv3.LocalityLbConfig{
+		LocalityConfigSpecifier: &commonv3.LocalityLbConfig_LocalityWeightedLbConfig_{
+			LocalityWeightedLbConfig: &commonv3.LocalityLbConfig_LocalityWeightedLbConfig{},
+		},
+	}
+
+	// Check PreferLocal from settings
+	if len(args.settings) == 1 {
+		if cfg := buildZoneAwareLbConfig(args.settings[0].PreferLocal); cfg != nil {
+			localityLbConfig.LocalityConfigSpecifier = cfg
+		}
+	}
+
+	// Explicit LoadBalancer.ZoneAware overrides config from args.settings
+	if zoneAware := ptr.Deref(args.loadBalancer, ir.LoadBalancer{}).ZoneAware; zoneAware != nil {
+		// Will later include additional case for weighted localities
+		if zoneAware.PreferLocal != nil {
+			if cfg := buildZoneAwareLbConfig(zoneAware.PreferLocal); cfg != nil {
+				localityLbConfig.LocalityConfigSpecifier = cfg
+			}
+		}
+	}
+
+	return localityLbConfig
+}
+
+func buildZoneAwareLbConfig(preferLocal *ir.PreferLocalZone) *commonv3.LocalityLbConfig_ZoneAwareLbConfig_ {
+	if preferLocal == nil {
+		return nil
+	}
+	lbConfig := &commonv3.LocalityLbConfig_ZoneAwareLbConfig_{
+		ZoneAwareLbConfig: &commonv3.LocalityLbConfig_ZoneAwareLbConfig{
+			MinClusterSize: wrapperspb.UInt64(ptr.Deref(preferLocal.MinEndpointsThreshold, 6)),
+		},
+	}
+	if preferLocal.Force != nil {
+		lbConfig.ZoneAwareLbConfig.ForceLocalZone = &commonv3.LocalityLbConfig_ZoneAwareLbConfig_ForceLocalZone{
+			MinSize: wrapperspb.UInt32(ptr.Deref(preferLocal.Force.MinEndpointsInZoneThreshold, 1)),
+		}
+	}
+	return lbConfig
+}
+
 func buildXdsHealthCheck(healthcheck *ir.ActiveHealthCheck) []*corev3.HealthCheck {
 	hc := &corev3.HealthCheck{
 		Timeout:  durationpb.New(healthcheck.Timeout.Duration),
@@ -645,7 +672,7 @@ func buildXdsClusterLoadAssignment(clusterName string, destSettings []*ir.Destin
 		// if multiple backendRefs exist. This pushes part of the routing logic higher up the stack which can
 		// limit host selection controls during retries and session affinity.
 		// For more details see https://github.com/envoyproxy/gateway/issues/5307#issuecomment-2688767482
-		if ds.ZoneAwareRouting != nil {
+		if ds.PreferLocal != nil {
 			localities = append(localities, buildZonalLocalities(metadata, ds)...)
 		} else {
 			localities = append(localities, buildWeightedLocalities(metadata, ds))
diff --git a/internal/xds/translator/globalresources.go b/internal/xds/translator/globalresources.go
index 0cb59c5f41..bb481356bf 100644
--- a/internal/xds/translator/globalresources.go
+++ b/internal/xds/translator/globalresources.go
@@ -31,9 +31,12 @@ const (
 // patchGlobalResources builds and appends the global resources that are shared across listeners and routes.
 // for example, the envoy client certificate and the OIDC HMAC secret.
 func (t *Translator) patchGlobalResources(tCtx *types.ResourceVersionTable, irXds *ir.Xds) error {
-	var errs error
+	if irXds.GlobalResources == nil {
+		return nil
+	}
 
-	if irXds.GlobalResources != nil && irXds.GlobalResources.EnvoyClientCertificate != nil {
+	var errs error
+	if irXds.GlobalResources.EnvoyClientCertificate != nil {
 		// Create the envoy client TLS secret. It is used for envoy to establish a TLS connection with control plane components.
 		if err := createEnvoyClientTLSCertSecret(tCtx, irXds.GlobalResources); err != nil {
 			errs = errors.Join(errs, err)
@@ -51,6 +54,16 @@ func (t *Translator) patchGlobalResources(tCtx *types.ResourceVersionTable, irXd
 			}
 		}
 	}
+	if irXds.GlobalResources.ProxyInfraCluster != nil {
+		proxyCluster := irXds.GlobalResources.ProxyInfraCluster
+		if err := addXdsCluster(tCtx, &xdsClusterArgs{
+			name:         proxyCluster.Name,
+			settings:     []*ir.DestinationSetting{proxyCluster.Destination},
+			endpointType: EndpointTypeStatic,
+		}); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
 	return errs
 }
 
diff --git a/internal/xds/translator/route.go b/internal/xds/translator/route.go
index 7458145c2f..cdb92149a7 100644
--- a/internal/xds/translator/route.go
+++ b/internal/xds/translator/route.go
@@ -82,8 +82,7 @@ func buildXdsRoute(httpRoute *ir.HTTPRoute, httpListener *ir.HTTPListener) (*rou
 
 		router.Action = &routev3.Route_Route{Route: routeAction}
 	default:
-		backendWeights := httpRoute.Destination.ToBackendWeights()
-		routeAction := buildXdsRouteAction(backendWeights, httpRoute.Destination)
+		routeAction := buildXdsRouteAction(httpRoute)
 		routeAction.IdleTimeout = idleTimeout(httpRoute)
 
 		if httpRoute.Mirrors != nil {
@@ -284,10 +283,11 @@ func buildXdsStringMatcher(irMatch *ir.StringMatch) *matcherv3.StringMatcher {
 	return stringMatcher
 }
 
-func buildXdsRouteAction(backendWeights *ir.BackendWeights, dest *ir.RouteDestination) *routev3.RouteAction {
+func buildXdsRouteAction(route *ir.HTTPRoute) *routev3.RouteAction {
+	backendWeights := route.Destination.ToBackendWeights()
 	// only use weighted cluster when there are invalid weights
-	if dest.NeedsClusterPerSetting() || backendWeights.Invalid != 0 {
-		return buildXdsWeightedRouteAction(backendWeights, dest.Settings)
+	if route.NeedsClusterPerSetting() || backendWeights.Invalid != 0 {
+		return buildXdsWeightedRouteAction(backendWeights, route.Destination.Settings)
 	}
 
 	return &routev3.RouteAction{
diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-proxy-cluster-infra.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-proxy-cluster-infra.yaml
new file mode 100644
index 0000000000..b27ab27b90
--- /dev/null
+++ b/internal/xds/translator/testdata/in/xds-ir/http-route-proxy-cluster-infra.yaml
@@ -0,0 +1,33 @@
+globalResources:
+  proxyInfraCluster:
+    destination:
+      addressType: IP
+      endpoints:
+        - host: 7.6.5.4
+          port: 8080
+          zone: zone1
+      name: envoy-envoy-gateway-gateway-1-196ae069
+      protocol: HTTP
+    name: envoy-gateway-gateway-1-196ae069
+http:
+  - name: "first-listener"
+    address: "::"
+    port: 10080
+    hostnames:
+      - "*"
+    routes:
+      - name: "first-route"
+        hostname: "*"
+        destination:
+          name: "first-route-dest"
+          settings:
+            - endpoints:
+                - host: "1.2.3.4"
+                  port: 8080
+                  zone: us-east-1a
+                - host: "2.3.4.5"
+                  port: 8080
+                  zone: us-east-1b
+              name: "first-route-dest/backend/0"
+              weight: 30
+              zoneAwareRoutingEnabled: true
\ No newline at end of file
diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-lb-routing.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-lb-routing.yaml
new file mode 100644
index 0000000000..f602cfc808
--- /dev/null
+++ b/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-lb-routing.yaml
@@ -0,0 +1,69 @@
+http:
+- name: "first-listener"
+  address: "::"
+  port: 10080
+  hostnames:
+  - "*"
+  routes:
+  - name: "route-with-settings-preferlocal"
+    hostname: "*"
+    destination:
+      name: "route-with-settings-preferlocal-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 8080
+          zone: us-east-1a
+        - host: "2.3.4.5"
+          port: 8080
+          zone: us-east-1b
+        name: "route-with-settings-preferlocal/backend/0"
+        weight: 30
+        preferLocal:
+          minEndpointsThreshold: 1
+          force:
+            minEndpointsInZoneThreshold: 1
+  - name: "route-with-lb-preferlocal"
+    hostname: "*"
+    destination:
+      name: "route-with-lb-preferlocal-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 8080
+          zone: us-east-1a
+        - host: "2.3.4.5"
+          port: 8080
+          zone: us-east-1b
+        name: "route-with-lb-preferlocal-dest/backend/0"
+        weight: 30
+    traffic:
+      loadBalancer:
+        leastRequest: {}
+        zoneAware:
+          preferLocal:
+            minEndpointsThreshold: 3
+  - name: "route-with-lb-and-settings-preferlocal"
+    hostname: "*"
+    destination:
+      name: "route-with-lb-and-settings-preferlocal-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 8080
+          zone: us-east-1a
+        - host: "2.3.4.5"
+          port: 8080
+          zone: us-east-1b
+        name: "route-with-lb-and-settings-preferlocal-dest/backend/0"
+        weight: 30
+        preferLocal:
+          minEndpointsThreshold: 1
+          force:
+            minEndpointsInZoneThreshold: 1
+    traffic:
+      loadBalancer:
+        leastRequest: {}
+        zoneAware:
+          preferLocal:
+            minEndpointsThreshold: 3
diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-routing-weighted-clusters.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-routing-weighted-clusters.yaml
index fb9c0c6fc1..2f2a70ad9c 100644
--- a/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-routing-weighted-clusters.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-routing-weighted-clusters.yaml
@@ -19,8 +19,10 @@ http:
           zone: us-east-1b
         name: "first-route-dest/backend/0"
         weight: 30
-        zoneAwareRouting:
-          minSize: 1
+        preferLocalZone:
+          minEndpointsThreshold: 1
+          force:
+            minEndpointsInZoneThreshold: 1
       - endpoints:
         - host: "3.4.5.6"
           port: 9090
diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-routing.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-routing.yaml
index 37d103aed2..23d66a3995 100644
--- a/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-routing.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/http-route-zonal-routing.yaml
@@ -19,5 +19,7 @@ http:
           zone: us-east-1b
         name: "first-route-dest/backend/0"
         weight: 30
-        zoneAwareRouting:
-          minSize: 1
+        preferLocalZone:
+          minEndpointsThreshold: 1
+          force:
+            minEndpointsInZoneThreshold: 1
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.clusters.yaml
new file mode 100644
index 0000000000..881b9f71e4
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.clusters.yaml
@@ -0,0 +1,48 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  ignoreHealthOnHostRemoval: true
+  lbPolicy: LEAST_REQUEST
+  loadBalancingPolicy:
+    policies:
+    - typedExtensionConfig:
+        name: envoy.load_balancing_policies.least_request
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+          localityLbConfig:
+            localityWeightedLbConfig: {}
+  name: first-route-dest
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoy-gateway-gateway-1-196ae069
+  ignoreHealthOnHostRemoval: true
+  lbPolicy: LEAST_REQUEST
+  loadBalancingPolicy:
+    policies:
+    - typedExtensionConfig:
+        name: envoy.load_balancing_policies.least_request
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+          localityLbConfig:
+            localityWeightedLbConfig: {}
+  name: envoy-gateway-gateway-1-196ae069
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.endpoints.yaml
new file mode 100644
index 0000000000..e6a3b120e4
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.endpoints.yaml
@@ -0,0 +1,30 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 8080
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.3.4.5
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 30
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: envoy-gateway-gateway-1-196ae069
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.6.5.4
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: envoy-envoy-gateway-gateway-1-196ae069
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.listeners.yaml
new file mode 100644
index 0000000000..5c7db41545
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: '::'
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http-10080
+        useRemoteAddress: true
+    name: first-listener
+  maxConnectionsToAcceptPerSocketEvent: 1
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.routes.yaml
new file mode 100644
index 0000000000..0b5b4bee7b
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-proxy-cluster-infra.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.clusters.yaml
new file mode 100644
index 0000000000..50cd448cd2
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.clusters.yaml
@@ -0,0 +1,77 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: route-with-settings-preferlocal-dest
+  ignoreHealthOnHostRemoval: true
+  lbPolicy: LEAST_REQUEST
+  loadBalancingPolicy:
+    policies:
+    - typedExtensionConfig:
+        name: envoy.load_balancing_policies.least_request
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+          localityLbConfig:
+            zoneAwareLbConfig:
+              forceLocalZone:
+                minSize: 1
+              minClusterSize: "1"
+  name: route-with-settings-preferlocal-dest
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: route-with-lb-preferlocal-dest/backend/0
+  ignoreHealthOnHostRemoval: true
+  lbPolicy: LEAST_REQUEST
+  loadBalancingPolicy:
+    policies:
+    - typedExtensionConfig:
+        name: envoy.load_balancing_policies.least_request
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+          localityLbConfig:
+            zoneAwareLbConfig:
+              minClusterSize: "3"
+  name: route-with-lb-preferlocal-dest/backend/0
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: route-with-lb-and-settings-preferlocal-dest/backend/0
+  ignoreHealthOnHostRemoval: true
+  lbPolicy: LEAST_REQUEST
+  loadBalancingPolicy:
+    policies:
+    - typedExtensionConfig:
+        name: envoy.load_balancing_policies.least_request
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+          localityLbConfig:
+            zoneAwareLbConfig:
+              minClusterSize: "3"
+  name: route-with-lb-and-settings-preferlocal-dest/backend/0
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.endpoints.yaml
new file mode 100644
index 0000000000..9ad2673fed
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.endpoints.yaml
@@ -0,0 +1,58 @@
+- clusterName: route-with-settings-preferlocal-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 8080
+      loadBalancingWeight: 1
+    locality:
+      zone: us-east-1a
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.3.4.5
+            portValue: 8080
+      loadBalancingWeight: 1
+    locality:
+      zone: us-east-1b
+- clusterName: route-with-lb-preferlocal-dest/backend/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 8080
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.3.4.5
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 30
+    locality:
+      region: route-with-lb-preferlocal-dest/backend/0
+- clusterName: route-with-lb-and-settings-preferlocal-dest/backend/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 8080
+      loadBalancingWeight: 1
+    locality:
+      zone: us-east-1a
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.3.4.5
+            portValue: 8080
+      loadBalancingWeight: 1
+    locality:
+      zone: us-east-1b
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.listeners.yaml
new file mode 100644
index 0000000000..5c7db41545
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: '::'
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http-10080
+        useRemoteAddress: true
+    name: first-listener
+  maxConnectionsToAcceptPerSocketEvent: 1
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.routes.yaml
new file mode 100644
index 0000000000..c6b19600c0
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-lb-routing.routes.yaml
@@ -0,0 +1,36 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: route-with-settings-preferlocal
+      route:
+        cluster: route-with-settings-preferlocal-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: route-with-lb-preferlocal
+      route:
+        clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
+        upgradeConfigs:
+        - upgradeType: websocket
+        weightedClusters:
+          clusters:
+          - name: route-with-lb-preferlocal-dest/backend/0
+            weight: 30
+    - match:
+        prefix: /
+      name: route-with-lb-and-settings-preferlocal
+      route:
+        clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
+        upgradeConfigs:
+        - upgradeType: websocket
+        weightedClusters:
+          clusters:
+          - name: route-with-lb-and-settings-preferlocal-dest/backend/0
+            weight: 30
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.clusters.yaml
index d4c76edfbf..054f90bb71 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.clusters.yaml
@@ -8,34 +8,7 @@
     edsConfig:
       ads: {}
       resourceApiVersion: V3
-    serviceName: first-route-dest/backend/0
-  ignoreHealthOnHostRemoval: true
-  lbPolicy: LEAST_REQUEST
-  loadBalancingPolicy:
-    policies:
-    - typedExtensionConfig:
-        name: envoy.load_balancing_policies.least_request
-        typedConfig:
-          '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
-          localityLbConfig:
-            zoneAwareLbConfig:
-              forceLocalZone:
-                minSize: 1
-              minClusterSize: "1"
-  name: first-route-dest/backend/0
-  perConnectionBufferLimitBytes: 32768
-  type: EDS
-- circuitBreakers:
-    thresholds:
-    - maxRetries: 1024
-  commonLbConfig: {}
-  connectTimeout: 10s
-  dnsLookupFamily: V4_PREFERRED
-  edsClusterConfig:
-    edsConfig:
-      ads: {}
-      resourceApiVersion: V3
-    serviceName: first-route-dest/backend/1
+    serviceName: first-route-dest
   ignoreHealthOnHostRemoval: true
   lbPolicy: LEAST_REQUEST
   loadBalancingPolicy:
@@ -46,6 +19,6 @@
           '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
           localityLbConfig:
             localityWeightedLbConfig: {}
-  name: first-route-dest/backend/1
+  name: first-route-dest
   perConnectionBufferLimitBytes: 32768
   type: EDS
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.endpoints.yaml
index c6c23b8c1e..46d68c9c37 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.endpoints.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.endpoints.yaml
@@ -1,4 +1,4 @@
-- clusterName: first-route-dest/backend/0
+- clusterName: first-route-dest
   endpoints:
   - lbEndpoints:
     - endpoint:
@@ -7,19 +7,15 @@
             address: 1.2.3.4
             portValue: 8080
       loadBalancingWeight: 1
-    locality:
-      zone: us-east-1a
-  - lbEndpoints:
     - endpoint:
         address:
           socketAddress:
             address: 2.3.4.5
             portValue: 8080
       loadBalancingWeight: 1
+    loadBalancingWeight: 30
     locality:
-      zone: us-east-1b
-- clusterName: first-route-dest/backend/1
-  endpoints:
+      region: first-route-dest/backend/0
   - lbEndpoints:
     - endpoint:
         address:
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.routes.yaml
index d2d5e3aefd..0b5b4bee7b 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing-weighted-clusters.routes.yaml
@@ -9,12 +9,6 @@
         prefix: /
       name: first-route
       route:
-        clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
+        cluster: first-route-dest
         upgradeConfigs:
         - upgradeType: websocket
-        weightedClusters:
-          clusters:
-          - name: first-route-dest/backend/0
-            weight: 30
-          - name: first-route-dest/backend/1
-            weight: 70
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing.clusters.yaml
index 546f93e8e6..054f90bb71 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing.clusters.yaml
@@ -18,10 +18,7 @@
         typedConfig:
           '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
           localityLbConfig:
-            zoneAwareLbConfig:
-              forceLocalZone:
-                minSize: 1
-              minClusterSize: "1"
+            localityWeightedLbConfig: {}
   name: first-route-dest
   perConnectionBufferLimitBytes: 32768
   type: EDS
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing.endpoints.yaml
index 4d20294a0a..df5e88e990 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing.endpoints.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-zonal-routing.endpoints.yaml
@@ -7,14 +7,12 @@
             address: 1.2.3.4
             portValue: 8080
       loadBalancingWeight: 1
-    locality:
-      zone: us-east-1a
-  - lbEndpoints:
     - endpoint:
         address:
           socketAddress:
             address: 2.3.4.5
             portValue: 8080
       loadBalancingWeight: 1
+    loadBalancingWeight: 30
     locality:
-      zone: us-east-1b
+      region: first-route-dest/backend/0
diff --git a/internal/xds/translator/translator.go b/internal/xds/translator/translator.go
index 0b3dbe724e..6fe94360c9 100644
--- a/internal/xds/translator/translator.go
+++ b/internal/xds/translator/translator.go
@@ -133,6 +133,7 @@ func (t *Translator) Translate(xdsIR *ir.Xds) (*types.ResourceVersionTable, erro
 	// - the envoy client certificate
 	// - the OIDC HMAC secret
 	// - the rate limit server cluster
+	// - the EnvoyProxy cluster
 	if err := t.patchGlobalResources(tCtx, xdsIR); err != nil {
 		errs = errors.Join(errs, err)
 	}
@@ -547,7 +548,7 @@ func (t *Translator) addRouteToRouteConfig(
 			var err error
 			// If there are no filters in the destination settings we create
 			// a regular xds Cluster
-			if !httpRoute.Destination.NeedsClusterPerSetting() {
+			if !httpRoute.NeedsClusterPerSetting() {
 				err = processXdsCluster(
 					tCtx,
 					httpRoute.Destination.Name,

From c147970093f31f5d2e439cf07ecfed3d3afe6285 Mon Sep 17 00:00:00 2001
From: Jukie <10012479+Jukie@users.noreply.github.com>
Date: Mon, 7 Jul 2025 23:04:48 -0600
Subject: [PATCH 2/6] lint

Signed-off-by: Jukie <10012479+Jukie@users.noreply.github.com>
---
 internal/ir/xds.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index ff43f6e2f5..df4ccafeaf 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -813,14 +813,14 @@ func (h *HTTPRoute) GetRetry() *Retry {
 	return nil
 }
 
-func (r *HTTPRoute) NeedsClusterPerSetting() bool {
-	if r.Traffic != nil &&
-		r.Traffic.LoadBalancer != nil &&
-		r.Traffic.LoadBalancer.ZoneAware != nil &&
-		r.Traffic.LoadBalancer.ZoneAware.PreferLocal != nil {
+func (h *HTTPRoute) NeedsClusterPerSetting() bool {
+	if h.Traffic != nil &&
+		h.Traffic.LoadBalancer != nil &&
+		h.Traffic.LoadBalancer.ZoneAware != nil &&
+		h.Traffic.LoadBalancer.ZoneAware.PreferLocal != nil {
 		return true
 	}
-	return r.Destination.NeedsClusterPerSetting()
+	return h.Destination.NeedsClusterPerSetting()
 }
 
 // DNS contains configuration options for DNS resolution.

From 339c5036da86442307bedb96cf1c02c71aa7903b Mon Sep 17 00:00:00 2001
From: Isaac <10012479+jukie@users.noreply.github.com>
Date: Mon, 7 Jul 2025 23:23:59 -0600
Subject: [PATCH 3/6] linting

Signed-off-by: Jukie <10012479+Jukie@users.noreply.github.com>
---
 .../testdata/in/xds-ir/http-route-proxy-cluster-infra.yaml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/xds/translator/testdata/in/xds-ir/http-route-proxy-cluster-infra.yaml b/internal/xds/translator/testdata/in/xds-ir/http-route-proxy-cluster-infra.yaml
index b27ab27b90..b745456aa5 100644
--- a/internal/xds/translator/testdata/in/xds-ir/http-route-proxy-cluster-infra.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/http-route-proxy-cluster-infra.yaml
@@ -30,4 +30,4 @@ http:
                   zone: us-east-1b
               name: "first-route-dest/backend/0"
               weight: 30
-              zoneAwareRoutingEnabled: true
\ No newline at end of file
+              zoneAwareRoutingEnabled: true

From 6544869f79bd7f6f66553b5744f2462b3bb434ab Mon Sep 17 00:00:00 2001
From: Jukie <10012479+Jukie@users.noreply.github.com>
Date: Tue, 8 Jul 2025 00:45:36 -0600
Subject: [PATCH 4/6] Tweak bootstrap

Signed-off-by: Jukie <10012479+Jukie@users.noreply.github.com>
---
 .../translate/out/default-resources.all.yaml  | 65 +++++++++---------
 .../out/from-gateway-api-to-xds.all.json      | 40 ++++++-----
 .../out/from-gateway-api-to-xds.all.yaml      | 32 ++++-----
 .../from-gateway-api-to-xds.bootstrap.yaml    | 32 ++++-----
 ...-single-route-single-match-to-xds.all.json | 40 ++++++-----
 ...-single-route-single-match-to-xds.all.yaml | 32 ++++-----
 ...e-route-single-match-to-xds.bootstrap.yaml | 32 ++++-----
 .../out/no-service-cluster-ip.all.yaml        | 32 ++++-----
 .../proxy/testdata/daemonsets/custom.yaml     | 33 +++++-----
 .../testdata/daemonsets/default-env.yaml      | 33 +++++-----
 .../proxy/testdata/daemonsets/default.yaml    | 33 +++++-----
 .../daemonsets/disable-prometheus.yaml        | 33 +++++-----
 .../testdata/daemonsets/extension-env.yaml    | 33 +++++-----
 .../daemonsets/gateway-namespace-mode.yaml    | 33 +++++-----
 .../override-labels-and-annotations.yaml      | 33 +++++-----
 .../testdata/daemonsets/patch-daemonset.yaml  | 33 +++++-----
 .../testdata/daemonsets/shutdown-manager.yaml | 33 +++++-----
 .../proxy/testdata/daemonsets/volumes.yaml    | 33 +++++-----
 .../testdata/daemonsets/with-annotations.yaml | 33 +++++-----
 .../testdata/daemonsets/with-extra-args.yaml  | 33 +++++-----
 .../daemonsets/with-image-pull-secrets.yaml   | 33 +++++-----
 .../proxy/testdata/daemonsets/with-name.yaml  | 33 +++++-----
 .../daemonsets/with-node-selector.yaml        | 33 +++++-----
 .../with-topology-spread-constraints.yaml     | 33 +++++-----
 .../proxy/testdata/deployments/custom-sa.yaml | 33 +++++-----
 .../proxy/testdata/deployments/custom.yaml    | 33 +++++-----
 .../custom_with_initcontainers.yaml           | 33 +++++-----
 .../testdata/deployments/default-env.yaml     | 33 +++++-----
 .../proxy/testdata/deployments/default.yaml   | 33 +++++-----
 .../deployments/disable-prometheus.yaml       | 33 +++++-----
 .../testdata/deployments/dual-stack.yaml      | 33 +++++-----
 .../testdata/deployments/extension-env.yaml   | 33 +++++-----
 .../deployments/gateway-namespace-mode.yaml   | 33 +++++-----
 .../proxy/testdata/deployments/ipv6.yaml      | 33 +++++-----
 .../override-labels-and-annotations.yaml      | 33 +++++-----
 .../deployments/patch-deployment.yaml         | 33 +++++-----
 .../deployments/shutdown-manager.yaml         | 33 +++++-----
 .../proxy/testdata/deployments/volumes.yaml   | 33 +++++-----
 .../deployments/with-annotations.yaml         | 33 +++++-----
 .../deployments/with-empty-memory-limits.yaml | 33 +++++-----
 .../testdata/deployments/with-extra-args.yaml | 33 +++++-----
 .../deployments/with-image-pull-secrets.yaml  | 33 +++++-----
 .../proxy/testdata/deployments/with-name.yaml | 33 +++++-----
 .../deployments/with-node-selector.yaml       | 33 +++++-----
 .../with-topology-spread-constraints.yaml     | 33 +++++-----
 .../gateway-namespace-mode/deployment.yaml    | 66 +++++++++----------
 internal/provider/kubernetes/predicates.go    | 10 +--
 internal/xds/bootstrap/bootstrap.yaml.tpl     | 34 +++++-----
 .../bootstrap/testdata/merge/default.out.yaml | 32 ++++-----
 .../merge/merge-user-bootstrap.out.yaml       | 32 ++++-----
 .../merge/patch-global-config.out.yaml        | 33 +++++-----
 .../testdata/merge/stats_sinks.out.yaml       | 32 ++++-----
 .../testdata/render/custom-server-port.yaml   | 33 +++++-----
 .../testdata/render/custom-stats-matcher.yaml | 33 +++++-----
 .../testdata/render/disable-prometheus.yaml   | 33 +++++-----
 .../enable-prometheus-brotli-compression.yaml | 33 +++++-----
 .../enable-prometheus-gzip-compression.yaml   | 33 +++++-----
 .../testdata/render/enable-prometheus.yaml    | 33 +++++-----
 .../xds/bootstrap/testdata/render/ipv6.yaml   | 33 +++++-----
 .../render/otel-metrics-backendref.yaml       | 33 +++++-----
 .../testdata/render/otel-metrics.yaml         | 33 +++++-----
 .../render/with-max-heap-size-bytes.yaml      | 33 +++++-----
 62 files changed, 1019 insertions(+), 1076 deletions(-)

diff --git a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
index 31b11eb1af..7652dafbb1 100644
--- a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
@@ -20,7 +20,7 @@ envoyProxyForGatewayClass:
               address: 127.0.0.1
               port_value: 19000
         cluster_manager:
-          local_cluster_name: local_cluster
+          local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
         node:
           locality:
             zone: $(ENVOY_SERVICE_ZONE)
@@ -95,22 +95,21 @@ envoyProxyForGatewayClass:
                         address: 127.0.0.1
                         port_value: 19000
           - connect_timeout: 10s
-            lb_policy: ROUND_ROBIN
-            load_assignment:
-              cluster_name: local_cluster
-              endpoints:
-              - lb_endpoints:
-                - endpoint:
-                    address:
-                      socket_address:
-                        address: 127.0.0.1
-                        port_value: 10080
-                  load_balancing_weight: 1
-                load_balancing_weight: 1
-                locality:
-                  zone: $(ENVOY_SERVICE_ZONE)
-            name: local_cluster
-            type: STATIC
+            eds_cluster_config:
+              eds_config:
+                ads: {}
+                resource_api_version: 'V3'
+              service_name: $(ENVOY_PROXY_INFRA_NAME)
+            load_balancing_policy:
+              policies:
+                - typed_extension_config:
+                    name: 'envoy.load_balancing_policies.least_request'
+                    typed_config:
+                      '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                      locality_lb_config:
+                        locality_weighted_lb_config: {}
+            name: $(ENVOY_PROXY_INFRA_NAME)
+            type: EDS
           - connect_timeout: 10s
             load_assignment:
               cluster_name: xds_cluster
@@ -560,7 +559,7 @@ xds:
               address: 127.0.0.1
               portValue: 19000
         clusterManager:
-          localClusterName: local_cluster
+          localClusterName: $(ENVOY_PROXY_INFRA_NAME)
         dynamicResources:
           adsConfig:
             apiType: DELTA_GRPC
@@ -607,21 +606,21 @@ xds:
             name: prometheus_stats
             type: STATIC
           - connectTimeout: 10s
-            loadAssignment:
-              clusterName: local_cluster
-              endpoints:
-              - lbEndpoints:
-                - endpoint:
-                    address:
-                      socketAddress:
-                        address: 127.0.0.1
-                        portValue: 10080
-                  loadBalancingWeight: 1
-                loadBalancingWeight: 1
-                locality:
-                  zone: $(ENVOY_SERVICE_ZONE)
-            name: local_cluster
-            type: STATIC
+            edsClusterConfig:
+              edsConfig:
+                ads: {}
+                resourceApiVersion: V3
+              serviceName: $(ENVOY_PROXY_INFRA_NAME)
+            loadBalancingPolicy:
+              policies:
+              - typedExtensionConfig:
+                  name: envoy.load_balancing_policies.least_request
+                  typedConfig:
+                    '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+                    localityLbConfig:
+                      localityWeightedLbConfig: {}
+            name: $(ENVOY_PROXY_INFRA_NAME)
+            type: EDS
           - connectTimeout: 10s
             loadAssignment:
               clusterName: xds_cluster
diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json
index b592bd3e6a..ea90f31076 100644
--- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json
+++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json
@@ -23,7 +23,7 @@
               }
             },
             "clusterManager": {
-              "localClusterName": "local_cluster"
+              "localClusterName": "$(ENVOY_PROXY_INFRA_NAME)"
             },
             "dynamicResources": {
               "adsConfig": {
@@ -104,32 +104,30 @@
                 },
                 {
                   "connectTimeout": "10s",
-                  "loadAssignment": {
-                    "clusterName": "local_cluster",
-                    "endpoints": [
+                  "edsClusterConfig": {
+                    "edsConfig": {
+                      "ads": {},
+                      "resourceApiVersion": "V3"
+                    },
+                    "serviceName": "$(ENVOY_PROXY_INFRA_NAME)"
+                  },
+                  "loadBalancingPolicy": {
+                    "policies": [
                       {
-                        "lbEndpoints": [
-                          {
-                            "endpoint": {
-                              "address": {
-                                "socketAddress": {
-                                  "address": "127.0.0.1",
-                                  "portValue": 10080
-                                }
-                              }
-                            },
-                            "loadBalancingWeight": 1
+                        "typedExtensionConfig": {
+                          "name": "envoy.load_balancing_policies.least_request",
+                          "typedConfig": {
+                            "@type": "type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest",
+                            "localityLbConfig": {
+                              "localityWeightedLbConfig": {}
+                            }
                           }
-                        ],
-                        "loadBalancingWeight": 1,
-                        "locality": {
-                          "zone": "$(ENVOY_SERVICE_ZONE)"
                         }
                       }
                     ]
                   },
-                  "name": "local_cluster",
-                  "type": "STATIC"
+                  "name": "$(ENVOY_PROXY_INFRA_NAME)",
+                  "type": "EDS"
                 },
                 {
                   "connectTimeout": "10s",
diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml
index 0ce878805f..ea3dbdab50 100644
--- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml
@@ -14,7 +14,7 @@ xds:
               address: 127.0.0.1
               portValue: 19000
         clusterManager:
-          localClusterName: local_cluster
+          localClusterName: $(ENVOY_PROXY_INFRA_NAME)
         dynamicResources:
           adsConfig:
             apiType: DELTA_GRPC
@@ -61,21 +61,21 @@ xds:
             name: prometheus_stats
             type: STATIC
           - connectTimeout: 10s
-            loadAssignment:
-              clusterName: local_cluster
-              endpoints:
-              - lbEndpoints:
-                - endpoint:
-                    address:
-                      socketAddress:
-                        address: 127.0.0.1
-                        portValue: 10080
-                  loadBalancingWeight: 1
-                loadBalancingWeight: 1
-                locality:
-                  zone: $(ENVOY_SERVICE_ZONE)
-            name: local_cluster
-            type: STATIC
+            edsClusterConfig:
+              edsConfig:
+                ads: {}
+                resourceApiVersion: V3
+              serviceName: $(ENVOY_PROXY_INFRA_NAME)
+            loadBalancingPolicy:
+              policies:
+              - typedExtensionConfig:
+                  name: envoy.load_balancing_policies.least_request
+                  typedConfig:
+                    '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+                    localityLbConfig:
+                      localityWeightedLbConfig: {}
+            name: $(ENVOY_PROXY_INFRA_NAME)
+            type: EDS
           - connectTimeout: 10s
             loadAssignment:
               clusterName: xds_cluster
diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml
index 6dcc5612c9..4e1f7482f5 100644
--- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml
@@ -13,7 +13,7 @@ xds:
             address: 127.0.0.1
             portValue: 19000
       clusterManager:
-        localClusterName: local_cluster
+        localClusterName: $(ENVOY_PROXY_INFRA_NAME)
       dynamicResources:
         adsConfig:
           apiType: DELTA_GRPC
@@ -60,21 +60,21 @@ xds:
           name: prometheus_stats
           type: STATIC
         - connectTimeout: 10s
-          loadAssignment:
-            clusterName: local_cluster
-            endpoints:
-            - lbEndpoints:
-              - endpoint:
-                  address:
-                    socketAddress:
-                      address: 127.0.0.1
-                      portValue: 10080
-                loadBalancingWeight: 1
-              loadBalancingWeight: 1
-              locality:
-                zone: $(ENVOY_SERVICE_ZONE)
-          name: local_cluster
-          type: STATIC
+          edsClusterConfig:
+            edsConfig:
+              ads: {}
+              resourceApiVersion: V3
+            serviceName: $(ENVOY_PROXY_INFRA_NAME)
+          loadBalancingPolicy:
+            policies:
+            - typedExtensionConfig:
+                name: envoy.load_balancing_policies.least_request
+                typedConfig:
+                  '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+                  localityLbConfig:
+                    localityWeightedLbConfig: {}
+          name: $(ENVOY_PROXY_INFRA_NAME)
+          type: EDS
         - connectTimeout: 10s
           loadAssignment:
             clusterName: xds_cluster
diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json
index 1cfbb327fe..e399fba24e 100644
--- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json
+++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json
@@ -23,7 +23,7 @@
               }
             },
             "clusterManager": {
-              "localClusterName": "local_cluster"
+              "localClusterName": "$(ENVOY_PROXY_INFRA_NAME)"
             },
             "dynamicResources": {
               "adsConfig": {
@@ -104,32 +104,30 @@
                 },
                 {
                   "connectTimeout": "10s",
-                  "loadAssignment": {
-                    "clusterName": "local_cluster",
-                    "endpoints": [
+                  "edsClusterConfig": {
+                    "edsConfig": {
+                      "ads": {},
+                      "resourceApiVersion": "V3"
+                    },
+                    "serviceName": "$(ENVOY_PROXY_INFRA_NAME)"
+                  },
+                  "loadBalancingPolicy": {
+                    "policies": [
                       {
-                        "lbEndpoints": [
-                          {
-                            "endpoint": {
-                              "address": {
-                                "socketAddress": {
-                                  "address": "127.0.0.1",
-                                  "portValue": 10080
-                                }
-                              }
-                            },
-                            "loadBalancingWeight": 1
+                        "typedExtensionConfig": {
+                          "name": "envoy.load_balancing_policies.least_request",
+                          "typedConfig": {
+                            "@type": "type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest",
+                            "localityLbConfig": {
+                              "localityWeightedLbConfig": {}
+                            }
                           }
-                        ],
-                        "loadBalancingWeight": 1,
-                        "locality": {
-                          "zone": "$(ENVOY_SERVICE_ZONE)"
                         }
                       }
                     ]
                   },
-                  "name": "local_cluster",
-                  "type": "STATIC"
+                  "name": "$(ENVOY_PROXY_INFRA_NAME)",
+                  "type": "EDS"
                 },
                 {
                   "connectTimeout": "10s",
diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml
index afddaa3f01..07aeeed842 100644
--- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml
@@ -14,7 +14,7 @@ xds:
               address: 127.0.0.1
               portValue: 19000
         clusterManager:
-          localClusterName: local_cluster
+          localClusterName: $(ENVOY_PROXY_INFRA_NAME)
         dynamicResources:
           adsConfig:
             apiType: DELTA_GRPC
@@ -61,21 +61,21 @@ xds:
             name: prometheus_stats
             type: STATIC
           - connectTimeout: 10s
-            loadAssignment:
-              clusterName: local_cluster
-              endpoints:
-              - lbEndpoints:
-                - endpoint:
-                    address:
-                      socketAddress:
-                        address: 127.0.0.1
-                        portValue: 10080
-                  loadBalancingWeight: 1
-                loadBalancingWeight: 1
-                locality:
-                  zone: $(ENVOY_SERVICE_ZONE)
-            name: local_cluster
-            type: STATIC
+            edsClusterConfig:
+              edsConfig:
+                ads: {}
+                resourceApiVersion: V3
+              serviceName: $(ENVOY_PROXY_INFRA_NAME)
+            loadBalancingPolicy:
+              policies:
+              - typedExtensionConfig:
+                  name: envoy.load_balancing_policies.least_request
+                  typedConfig:
+                    '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+                    localityLbConfig:
+                      localityWeightedLbConfig: {}
+            name: $(ENVOY_PROXY_INFRA_NAME)
+            type: EDS
           - connectTimeout: 10s
             loadAssignment:
               clusterName: xds_cluster
diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml
index c7675ded8b..49ba1fa0e9 100644
--- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml
@@ -13,7 +13,7 @@ xds:
             address: 127.0.0.1
             portValue: 19000
       clusterManager:
-        localClusterName: local_cluster
+        localClusterName: $(ENVOY_PROXY_INFRA_NAME)
       dynamicResources:
         adsConfig:
           apiType: DELTA_GRPC
@@ -60,21 +60,21 @@ xds:
           name: prometheus_stats
           type: STATIC
         - connectTimeout: 10s
-          loadAssignment:
-            clusterName: local_cluster
-            endpoints:
-            - lbEndpoints:
-              - endpoint:
-                  address:
-                    socketAddress:
-                      address: 127.0.0.1
-                      portValue: 10080
-                loadBalancingWeight: 1
-              loadBalancingWeight: 1
-              locality:
-                zone: $(ENVOY_SERVICE_ZONE)
-          name: local_cluster
-          type: STATIC
+          edsClusterConfig:
+            edsConfig:
+              ads: {}
+              resourceApiVersion: V3
+            serviceName: $(ENVOY_PROXY_INFRA_NAME)
+          loadBalancingPolicy:
+            policies:
+            - typedExtensionConfig:
+                name: envoy.load_balancing_policies.least_request
+                typedConfig:
+                  '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+                  localityLbConfig:
+                    localityWeightedLbConfig: {}
+          name: $(ENVOY_PROXY_INFRA_NAME)
+          type: EDS
         - connectTimeout: 10s
           loadAssignment:
             clusterName: xds_cluster
diff --git a/internal/cmd/egctl/testdata/translate/out/no-service-cluster-ip.all.yaml b/internal/cmd/egctl/testdata/translate/out/no-service-cluster-ip.all.yaml
index 0553585ed2..c2387c7eaa 100644
--- a/internal/cmd/egctl/testdata/translate/out/no-service-cluster-ip.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/no-service-cluster-ip.all.yaml
@@ -14,7 +14,7 @@ xds:
               address: 127.0.0.1
               portValue: 19000
         clusterManager:
-          localClusterName: local_cluster
+          localClusterName: $(ENVOY_PROXY_INFRA_NAME)
         dynamicResources:
           adsConfig:
             apiType: DELTA_GRPC
@@ -61,21 +61,21 @@ xds:
             name: prometheus_stats
             type: STATIC
           - connectTimeout: 10s
-            loadAssignment:
-              clusterName: local_cluster
-              endpoints:
-              - lbEndpoints:
-                - endpoint:
-                    address:
-                      socketAddress:
-                        address: 127.0.0.1
-                        portValue: 10080
-                  loadBalancingWeight: 1
-                loadBalancingWeight: 1
-                locality:
-                  zone: $(ENVOY_SERVICE_ZONE)
-            name: local_cluster
-            type: STATIC
+            edsClusterConfig:
+              edsConfig:
+                ads: {}
+                resourceApiVersion: V3
+              serviceName: $(ENVOY_PROXY_INFRA_NAME)
+            loadBalancingPolicy:
+              policies:
+              - typedExtensionConfig:
+                  name: envoy.load_balancing_policies.least_request
+                  typedConfig:
+                    '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+                    localityLbConfig:
+                      localityWeightedLbConfig: {}
+            name: $(ENVOY_PROXY_INFRA_NAME)
+            type: EDS
           - connectTimeout: 10s
             loadAssignment:
               clusterName: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
index ac0456a5bb..c585ab5b69 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml
@@ -55,7 +55,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -130,22 +130,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
index fc28644e19..19bcd505b5 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
index 3d5881c41d..5535243e13 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
index 1933ca9aa3..e243bd45e6 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml
@@ -50,7 +50,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -78,22 +78,21 @@ spec:
           static_resources:
             clusters:
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
index 128573a4e3..22497d3b0f 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
index a89fb59d2c..0cb42d9487 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml
@@ -57,7 +57,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -132,22 +132,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
index 666edda5f5..246b7cea16 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml
@@ -63,7 +63,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -138,22 +138,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
index 23cd478887..697cdf6f25 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
index a97ebdf88d..e68b55e284 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
index 6f33966798..5438b3012f 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
index c6216d0bde..87f7d2f4c9 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml
@@ -59,7 +59,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -134,22 +134,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
index c5b11805d2..f0274df1bc 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
index 49ed190d12..0c6efe16e9 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
index 65cbf90d5f..b622ce30f1 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
index bb00f4a93c..713c6f21af 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
index a3b2c1d52b..441c0d1d48 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml
index 03c067443d..8386117fa8 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml
@@ -61,7 +61,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -136,22 +136,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
index 8b246230f1..e7cb9625a4 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -60,7 +60,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -135,22 +135,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
index 209880f4f5..1a9c1f3036 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -60,7 +60,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -135,22 +135,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
index 1f369ecad6..b862bceb72 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
@@ -59,7 +59,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -134,22 +134,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
index 0bde2ba679..a835ac8991 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -133,22 +133,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
index b271a4c17c..7fd59578de 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -82,22 +82,21 @@ spec:
           static_resources:
             clusters:
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
index 7d50c0859f..0fcba7ffc9 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -134,22 +134,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
index 0dfc8bcf8b..9d868823ae 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
@@ -59,7 +59,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -134,22 +134,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
index 6c0d5e49e7..edd57df40f 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml
@@ -61,7 +61,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -136,22 +136,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
index e053d18500..03b3a74e0b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml
@@ -58,7 +58,7 @@ spec:
                 address: ::1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -134,22 +134,21 @@ spec:
                           address: ::1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
index 205d9bc073..09a700f917 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
@@ -67,7 +67,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -142,22 +142,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
index 4498073b9c..787d84078b 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -133,22 +133,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
index ea85351567..4a383eedbe 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -133,22 +133,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
index cefb6f9590..fe00838012 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
@@ -59,7 +59,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -134,22 +134,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
index 3365e32ab7..766e61debd 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
@@ -63,7 +63,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -138,22 +138,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
index 663a9e65ce..fc6f3c7afa 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -133,22 +133,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
index b3064615f3..be1939f620 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -133,22 +133,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
index 019c45896e..3410295846 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -133,22 +133,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
index 71d9640623..120247d156 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -133,22 +133,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
index ff37beab9b..4542478771 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -133,22 +133,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
index 6ed81cd3a8..fdad7836eb 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
@@ -58,7 +58,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -133,22 +133,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
index 438c2cc425..197a53e47a 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml
@@ -61,7 +61,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -136,22 +136,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
@@ -479,7 +478,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -554,22 +553,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
diff --git a/internal/provider/kubernetes/predicates.go b/internal/provider/kubernetes/predicates.go
index 16c519744b..4b5d32d3b9 100644
--- a/internal/provider/kubernetes/predicates.go
+++ b/internal/provider/kubernetes/predicates.go
@@ -343,7 +343,7 @@ func (r *gatewayAPIReconciler) validateServiceForReconcile(obj client.Object) bo
 			r.log.Info("no Gateways found under GatewayClass", "name", gcName)
 			return false
 		}
-		return false
+		return true
 	}
 
 	nsName := utils.NamespacedName(svc)
@@ -405,10 +405,6 @@ func (r *gatewayAPIReconciler) validateBackendForReconcile(obj client.Object) bo
 		}
 	}
 
-	if r.isProxyInfraService(&nsName) {
-		return true
-	}
-
 	return false
 }
 
@@ -555,6 +551,10 @@ func (r *gatewayAPIReconciler) validateEndpointSliceForReconcile(obj client.Obje
 		}
 	}
 
+	if r.isProxyInfraService(&nsName) {
+		return true
+	}
+
 	return false
 }
 
diff --git a/internal/xds/bootstrap/bootstrap.yaml.tpl b/internal/xds/bootstrap/bootstrap.yaml.tpl
index c6956fe868..9d213634a3 100644
--- a/internal/xds/bootstrap/bootstrap.yaml.tpl
+++ b/internal/xds/bootstrap/bootstrap.yaml.tpl
@@ -9,7 +9,7 @@ admin:
       address: {{ .AdminServer.Address }}
       port_value: {{ .AdminServer.Port }}
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -172,23 +172,21 @@ static_resources:
                 port_value: {{ $sink.Port }}
   {{- end }}
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                {{- /* fake lb_endpoint to satisfy zone aware routing requirements */}}
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/merge/default.out.yaml b/internal/xds/bootstrap/testdata/merge/default.out.yaml
index 6355da0d26..818e371532 100644
--- a/internal/xds/bootstrap/testdata/merge/default.out.yaml
+++ b/internal/xds/bootstrap/testdata/merge/default.out.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       portValue: 20000
 clusterManager:
-  localClusterName: local_cluster
+  localClusterName: $(ENVOY_PROXY_INFRA_NAME)
 dynamicResources:
   adsConfig:
     apiType: DELTA_GRPC
@@ -62,21 +62,21 @@ staticResources:
     name: prometheus_stats
     type: STATIC
   - connectTimeout: 10s
-    loadAssignment:
-      clusterName: local_cluster
-      endpoints:
-      - lbEndpoints:
-        - endpoint:
-            address:
-              socketAddress:
-                address: 127.0.0.1
-                portValue: 10080
-          loadBalancingWeight: 1
-        loadBalancingWeight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    edsClusterConfig:
+      edsConfig:
+        ads: {}
+        resourceApiVersion: V3
+      serviceName: $(ENVOY_PROXY_INFRA_NAME)
+    loadBalancingPolicy:
+      policies:
+      - typedExtensionConfig:
+          name: envoy.load_balancing_policies.least_request
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+            localityLbConfig:
+              localityWeightedLbConfig: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connectTimeout: 10s
     loadAssignment:
       clusterName: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/merge/merge-user-bootstrap.out.yaml b/internal/xds/bootstrap/testdata/merge/merge-user-bootstrap.out.yaml
index 7103c7405e..2ca21b1f38 100644
--- a/internal/xds/bootstrap/testdata/merge/merge-user-bootstrap.out.yaml
+++ b/internal/xds/bootstrap/testdata/merge/merge-user-bootstrap.out.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       portValue: 8080
 clusterManager:
-  localClusterName: local_cluster
+  localClusterName: $(ENVOY_PROXY_INFRA_NAME)
 dynamicResources:
   adsConfig:
     apiType: DELTA_GRPC
@@ -56,21 +56,21 @@ staticResources:
     name: prometheus_stats
     type: STATIC
   - connectTimeout: 10s
-    loadAssignment:
-      clusterName: local_cluster
-      endpoints:
-      - lbEndpoints:
-        - endpoint:
-            address:
-              socketAddress:
-                address: 127.0.0.1
-                portValue: 10080
-          loadBalancingWeight: 1
-        loadBalancingWeight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    edsClusterConfig:
+      edsConfig:
+        ads: {}
+        resourceApiVersion: V3
+      serviceName: $(ENVOY_PROXY_INFRA_NAME)
+    loadBalancingPolicy:
+      policies:
+      - typedExtensionConfig:
+          name: envoy.load_balancing_policies.least_request
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+            localityLbConfig:
+              localityWeightedLbConfig: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connectTimeout: 10s
     loadAssignment:
       clusterName: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/merge/patch-global-config.out.yaml b/internal/xds/bootstrap/testdata/merge/patch-global-config.out.yaml
index 95b6513157..1405f5af97 100644
--- a/internal/xds/bootstrap/testdata/merge/patch-global-config.out.yaml
+++ b/internal/xds/bootstrap/testdata/merge/patch-global-config.out.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 dynamic_resources:
   ads_config:
     api_type: DELTA_GRPC
@@ -58,22 +58,21 @@ static_resources:
     name: prometheus_stats
     type: STATIC
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: V3
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+      - typed_extension_config:
+          name: envoy.load_balancing_policies.least_request
+          typed_config:
+            '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+            locality_lb_config:
+              locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/merge/stats_sinks.out.yaml b/internal/xds/bootstrap/testdata/merge/stats_sinks.out.yaml
index c9ab73ed73..258e050ad9 100644
--- a/internal/xds/bootstrap/testdata/merge/stats_sinks.out.yaml
+++ b/internal/xds/bootstrap/testdata/merge/stats_sinks.out.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       portValue: 19000
 clusterManager:
-  localClusterName: local_cluster
+  localClusterName: $(ENVOY_PROXY_INFRA_NAME)
 dynamicResources:
   adsConfig:
     apiType: DELTA_GRPC
@@ -56,21 +56,21 @@ staticResources:
     name: prometheus_stats
     type: STATIC
   - connectTimeout: 10s
-    loadAssignment:
-      clusterName: local_cluster
-      endpoints:
-      - lbEndpoints:
-        - endpoint:
-            address:
-              socketAddress:
-                address: 127.0.0.1
-                portValue: 10080
-          loadBalancingWeight: 1
-        loadBalancingWeight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    edsClusterConfig:
+      edsConfig:
+        ads: {}
+        resourceApiVersion: V3
+      serviceName: $(ENVOY_PROXY_INFRA_NAME)
+    loadBalancingPolicy:
+      policies:
+      - typedExtensionConfig:
+          name: envoy.load_balancing_policies.least_request
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+            localityLbConfig:
+              localityWeightedLbConfig: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connectTimeout: 10s
     loadAssignment:
       clusterName: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/custom-server-port.yaml b/internal/xds/bootstrap/testdata/render/custom-server-port.yaml
index 94586a1f0a..ad9489a88b 100644
--- a/internal/xds/bootstrap/testdata/render/custom-server-port.yaml
+++ b/internal/xds/bootstrap/testdata/render/custom-server-port.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 2222
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -84,22 +84,21 @@ static_resources:
                 address: 127.0.0.1
                 port_value: 2222
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml b/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml
index a0cef5eb66..b87b276705 100644
--- a/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml
+++ b/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -95,22 +95,21 @@ static_resources:
                 address: 127.0.0.1
                 port_value: 19000
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml b/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml
index 00f493acc1..33304209b5 100644
--- a/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml
+++ b/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -37,22 +37,21 @@ dynamic_resources:
 static_resources:
   clusters:
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml
index 936b6b5204..b60f4548de 100644
--- a/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml
+++ b/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -100,22 +100,21 @@ static_resources:
                 address: 127.0.0.1
                 port_value: 19000
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml
index b4e898497e..06787f5cc3 100644
--- a/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml
+++ b/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -100,22 +100,21 @@ static_resources:
                 address: 127.0.0.1
                 port_value: 19000
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml
index a974728e63..06a18712b3 100644
--- a/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml
+++ b/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -84,22 +84,21 @@ static_resources:
                 address: 127.0.0.1
                 port_value: 19000
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/ipv6.yaml b/internal/xds/bootstrap/testdata/render/ipv6.yaml
index ce56cc6abd..8dd2ffb091 100644
--- a/internal/xds/bootstrap/testdata/render/ipv6.yaml
+++ b/internal/xds/bootstrap/testdata/render/ipv6.yaml
@@ -9,7 +9,7 @@ admin:
       address: ::1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -85,22 +85,21 @@ static_resources:
                 address: ::1
                 port_value: 19000
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml
index b3b2f9b534..9adb33e334 100644
--- a/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml
+++ b/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -62,22 +62,21 @@ static_resources:
                 address: otel-collector.monitoring.svc
                 port_value: 4317
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics.yaml
index b3b2f9b534..9adb33e334 100644
--- a/internal/xds/bootstrap/testdata/render/otel-metrics.yaml
+++ b/internal/xds/bootstrap/testdata/render/otel-metrics.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -62,22 +62,21 @@ static_resources:
                 address: otel-collector.monitoring.svc
                 port_value: 4317
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster
diff --git a/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml b/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml
index 33b2a460c2..e4214a060f 100644
--- a/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml
+++ b/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml
@@ -9,7 +9,7 @@ admin:
       address: 127.0.0.1
       port_value: 19000
 cluster_manager:
-  local_cluster_name: local_cluster
+  local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
 node:
   locality:
     zone: $(ENVOY_SERVICE_ZONE)
@@ -84,22 +84,21 @@ static_resources:
                 address: 127.0.0.1
                 port_value: 19000
   - connect_timeout: 10s
-    lb_policy: ROUND_ROBIN
-    load_assignment:
-      cluster_name: local_cluster
-      endpoints:
-      - lb_endpoints:
-        - endpoint:
-            address:
-              socket_address:
-                address: 127.0.0.1
-                port_value: 10080
-          load_balancing_weight: 1
-        load_balancing_weight: 1
-        locality:
-          zone: $(ENVOY_SERVICE_ZONE)
-    name: local_cluster
-    type: STATIC
+    eds_cluster_config:
+      eds_config:
+        ads: {}
+        resource_api_version: 'V3'
+      service_name: $(ENVOY_PROXY_INFRA_NAME)
+    load_balancing_policy:
+      policies:
+        - typed_extension_config:
+            name: 'envoy.load_balancing_policies.least_request'
+            typed_config:
+              '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+              locality_lb_config:
+                locality_weighted_lb_config: {}
+    name: $(ENVOY_PROXY_INFRA_NAME)
+    type: EDS
   - connect_timeout: 10s
     load_assignment:
       cluster_name: xds_cluster

From 42d67b06e89c57ea178fd62acf89452266ac43a9 Mon Sep 17 00:00:00 2001
From: Jukie <10012479+Jukie@users.noreply.github.com>
Date: Tue, 8 Jul 2025 01:01:20 -0600
Subject: [PATCH 5/6] Use zone aware lb for proxy infra cluster

Signed-off-by: Jukie <10012479+Jukie@users.noreply.github.com>
---
 internal/gatewayapi/proxyinfracluster.go               |  4 ++--
 .../gatewayapi/testdata/accesslog-als-backend.out.yaml |  2 ++
 internal/gatewayapi/testdata/accesslog.out.yaml        |  2 ++
 .../testdata/backend-invalid-feature-disabled.out.yaml |  2 ++
 .../testdata/backend-with-endpoint-zones.out.yaml      |  2 ++
 .../gatewayapi/testdata/backend-with-fallback.out.yaml |  2 ++
 .../testdata/backend-with-skip-tls-verify.out.yaml     |  2 ++
 .../testdata/backendtlspolicy-across-ns.out.yaml       |  2 ++
 .../testdata/backendtlspolicy-ca-only-secret.out.yaml  |  2 ++
 .../testdata/backendtlspolicy-ca-only.out.yaml         |  2 ++
 .../backendtlspolicy-default-ns-targetrefs.out.yaml    |  4 ++++
 .../testdata/backendtlspolicy-default-ns.out.yaml      |  2 ++
 .../testdata/backendtlspolicy-invalid-ca.out.yaml      |  2 ++
 .../backendtlspolicy-multiple-targets.out.yaml         |  2 ++
 .../backendtlspolicy-serviceimport-target.out.yaml     |  2 ++
 .../testdata/backendtlspolicy-subjectaltnames.out.yaml |  2 ++
 .../backendtlspolicy-system-truststore.out.yaml        |  2 ++
 ...fficpolicy-buffer-limit-out-of-range-error.out.yaml |  4 ++++
 ...fficpolicy-buffer-limit-with-invalid-value.out.yaml |  4 ++++
 .../backendtrafficpolicy-buffer-limit.out.yaml         |  4 ++++
 .../testdata/backendtrafficpolicy-compression.out.yaml |  2 ++
 .../backendtrafficpolicy-connect-proxy.out.yaml        |  2 ++
 .../backendtrafficpolicy-connect-terminate.out.yaml    |  2 ++
 .../backendtrafficpolicy-dns-lookup-family.out.yaml    |  2 ++
 .../backendtrafficpolicy-http-upgrade-spdy.out.yaml    |  2 ++
 ...ackendtrafficpolicy-http-upgrade-websocket.out.yaml |  2 ++
 .../backendtrafficpolicy-override-replace.out.yaml     |  2 ++
 .../backendtrafficpolicy-request-buffer.out.yaml       |  4 ++++
 .../backendtrafficpolicy-status-conditions.out.yaml    |  6 ++++++
 ...ackendtrafficpolicy-status-fault-injection.out.yaml |  4 ++++
 ...ficpolicy-strategic-merge-global-ratelimit.out.yaml |  4 ++++
 ...fficpolicy-strategic-merge-local-ratelimit.out.yaml |  4 ++++
 ...ndtrafficpolicy-strategic-merge-only-gw-rl.out.yaml |  4 ++++
 ...icpolicy-strategic-merge-only-httproute-rl.out.yaml |  4 ++++
 ...cpolicy-strategic-merge-with-multi-parents.out.yaml |  4 ++++
 .../backendtrafficpolicy-strategic-merge.out.yaml      |  2 ++
 .../testdata/backendtrafficpolicy-tracing.out.yaml     |  2 ++
 .../backendtrafficpolicy-use-client-protocol.out.yaml  |  2 ++
 ...ndtrafficpolicy-with-circuitbreakers-error.out.yaml |  4 ++++
 .../backendtrafficpolicy-with-circuitbreakers.out.yaml |  4 ++++
 .../backendtrafficpolicy-with-dns-settings.out.yaml    |  4 ++++
 .../backendtrafficpolicy-with-healthcheck.out.yaml     |  4 ++++
 .../testdata/backendtrafficpolicy-with-http2.out.yaml  |  4 ++++
 ...ackendtrafficpolicy-with-httproute-timeout.out.yaml |  2 ++
 ...alancer-invalid-consistent-hash-table-size.out.yaml |  2 ++
 .../backendtrafficpolicy-with-loadbalancer.out.yaml    |  4 ++++
 ...-local-ratelimit-default-route-level-limit.out.yaml |  2 ++
 ...y-with-local-ratelimit-distinct-match-type.out.yaml |  2 ++
 ...cy-with-local-ratelimit-invalid-limit-unit.out.yaml |  2 ++
 ...elimit-invalid-multiple-route-level-limits.out.yaml |  2 ++
 .../backendtrafficpolicy-with-local-ratelimit.out.yaml |  2 ++
 .../backendtrafficpolicy-with-panic-threshold.out.yaml |  4 ++++
 .../backendtrafficpolicy-with-proxyprotocol.out.yaml   |  4 ++++
 ...icy-with-ratelimit-invalid-distinct-invert.out.yaml |  2 ++
 ...trafficpolicy-with-ratelimit-invalid-regex.out.yaml |  2 ++
 .../backendtrafficpolicy-with-ratelimit.out.yaml       |  4 ++++
 ...cy-with-response-override-invalid-valueref.out.yaml |  4 ++++
 ...ackendtrafficpolicy-with-response-override.out.yaml |  4 ++++
 .../backendtrafficpolicy-with-retries.out.yaml         |  4 ++++
 ...dtrafficpolicy-with-same-prefix-httproutes.out.yaml |  2 ++
 ...backendtrafficpolicy-with-shared-ratelimit.out.yaml |  4 ++++
 ...cy-with-tcp-udp-listeners-apply-on-gateway.out.yaml |  2 ++
 ...licy-with-tcp-udp-listeners-apply-on-route.out.yaml |  2 ++
 .../backendtrafficpolicy-with-tcpkeepalive.out.yaml    |  4 ++++
 .../backendtrafficpolicy-with-timeout-error.out.yaml   |  2 ++
 ...ckendtrafficpolicy-with-timeout-targetrefs.out.yaml |  4 ++++
 .../backendtrafficpolicy-with-timeout.out.yaml         |  4 ++++
 ...afficpolicy-buffer-limit-with-format-error.out.yaml |  2 ++
 ...olicy-buffer-limit-with-out-of-range-error.out.yaml |  2 ++
 .../testdata/clienttrafficpolicy-buffer-limit.out.yaml |  2 ++
 .../clienttrafficpolicy-client-ip-detection.out.yaml   |  2 ++
 ...clienttrafficpolicy-connection-limit-error.out.yaml |  2 ++
 .../clienttrafficpolicy-connection-limit.out.yaml      |  2 ++
 .../clienttrafficpolicy-for-tcp-listeners.out.yaml     |  2 ++
 .../clienttrafficpolicy-headers-error.out.yaml         |  2 ++
 .../testdata/clienttrafficpolicy-headers.out.yaml      |  2 ++
 .../clienttrafficpolicy-http-health-check.out.yaml     |  2 ++
 .../testdata/clienttrafficpolicy-http10.out.yaml       |  2 ++
 .../testdata/clienttrafficpolicy-http2.out.yaml        |  2 ++
 .../testdata/clienttrafficpolicy-http3.out.yaml        |  2 ++
 ...lienttrafficpolicy-idle-timeout-with-error.out.yaml |  2 ++
 .../testdata/clienttrafficpolicy-idle-timeout.out.yaml |  2 ++
 .../clienttrafficpolicy-invalid-settings.out.yaml      |  2 ++
 ...ienttrafficpolicy-mtls-client-verification.out.yaml |  6 ++++++
 ...olicy-mtls-forward-client-cert-custom-data.out.yaml | 10 ++++++++++
 ...ienttrafficpolicy-mtls-forward-client-cert.out.yaml | 10 ++++++++++
 .../testdata/clienttrafficpolicy-mtls.out.yaml         |  4 ++++
 .../clienttrafficpolicy-path-settings.out.yaml         |  2 ++
 ...afficpolicy-preserve-case-multiple-targets.out.yaml |  4 ++++
 .../clienttrafficpolicy-preserve-case.out.yaml         |  2 ++
 .../clienttrafficpolicy-proxyprotocol.out.yaml         |  2 ++
 .../clienttrafficpolicy-ratelimitheaders.out.yaml      |  2 ++
 .../clienttrafficpolicy-status-conditions.out.yaml     |  8 ++++++++
 .../clienttrafficpolicy-tcp-keepalive.out.yaml         |  2 ++
 .../clienttrafficpolicy-timeout-with-error.out.yaml    |  2 ++
 .../testdata/clienttrafficpolicy-timeout.out.yaml      |  2 ++
 .../testdata/clienttrafficpolicy-tls-settings.out.yaml |  6 ++++++
 .../testdata/clienttrafficpolicy-trailers.out.yaml     |  2 ++
 .../gatewayapi/testdata/conflicting-policies.out.yaml  |  2 ++
 .../gatewayapi/testdata/custom-filter-order.out.yaml   |  2 ++
 .../gatewayapi/testdata/disable-accesslog.out.yaml     |  2 ++
 .../envoyextensionpolicy-invalid-cross-ns-ref.out.yaml |  2 ++
 .../envoyextensionpolicy-override-replace.out.yaml     |  2 ++
 .../envoyextensionpolicy-status-conditions.out.yaml    |  6 ++++++
 ...licy-with-extproc-invalid-no-matching-port.out.yaml |  2 ++
 ...tensionpolicy-with-extproc-invalid-no-port.out.yaml |  2 ++
 ...cy-with-extproc-invalid-no-reference-grant.out.yaml |  2 ++
 ...sionpolicy-with-extproc-invalid-no-service.out.yaml |  2 ++
 ...npolicy-with-extproc-with-backendtlspolicy.out.yaml |  2 ++
 ...policy-with-extproc-with-mixed-backendrefs.out.yaml |  2 ++
 ...icy-with-extproc-with-multiple-backendrefs.out.yaml |  2 ++
 ...npolicy-with-extproc-with-traffic-features.out.yaml |  2 ++
 ...olicy-with-invalid-lua-validation-disabled.out.yaml |  2 ++
 .../envoyextensionpolicy-with-invalid-lua.out.yaml     |  2 ++
 .../envoyextensionpolicy-with-lua-configmap.out.yaml   |  2 ++
 .../testdata/envoyextensionpolicy-with-lua.out.yaml    |  2 ++
 .../envoyextensionpolicy-with-wasm-env-vars.out.yaml   |  2 ++
 .../envoyextensionpolicy-with-wasm-targetrefs.out.yaml |  2 ++
 .../testdata/envoyextensionpolicy-with-wasm.out.yaml   |  2 ++
 .../testdata/envoypatchpolicy-cross-ns-target.out.yaml |  2 ++
 .../envoypatchpolicy-invalid-feature-disabled.out.yaml |  2 ++
 ...hpolicy-invalid-target-kind-merge-gateways.out.yaml |  2 ++
 .../envoypatchpolicy-invalid-target-kind.out.yaml      |  2 ++
 .../envoypatchpolicy-valid-merge-gateways.out.yaml     |  2 ++
 .../testdata/envoypatchpolicy-valid.out.yaml           |  2 ++
 .../testdata/envoyproxy-accesslog-als-json.out.yaml    |  2 ++
 .../envoyproxy-accesslog-backend-invalid.out.yaml      |  2 ++
 .../testdata/envoyproxy-accesslog-backend.out.yaml     |  2 ++
 .../envoyproxy-accesslog-cel-with-invalid.out.yaml     |  2 ++
 .../testdata/envoyproxy-accesslog-cel.out.yaml         |  2 ++
 .../envoyproxy-accesslog-file-json-no-format.out.yaml  |  2 ++
 .../testdata/envoyproxy-accesslog-file-json.out.yaml   |  2 ++
 .../testdata/envoyproxy-accesslog-types.out.yaml       |  2 ++
 .../envoyproxy-accesslog-with-bad-sinks.out.yaml       |  2 ++
 .../envoyproxy-accesslog-with-traffic.out.yaml         |  2 ++
 .../envoyproxy-accesslog-without-format.out.yaml       |  2 ++
 .../gatewayapi/testdata/envoyproxy-accesslog.out.yaml  |  2 ++
 .../envoyproxy-endpoint-routing-for-gateway.out.yaml   |  2 ++
 .../testdata/envoyproxy-endpoint-routing.out.yaml      |  2 ++
 .../envoyproxy-metric-backend-invalid.out.yaml         |  2 ++
 .../testdata/envoyproxy-metric-backend.out.yaml        |  2 ++
 .../envoyproxy-metric-enabled-backend.out.yaml         |  2 ++
 .../testdata/envoyproxy-preserve-route-order.out.yaml  |  2 ++
 .../testdata/envoyproxy-priority-backend.out.yaml      |  2 ++
 .../envoyproxy-service-routing-for-gateway.out.yaml    |  2 ++
 .../testdata/envoyproxy-service-routing.out.yaml       |  2 ++
 .../envoyproxy-tls-settings-invalid-ns.out.yaml        |  2 ++
 .../testdata/envoyproxy-tls-settings-invalid.out.yaml  |  2 ++
 .../testdata/envoyproxy-tls-settings.out.yaml          |  2 ++
 .../envoyproxy-tracing-backend-invalid.out.yaml        |  2 ++
 .../testdata/envoyproxy-tracing-backend-uds.out.yaml   |  2 ++
 .../testdata/envoyproxy-tracing-backend.out.yaml       |  2 ++
 internal/gatewayapi/testdata/envoyproxy-valid.out.yaml |  2 ++
 .../testdata/envoyproxy-with-statname.out.yaml         |  2 ++
 ...lows-same-namespace-with-allowed-httproute.out.yaml |  2 ++
 ...s-same-namespace-with-disallowed-httproute.out.yaml |  2 ++
 ...y-http-listener-with-hostname-intersection.out.yaml |  2 ++
 .../testdata/gateway-infrastructure.out.yaml           |  2 ++
 .../gateway-namespace-mode-infra-httproute.out.yaml    |  6 ++++++
 .../gateway-with-addresses-with-ipaddress.out.yaml     |  2 ++
 .../gateway-with-infrastructure-parametersref.out.yaml |  2 ++
 ...nfrastructure-parametersref-does-not-exist.out.yaml |  2 ++
 ...alid-infrastructure-parametersref-fallback.out.yaml |  2 ++
 ...r-with-invalid-allowed-namespaces-selector.out.yaml |  2 ++
 ...listener-with-invalid-allowed-routes-group.out.yaml |  2 ++
 ...-invalid-allowed-routes-kind-and-supported.out.yaml |  2 ++
 ...-listener-with-invalid-allowed-routes-kind.out.yaml |  2 ++
 ...stener-with-invalid-allowed-tls-route-kind.out.yaml |  2 ++
 ...er-with-invalid-multiple-tls-configuration.out.yaml |  2 ++
 ...ith-invalid-tls-configuration-invalid-mode.out.yaml |  2 ++
 ...alid-tls-configuration-no-certificate-refs.out.yaml |  2 ++
 ...onfiguration-no-valid-certificate-for-fqdn.out.yaml |  2 ++
 ...id-tls-configuration-secret-does-not-exist.out.yaml |  2 ++
 ...ls-configuration-secret-in-other-namespace.out.yaml |  2 ++
 ...alid-tls-configuration-secret-is-not-valid.out.yaml |  2 ++
 ...r-with-missing-allowed-namespaces-selector.out.yaml |  2 ++
 ...teway-with-listener-with-tcp-with-hostname.out.yaml |  2 ++
 ...-with-tcproute-with-mismatch-port-protocol.out.yaml |  2 ++
 ...tener-with-tcproute-with-multiple-backends.out.yaml |  2 ++
 ...listener-with-tcproute-with-multiple-rules.out.yaml |  2 ++
 ...ret-in-other-namespace-allowed-by-refgrant.out.yaml |  2 ++
 ...istener-with-tls-terminate-and-passthrough.out.yaml |  2 ++
 ...teway-with-listener-with-udp-with-hostname.out.yaml |  2 ++
 ...-with-udproute-with-mismatch-port-protocol.out.yaml |  2 ++
 ...tener-with-udproute-with-multiple-backends.out.yaml |  2 ++
 ...listener-with-udproute-with-multiple-rules.out.yaml |  2 ++
 ...eway-with-listener-with-unmatched-tcproute.out.yaml |  2 ++
 ...eway-with-listener-with-unmatched-udproute.out.yaml |  2 ++
 ...ay-with-listener-with-unsupported-protocol.out.yaml |  2 ++
 ...uration-with-same-algorithm-different-fqdn.out.yaml |  2 ++
 ...ener-with-valid-multiple-tls-configuration.out.yaml |  2 ++
 ...with-listener-with-valid-tls-configuration.out.yaml |  2 ++
 ...ple-https-listeners-with-overlapping-certs.out.yaml |  2 ++
 ...apping-hostnames-and-certs-merged-gateways.out.yaml |  2 ++
 ...eners-with-overlapping-hostnames-and-certs.out.yaml |  2 ++
 ...with-overlapping-hostnames-merged-gateways.out.yaml |  2 ++
 ...https-listeners-with-overlapping-hostnames.out.yaml |  2 ++
 .../gateway-with-preexisting-status-condition.out.yaml |  2 ++
 ...th-single-listener-with-multiple-tcproutes.out.yaml |  2 ++
 ...th-single-listener-with-multiple-udproutes.out.yaml |  2 ++
 .../gateway-with-stale-status-condition.out.yaml       |  2 ++
 ...with-two-listeners-on-same-tcp-or-tls-port.out.yaml |  2 ++
 ...ateway-with-two-listeners-on-same-udp-port.out.yaml |  2 ++
 ...h-http-and-tlsroute-same-hostname-and-port.out.yaml |  2 ++
 ...ith-two-listeners-with-multiple-httproutes.out.yaml |  2 ++
 ...-two-listeners-with-same-port-and-hostname.out.yaml |  2 ++
 ...s-with-same-port-and-incompatible-protocol.out.yaml |  2 ++
 ...listeners-with-same-port-http-tcp-protocol.out.yaml |  2 ++
 ...listeners-with-same-port-http-udp-protocol.out.yaml |  2 ++
 ...-listeners-with-tcproutes-with-sectionname.out.yaml |  2 ++
 ...steners-with-tcproutes-without-sectionname.out.yaml |  2 ++
 ...-listeners-with-udproutes-with-sectionname.out.yaml |  2 ++
 ...steners-with-udproutes-without-sectionname.out.yaml |  2 ++
 .../testdata/grpcroute-with-backend.out.yaml           |  2 ++
 .../testdata/grpcroute-with-empty-backends.out.yaml    |  2 ++
 .../testdata/grpcroute-with-header-match.out.yaml      |  2 ++
 .../grpcroute-with-method-and-service-match.out.yaml   |  2 ++
 .../testdata/grpcroute-with-method-match.out.yaml      |  2 ++
 .../grpcroute-with-request-header-modifier.out.yaml    |  2 ++
 .../testdata/grpcroute-with-service-match.out.yaml     |  2 ++
 ...nd-backendtrafficpolicy-with-timeout-error.out.yaml |  2 ++
 ...oute-and-backendtrafficpolicy-with-timeout.out.yaml |  4 ++++
 ...g-to-gateway-with-more-different-listeners.out.yaml |  2 ++
 ...e-attaching-to-gateway-with-more-listeners.out.yaml |  2 ++
 ...ay-with-two-listeners-with-different-ports.out.yaml |  2 ++
 ...te-attaching-to-gateway-with-two-listeners.out.yaml |  2 ++
 .../testdata/httproute-attaching-to-gateway.out.yaml   |  2 ++
 ...proute-attaching-to-listener-matching-port.out.yaml |  2 ++
 ...-to-listener-on-gateway-with-two-listeners.out.yaml |  2 ++
 ...listener-with-backend-and-core-backendrefs.out.yaml |  2 ++
 ...with-backend-backendref-mixed-address-type.out.yaml |  2 ++
 ...aching-to-listener-with-backend-backendref.out.yaml |  2 ++
 ...iple-backend-backendrefs-diff-address-type.out.yaml |  2 ++
 ...iple-backend-backendrefs-same-address-type.out.yaml |  2 ++
 ...erviceimport-backendrefs-diff-address-type.out.yaml |  2 ++
 ...erviceimport-backendrefs-same-address-type.out.yaml |  2 ++
 ...serviceimport-backendref-fqdn-address-type.out.yaml |  2 ++
 ...erviceimport-backendref-mixed-address-type.out.yaml |  2 ++
 ...-to-listener-with-serviceimport-backendref.out.yaml |  2 ++
 .../testdata/httproute-attaching-to-listener.out.yaml  |  2 ++
 .../httproute-backend-request-timeout.out.yaml         |  2 ++
 ...te-dynamic-resolver-with-mutliple-backends.out.yaml |  2 ++
 .../testdata/httproute-dynamic-resolver.out.yaml       |  2 ++
 ...ot-attaching-to-listener-non-matching-port.out.yaml |  2 ++
 .../testdata/httproute-request-timeout.out.yaml        |  2 ++
 internal/gatewayapi/testdata/httproute-retry.out.yaml  |  4 ++++
 ...te-rule-with-empty-backends-and-no-filters.out.yaml |  2 ++
 ...rule-with-multiple-backends-and-no-weights.out.yaml |  2 ++
 ...te-rule-with-multiple-backends-and-weights.out.yaml |  2 ++
 ...ith-non-service-backends-and-app-protocols.out.yaml |  2 ++
 ...rule-with-non-service-backends-and-weights.out.yaml |  2 ++
 ...route-with-api-key-auth-duplicated-api-key.out.yaml |  2 ++
 ...route-with-backendref-add-multiple-filters.out.yaml |  2 ++
 ...ref-in-other-namespace-allowed-by-refgrant.out.yaml |  2 ++
 ...ort-in-other-namespace-allowed-by-refgrant.out.yaml |  2 ++
 .../testdata/httproute-with-cors-filter.out.yaml       |  2 ++
 .../httproute-with-credential-injection.out.yaml       |  2 ++
 .../testdata/httproute-with-direct-response.out.yaml   |  2 ++
 .../testdata/httproute-with-empty-matches.out.yaml     |  2 ++
 .../httproute-with-enable-zone-discovery.out.yaml      |  2 ++
 ...ader-filter-duplicate-add-multiple-filters.out.yaml |  2 ++
 ...ttproute-with-header-filter-duplicate-adds.out.yaml |  2 ++
 ...r-filter-duplicate-remove-multiple-filters.out.yaml |  2 ++
 ...route-with-header-filter-duplicate-removes.out.yaml |  2 ++
 ...ute-with-header-filter-empty-header-values.out.yaml |  2 ++
 ...httproute-with-header-filter-empty-headers.out.yaml |  2 ++
 ...e-with-header-filter-invalid-header-values.out.yaml |  2 ++
 ...tproute-with-header-filter-invalid-headers.out.yaml |  2 ++
 .../httproute-with-header-filter-no-headers.out.yaml   |  2 ++
 ...proute-with-header-filter-no-valid-headers.out.yaml |  2 ++
 .../httproute-with-header-filter-remove.out.yaml       |  2 ++
 .../httproute-with-header-match-diff-number.out.yaml   |  2 ++
 .../httproute-with-header-match-diff-type.out.yaml     |  2 ++
 ...ute-with-headless-service-endpoint-routing.out.yaml |  2 ++
 ...oute-with-headless-service-service-routing.out.yaml |  2 ++
 ...ttproute-with-invalid-backend-ref-bad-port.out.yaml |  2 ++
 ...ute-with-invalid-backend-ref-invalid-group.out.yaml |  2 ++
 ...oute-with-invalid-backend-ref-invalid-kind.out.yaml |  2 ++
 ...ith-invalid-backend-ref-invalid-mixed-kind.out.yaml |  2 ++
 ...httproute-with-invalid-backend-ref-no-port.out.yaml |  2 ++
 ...with-invalid-backend-ref-no-service.import.out.yaml |  2 ++
 ...proute-with-invalid-backend-ref-no-service.out.yaml |  2 ++
 ...ith-invalid-backend-ref-unsupported-filter.out.yaml |  2 ++
 ...with-invalid-backendref-in-other-namespace.out.yaml |  2 ++
 .../testdata/httproute-with-invalid-regex.out.yaml     |  4 ++++
 .../testdata/httproute-with-metadata.out.yaml          |  2 ++
 .../httproute-with-mirror-filter-duplicates.out.yaml   |  2 ++
 .../httproute-with-mirror-filter-multiple.out.yaml     |  2 ++
 ...te-with-mirror-filter-percentage-mirroring.out.yaml |  2 ++
 ...tproute-with-mirror-filter-service-no-port.out.yaml |  2 ++
 ...route-with-mirror-filter-service-not-found.out.yaml |  2 ++
 .../testdata/httproute-with-mirror-filter.out.yaml     |  2 ++
 .../httproute-with-multi-gateways-notmatch.out.yaml    |  4 ++++
 ...tproute-with-multi-gateways-with-same-name.out.yaml |  4 ++++
 ...e-with-multiple-gateways-from-different-ns.out.yaml |  4 ++++
 ...proute-with-multiple-gateways-from-same-ns.out.yaml |  4 ++++
 .../httproute-with-multiple-invalid-rules.out.yaml     |  2 ++
 ...ttaching-to-gateway-with-wildcard-hostname.out.yaml |  2 ++
 .../httproute-with-query-match-diff-number.out.yaml    |  2 ++
 .../httproute-with-query-match-diff-type.out.yaml      |  2 ++
 ...th-redirect-filter-full-path-replace-https.out.yaml |  2 ++
 .../httproute-with-redirect-filter-hostname.out.yaml   |  2 ++
 ...e-with-redirect-filter-invalid-filter-type.out.yaml |  2 ++
 ...proute-with-redirect-filter-invalid-scheme.out.yaml |  2 ++
 ...proute-with-redirect-filter-invalid-status.out.yaml |  2 ++
 ...irect-filter-prefix-replace-with-port-http.out.yaml |  2 ++
 ...httproute-with-response-header-filter-adds.out.yaml |  2 ++
 ...ader-filter-duplicate-add-multiple-filters.out.yaml |  2 ++
 ...with-response-header-filter-duplicate-adds.out.yaml |  2 ++
 ...r-filter-duplicate-remove-multiple-filters.out.yaml |  2 ++
 ...h-response-header-filter-duplicate-removes.out.yaml |  2 ++
 ...response-header-filter-empty-header-values.out.yaml |  2 ++
 ...-with-response-header-filter-empty-headers.out.yaml |  2 ++
 ...sponse-header-filter-invalid-header-values.out.yaml |  2 ++
 ...ith-response-header-filter-invalid-headers.out.yaml |  2 ++
 ...ute-with-response-header-filter-no-headers.out.yaml |  2 ++
 ...th-response-header-filter-no-valid-headers.out.yaml |  2 ++
 ...tproute-with-response-header-filter-remove.out.yaml |  2 ++
 ...ute-with-single-rule-with-exact-path-match.out.yaml |  2 ++
 ...te-with-single-rule-with-http-method-match.out.yaml |  2 ++
 ...route-with-single-rule-with-multiple-rules.out.yaml |  2 ++
 ...-with-path-prefix-and-exact-header-matches.out.yaml |  2 ++
 ...-with-some-invalid-backend-refs-no-service.out.yaml |  2 ++
 ...ttaching-to-gateway-with-wildcard-hostname.out.yaml |  2 ++
 ...ttaching-to-gateway-with-wildcard-hostname.out.yaml |  2 ++
 ...h-urlrewrite-filter-full-path-replace-http.out.yaml |  2 ++
 ...-urlrewrite-filter-hostname-prefix-replace.out.yaml |  2 ++
 .../httproute-with-urlrewrite-filter-hostname.out.yaml |  2 ++
 ...with-urlrewrite-filter-invalid-filter-type.out.yaml |  2 ++
 ...te-with-urlrewrite-filter-invalid-hostname.out.yaml |  2 ++
 ...urlrewrite-filter-invalid-multiple-filters.out.yaml |  2 ++
 ...e-with-urlrewrite-filter-invalid-path-type.out.yaml |  2 ++
 ...proute-with-urlrewrite-filter-invalid-path.out.yaml |  2 ++
 ...proute-with-urlrewrite-filter-missing-path.out.yaml |  2 ++
 ...with-urlrewrite-filter-prefix-replace-http.out.yaml |  2 ++
 ...urlrewrite-filter-regex-match-replace-http.out.yaml |  2 ++
 ...rewrite-filter-regex-match-replace-invalid.out.yaml |  2 ++
 ...te-with-urlrewrite-hostname-filter-invalid.out.yaml |  2 ++
 .../httproute-with-urlrewrite-hostname-filter.out.yaml |  2 ++
 ...e-attaching-to-gateway-with-unset-hostname.out.yaml |  2 ++
 .../testdata/httproutes-with-multiple-matches.out.yaml |  2 ++
 .../testdata/merge-invalid-multiple-gateways.out.yaml  |  2 ++
 ...ple-gateways-multiple-listeners-same-ports.out.yaml |  2 ++
 ...ge-valid-multiple-gateways-multiple-routes.out.yaml |  2 ++
 .../testdata/merge-valid-multiple-gateways.out.yaml    |  2 ++
 .../testdata/merge-with-isolated-policies-2.out.yaml   |  2 ++
 .../testdata/merge-with-isolated-policies.out.yaml     |  2 ++
 .../securitypolicy-invalid-cross-ns-ref.out.yaml       |  2 ++
 ...itypolicy-invalid-no-section-name-listener.out.yaml |  2 ++
 .../testdata/securitypolicy-override-replace.out.yaml  |  2 ++
 .../testdata/securitypolicy-status-conditions.out.yaml |  4 ++++
 ...curitypolicy-with-authoriztion-client-cidr.out.yaml |  2 ++
 ...licy-with-authoriztion-headers-and-methods.out.yaml |  2 ++
 ...securitypolicy-with-authoriztion-jwt-claim.out.yaml |  2 ++
 .../testdata/securitypolicy-with-basic-auth.out.yaml   |  2 ++
 .../securitypolicy-with-cors-targetrefs.out.yaml       |  6 ++++++
 .../testdata/securitypolicy-with-cors.out.yaml         |  6 ++++++
 .../securitypolicy-with-extauth-backend.out.yaml       |  2 ++
 .../securitypolicy-with-extauth-backendref.out.yaml    |  2 ++
 .../testdata/securitypolicy-with-extauth-body.out.yaml |  2 ++
 ...licy-with-extauth-invalid-no-matching-port.out.yaml |  2 ++
 ...ecuritypolicy-with-extauth-invalid-no-port.out.yaml |  2 ++
 ...cy-with-extauth-invalid-no-reference-grant.out.yaml |  2 ++
 ...ritypolicy-with-extauth-invalid-no-service.out.yaml |  2 ++
 .../securitypolicy-with-extauth-recomputation.out.yaml |  2 ++
 ...ypolicy-with-extauth-with-backendtlspolicy.out.yaml |  2 ++
 .../testdata/securitypolicy-with-extauth.out.yaml      |  2 ++
 .../securitypolicy-with-jwt-and-invalid-oidc.out.yaml  |  2 ++
 .../securitypolicy-with-jwt-backendcluster.out.yaml    |  2 ++
 .../securitypolicy-with-jwt-local-jwks.out.yaml        |  2 ++
 .../testdata/securitypolicy-with-jwt-optional.out.yaml |  4 ++++
 ...uritypolicy-with-jwt-with-custom-extractor.out.yaml |  4 ++++
 .../testdata/securitypolicy-with-jwt.out.yaml          |  4 ++++
 ...curitypolicy-with-oidc-and-jwt-passthrough.out.yaml |  2 ++
 .../securitypolicy-with-oidc-backendcluster.out.yaml   |  2 ++
 ...typolicy-with-oidc-custom-cookies-samesite.out.yaml |  2 ++
 .../securitypolicy-with-oidc-custom-cookies.out.yaml   |  2 ++
 .../securitypolicy-with-oidc-deny-redirect.out.yaml    |  2 ++
 .../securitypolicy-with-oidc-invalid-issuer.out.yaml   |  2 ++
 ...securitypolicy-with-oidc-invalid-secretref.out.yaml |  6 ++++++
 .../testdata/securitypolicy-with-oidc.out.yaml         |  2 ++
 ...ing-to-gateway-with-listener-tls-terminate.out.yaml |  2 ++
 ...le-with-multiple-backends-and-zero-weights.out.yaml |  2 ++
 .../gatewayapi/testdata/tcproute-with-backend.out.yaml |  2 ++
 .../testdata/tlsroute-attaching-to-gateway.out.yaml    |  2 ++
 .../testdata/tlsroute-invalid-reference-grant.out.yaml |  2 ++
 .../gatewayapi/testdata/tlsroute-multiple.out.yaml     |  2 ++
 ...oute-not-attaching-to-gateway-with-no-mode.out.yaml |  2 ++
 .../gatewayapi/testdata/tlsroute-with-backend.out.yaml |  2 ++
 ...ref-in-other-namespace-allowed-by-refgrant.out.yaml |  2 ++
 .../testdata/tlsroute-with-empty-hostname.out.yaml     |  2 ++
 .../tlsroute-with-empty-listener-hostname.out.yaml     |  2 ++
 ...th-listener-both-passthrough-and-cert-data.out.yaml |  2 ++
 .../testdata/tracing-merged-multiple-routes.out.yaml   |  2 ++
 .../testdata/tracing-multiple-routes.out.yaml          |  4 ++++
 .../testdata/tracing-sampling-fraction.out.yaml        |  2 ++
 ...le-with-multiple-backends-and-zero-weights.out.yaml |  2 ++
 .../gatewayapi/testdata/udproute-with-backend.out.yaml |  2 ++
 398 files changed, 932 insertions(+), 2 deletions(-)

diff --git a/internal/gatewayapi/proxyinfracluster.go b/internal/gatewayapi/proxyinfracluster.go
index 59ef829b77..dc3ba02742 100644
--- a/internal/gatewayapi/proxyinfracluster.go
+++ b/internal/gatewayapi/proxyinfracluster.go
@@ -86,7 +86,7 @@ func (t *Translator) processEnvoyServiceDestinationSetting(
 		Protocol:    ir.HTTP,
 		Endpoints:   endpoints,
 		AddressType: addrType,
-		// might need to come back to this
-		// ZoneAwareRoutingEnabled: true,
+		// Use Zone Aware Lb so locality info is injected for endpoints
+		PreferLocal: &ir.PreferLocalZone{MinEndpointsThreshold: ptr.To[uint64](1)},
 	}
 }
diff --git a/internal/gatewayapi/testdata/accesslog-als-backend.out.yaml b/internal/gatewayapi/testdata/accesslog-als-backend.out.yaml
index 233a345cf4..4472501b28 100644
--- a/internal/gatewayapi/testdata/accesslog-als-backend.out.yaml
+++ b/internal/gatewayapi/testdata/accesslog-als-backend.out.yaml
@@ -207,6 +207,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/accesslog.out.yaml b/internal/gatewayapi/testdata/accesslog.out.yaml
index 1da3bc882a..3574cae98a 100644
--- a/internal/gatewayapi/testdata/accesslog.out.yaml
+++ b/internal/gatewayapi/testdata/accesslog.out.yaml
@@ -133,6 +133,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backend-invalid-feature-disabled.out.yaml b/internal/gatewayapi/testdata/backend-invalid-feature-disabled.out.yaml
index ade109e71c..6ce044b6bb 100644
--- a/internal/gatewayapi/testdata/backend-invalid-feature-disabled.out.yaml
+++ b/internal/gatewayapi/testdata/backend-invalid-feature-disabled.out.yaml
@@ -165,6 +165,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backend-with-endpoint-zones.out.yaml b/internal/gatewayapi/testdata/backend-with-endpoint-zones.out.yaml
index 6c4ce85868..03fcfb7ef9 100644
--- a/internal/gatewayapi/testdata/backend-with-endpoint-zones.out.yaml
+++ b/internal/gatewayapi/testdata/backend-with-endpoint-zones.out.yaml
@@ -151,6 +151,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backend-with-fallback.out.yaml b/internal/gatewayapi/testdata/backend-with-fallback.out.yaml
index ff661c092f..57d6294ee0 100644
--- a/internal/gatewayapi/testdata/backend-with-fallback.out.yaml
+++ b/internal/gatewayapi/testdata/backend-with-fallback.out.yaml
@@ -150,6 +150,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backend-with-skip-tls-verify.out.yaml b/internal/gatewayapi/testdata/backend-with-skip-tls-verify.out.yaml
index b472c00883..f181831fbb 100644
--- a/internal/gatewayapi/testdata/backend-with-skip-tls-verify.out.yaml
+++ b/internal/gatewayapi/testdata/backend-with-skip-tls-verify.out.yaml
@@ -166,6 +166,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-across-ns.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-across-ns.out.yaml
index 3936a9ee47..7d250ebfeb 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-across-ns.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-across-ns.out.yaml
@@ -134,6 +134,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-ca-only-secret.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-ca-only-secret.out.yaml
index 74c29bce6a..e43531ebad 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-ca-only-secret.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-ca-only-secret.out.yaml
@@ -144,6 +144,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml
index a39ce0b8f9..9876a6ca13 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-ca-only.out.yaml
@@ -144,6 +144,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml
index 26fb343e0d..0d8e5f78ea 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml
@@ -285,6 +285,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
@@ -369,6 +371,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-btls2-41698b8b
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls2-41698b8b
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml
index 612f4d5d54..60979023c6 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-default-ns.out.yaml
@@ -239,6 +239,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
index 261e2dff38..74551e85c7 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-invalid-ca.out.yaml
@@ -145,6 +145,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-multiple-targets.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-multiple-targets.out.yaml
index 5d12bce2c2..ee3f0a137c 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-multiple-targets.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-multiple-targets.out.yaml
@@ -186,6 +186,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml
index b969769191..ab5f2ef636 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml
@@ -152,6 +152,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-subjectaltnames.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-subjectaltnames.out.yaml
index ddc3948daf..7f3c9906fa 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-subjectaltnames.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-subjectaltnames.out.yaml
@@ -149,6 +149,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml
index bcec1faf77..a5119fe937 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml
@@ -141,6 +141,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-btls-a945b5bb
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-btls-a945b5bb
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml
index fc629eab77..6ad31c31e5 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml
@@ -260,6 +260,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -331,6 +333,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml
index 4e93a0f7c1..9677e53f34 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml
@@ -260,6 +260,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -331,6 +333,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml
index eb9275aa1d..f8299b5ed7 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml
@@ -264,6 +264,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -335,6 +337,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-compression.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-compression.out.yaml
index 7c939bb7e8..2b014477a1 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-compression.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-compression.out.yaml
@@ -142,6 +142,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-connect-proxy.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-connect-proxy.out.yaml
index 01ec77b222..09b453815f 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-connect-proxy.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-connect-proxy.out.yaml
@@ -141,6 +141,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-connect-terminate.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-connect-terminate.out.yaml
index 44e6201dca..25f2ffb7c7 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-connect-terminate.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-connect-terminate.out.yaml
@@ -143,6 +143,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
index 7d2fd94068..e3e6db9fe7 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
@@ -387,6 +387,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-spdy.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-spdy.out.yaml
index 286b465497..cd89ff9e7e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-spdy.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-spdy.out.yaml
@@ -141,6 +141,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-websocket.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-websocket.out.yaml
index 2fb37903b5..a710d420f6 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-websocket.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-http-upgrade-websocket.out.yaml
@@ -142,6 +142,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-override-replace.out.yaml
index e82fd54c69..b80b8e39c1 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-override-replace.out.yaml
@@ -284,6 +284,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml
index 16a111b7f9..d7e29c9700 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml
@@ -260,6 +260,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -331,6 +333,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
index 3b7adbe71b..deb80cd082 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
@@ -547,6 +547,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-another-namespace-not-same-namespace-gateway-8778384d
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-another-namespace-not-same-namespace-gateway-8778384d
     http:
@@ -577,6 +579,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -639,6 +643,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
index 2be9bac303..a6fad1300f 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
@@ -340,6 +340,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -412,6 +414,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml
index 48548290b0..1b963ad291 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml
@@ -314,6 +314,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -419,6 +421,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml
index bae38f9222..5f31ee71e0 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml
@@ -308,6 +308,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -410,6 +412,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml
index d96b4b3dd6..48bf7e8361 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml
@@ -309,6 +309,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -413,6 +415,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml
index 34e3bee389..d141cf020e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml
@@ -309,6 +309,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -417,6 +419,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml
index 3adb11bf69..ab64c1dc78 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml
@@ -284,6 +284,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -364,6 +366,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge.out.yaml
index 5728824a9a..28edff3204 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge.out.yaml
@@ -266,6 +266,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-tracing.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-tracing.out.yaml
index e1e7ad4086..507b71eacb 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-tracing.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-tracing.out.yaml
@@ -159,6 +159,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-use-client-protocol.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-use-client-protocol.out.yaml
index ca01222993..ffa3d3b52b 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-use-client-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-use-client-protocol.out.yaml
@@ -139,6 +139,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
index 5c4a0cdc6a..f5fe9a4206 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
@@ -322,6 +322,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -388,6 +390,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
index 56305cab5f..60f6c315af 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
@@ -264,6 +264,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -335,6 +337,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml
index 37508158fe..1455a3f167 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml
@@ -329,6 +329,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -401,6 +403,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
index 31cfa9270c..bd9ccc227f 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
@@ -690,6 +690,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -845,6 +847,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml
index cb980e6906..53a207eef0 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml
@@ -262,6 +262,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -332,6 +334,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-httproute-timeout.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-httproute-timeout.out.yaml
index c2062cda6f..c72733359b 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-httproute-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-httproute-timeout.out.yaml
@@ -220,6 +220,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer-invalid-consistent-hash-table-size.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer-invalid-consistent-hash-table-size.out.yaml
index 8ecd0cd277..ffe2ed92a1 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer-invalid-consistent-hash-table-size.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer-invalid-consistent-hash-table-size.out.yaml
@@ -213,6 +213,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
index f2c59c0ad0..53a410d1b6 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
@@ -432,6 +432,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -499,6 +501,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
index 8b6837b885..ad686d8a4c 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
@@ -162,6 +162,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-distinct-match-type.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-distinct-match-type.out.yaml
index a40e86348e..c0afc2310c 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-distinct-match-type.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-distinct-match-type.out.yaml
@@ -162,6 +162,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
index 499218bb65..6ff6ed9850 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
@@ -166,6 +166,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
index 2954ad1fd0..a6c72a5e73 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
@@ -169,6 +169,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
index bc2b349872..e5aef04dc8 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
@@ -165,6 +165,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml
index 9f9a8e3758..2dc5884a0d 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml
@@ -326,6 +326,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -397,6 +399,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
index 3c92b93f26..81f7375852 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
@@ -256,6 +256,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -323,6 +325,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-distinct-invert.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-distinct-invert.out.yaml
index 56bcb80457..4a8fe85486 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-distinct-invert.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-distinct-invert.out.yaml
@@ -147,6 +147,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-966d2c13
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-966d2c13
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
index 93ac090862..dc61cfb646 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
@@ -148,6 +148,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
index ba5ce4ad81..4c66de6272 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
@@ -292,6 +292,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -378,6 +380,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml
index 3bdcc0948a..48bb08d86f 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml
@@ -305,6 +305,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
@@ -371,6 +373,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-2-5e70ed84
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-2-5e70ed84
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml
index 06ed7e0075..bd96747343 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml
@@ -452,6 +452,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
@@ -540,6 +542,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-2-5e70ed84
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-2-5e70ed84
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
index 73c965204d..b393775cbe 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
@@ -414,6 +414,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -488,6 +490,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
index c938f29ad4..f0e7ca5e41 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
@@ -181,6 +181,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml
index fa1e29cdeb..e6347649a1 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml
@@ -293,6 +293,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -380,6 +382,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml
index 94e1577f95..eeb6c32ade 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml
@@ -245,6 +245,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-tcp-gateway-1ec60381
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-tcp-gateway-1ec60381
     readyListener:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml
index e408d51c0e..1ab7c9690c 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml
@@ -318,6 +318,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-tcp-gateway-1ec60381
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-tcp-gateway-1ec60381
     readyListener:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
index 166222cb6e..e0a00a2d37 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
@@ -260,6 +260,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -329,6 +331,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
index 3c60c49f90..40df412a2b 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
@@ -139,6 +139,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml
index 7c51784ebd..abce0d97e9 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml
@@ -248,6 +248,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -320,6 +322,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
index 9d21ad9684..ee037bd6a6 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
@@ -268,6 +268,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -340,6 +342,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-format-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-format-error.out.yaml
index 46177b8d7e..91dbef11e6 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-format-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-format-error.out.yaml
@@ -171,6 +171,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-out-of-range-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-out-of-range-error.out.yaml
index b0c3bc5187..2e6b806ff4 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-out-of-range-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit-with-out-of-range-error.out.yaml
@@ -172,6 +172,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit.out.yaml
index 950abc3e54..728493e867 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-buffer-limit.out.yaml
@@ -176,6 +176,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.out.yaml
index 543e7d9b4a..86f2a63a9f 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-client-ip-detection.out.yaml
@@ -274,6 +274,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.out.yaml
index e0b412648d..afa90b23e1 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.out.yaml
@@ -173,6 +173,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit.out.yaml
index 4b845e8e82..36ae480642 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit.out.yaml
@@ -173,6 +173,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-for-tcp-listeners.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-for-tcp-listeners.out.yaml
index 2fac2f3f46..6380584b59 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-for-tcp-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-for-tcp-listeners.out.yaml
@@ -196,6 +196,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml
index b19ac49d6a..e4bd2067fc 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-headers-error.out.yaml
@@ -129,6 +129,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml
index 989c5a7648..6ee0d24fdf 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-headers.out.yaml
@@ -153,6 +153,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml
index 51e4e94145..850ee12cf3 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http-health-check.out.yaml
@@ -101,6 +101,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
index 59ff2433df..bde03b8e8e 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http10.out.yaml
@@ -466,6 +466,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml
index 8a1a59ac95..89fe0df9cb 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http2.out.yaml
@@ -175,6 +175,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml
index 9bf6d2c145..1dc7ac7cf9 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml
@@ -143,6 +143,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout-with-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout-with-error.out.yaml
index 86f7ddcbe5..1d8880e939 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout-with-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout-with-error.out.yaml
@@ -102,6 +102,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-966d2c13
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-966d2c13
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout.out.yaml
index 5c5456d9f4..48764767ee 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-idle-timeout.out.yaml
@@ -140,6 +140,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-966d2c13
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-966d2c13
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml
index a2221cc050..6a1abc21fe 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml
@@ -398,6 +398,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml
index 254cd9713f..deb3d17cf0 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml
@@ -490,6 +490,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -546,6 +548,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
@@ -598,6 +602,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml
index fa6bfdd444..1c82c46a0d 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml
@@ -567,6 +567,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -631,6 +633,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
@@ -677,6 +681,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
@@ -725,6 +731,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-4-a293650b
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-4-a293650b
     http:
@@ -792,6 +800,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-5-e35ee57f
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-5-e35ee57f
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml
index 30bf1cdb37..7462c37d4d 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml
@@ -554,6 +554,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -618,6 +620,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
@@ -664,6 +668,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
@@ -710,6 +716,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-4-a293650b
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-4-a293650b
     http:
@@ -773,6 +781,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-5-e35ee57f
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-5-e35ee57f
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml
index 6df8fd0ef2..f19ab92031 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml
@@ -242,6 +242,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -306,6 +308,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-path-settings.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-path-settings.out.yaml
index a7f3c897ce..6681165b73 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-path-settings.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-path-settings.out.yaml
@@ -138,6 +138,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml
index b5b7ee3e1e..7e6a9ad74f 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml
@@ -209,6 +209,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -250,6 +252,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case.out.yaml
index a6066e45f3..c00a4c8fc2 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case.out.yaml
@@ -138,6 +138,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol.out.yaml
index 3240cb1aca..17217a9b80 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol.out.yaml
@@ -138,6 +138,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-ratelimitheaders.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-ratelimitheaders.out.yaml
index e9136150c7..bd806a25a2 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-ratelimitheaders.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-ratelimitheaders.out.yaml
@@ -138,6 +138,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
index 2f21fad0bd..a292ae6133 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
@@ -521,6 +521,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -551,6 +553,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
@@ -585,6 +589,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
@@ -629,6 +635,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-not-same-namespace-not-same-namespace-gateway-f21c7840
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-not-same-namespace-not-same-namespace-gateway-f21c7840
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-tcp-keepalive.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-tcp-keepalive.out.yaml
index 45a52c9b79..2d68cc17f3 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-tcp-keepalive.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-tcp-keepalive.out.yaml
@@ -173,6 +173,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout-with-error.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout-with-error.out.yaml
index afe041ba53..b68f357b82 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout-with-error.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout-with-error.out.yaml
@@ -102,6 +102,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-966d2c13
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-966d2c13
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml
index 7b7f62a505..27542d1e5e 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml
@@ -140,6 +140,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-966d2c13
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-966d2c13
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml
index e7f7b355f5..8ea6ea3011 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml
@@ -337,6 +337,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -400,6 +402,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
@@ -449,6 +453,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-trailers.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-trailers.out.yaml
index 7359f5a74c..73623fc12b 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-trailers.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-trailers.out.yaml
@@ -137,6 +137,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/conflicting-policies.out.yaml b/internal/gatewayapi/testdata/conflicting-policies.out.yaml
index 71b9ba7b36..f7f471e9f9 100644
--- a/internal/gatewayapi/testdata/conflicting-policies.out.yaml
+++ b/internal/gatewayapi/testdata/conflicting-policies.out.yaml
@@ -277,6 +277,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/custom-filter-order.out.yaml b/internal/gatewayapi/testdata/custom-filter-order.out.yaml
index 452d19e6d9..5c7867630a 100644
--- a/internal/gatewayapi/testdata/custom-filter-order.out.yaml
+++ b/internal/gatewayapi/testdata/custom-filter-order.out.yaml
@@ -241,6 +241,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/disable-accesslog.out.yaml b/internal/gatewayapi/testdata/disable-accesslog.out.yaml
index 8169fd0585..49c4ca0ed3 100644
--- a/internal/gatewayapi/testdata/disable-accesslog.out.yaml
+++ b/internal/gatewayapi/testdata/disable-accesslog.out.yaml
@@ -131,6 +131,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
index 38764bc6a4..c4496a4577 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-invalid-cross-ns-ref.out.yaml
@@ -91,6 +91,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
index bf03529c61..d37d77af40 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
@@ -280,6 +280,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
index f1dfd50d08..c303509934 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
@@ -547,6 +547,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-another-namespace-not-same-namespace-gateway-8778384d
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-another-namespace-not-same-namespace-gateway-8778384d
     http:
@@ -577,6 +579,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -639,6 +643,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
index 82fc327406..67430f1999 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-matching-port.out.yaml
@@ -142,6 +142,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
index dd430428e3..71c0e8741c 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-port.out.yaml
@@ -142,6 +142,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
index 0df0031657..a12475b87a 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-reference-grant.out.yaml
@@ -144,6 +144,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
index 4b16b5ea20..6ed85f5cf1 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-invalid-no-service.out.yaml
@@ -143,6 +143,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
index 6945b1b6ab..4d81dc45d8 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
@@ -303,6 +303,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml
index 424e55f90e..d0b799234b 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-mixed-backendrefs.out.yaml
@@ -186,6 +186,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
index 599407e306..6dc911057f 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
@@ -292,6 +292,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml
index 2bd14f825f..00911e5ea6 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml
@@ -321,6 +321,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml
index 6936c17b23..2c742819ca 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml
@@ -154,6 +154,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml
index f0b750fb92..ca18946a75 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml
@@ -219,6 +219,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml
index f1b5f7b2fd..8c0a75c465 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml
@@ -400,6 +400,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml
index 8bcc44afc3..0027c28552 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml
@@ -221,6 +221,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-env-vars.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-env-vars.out.yaml
index 010c19c431..eae89a0186 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-env-vars.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-env-vars.out.yaml
@@ -255,6 +255,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-targetrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-targetrefs.out.yaml
index 01a02913f5..c5fcc5668a 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-targetrefs.out.yaml
@@ -223,6 +223,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm.out.yaml
index fa3266a92b..3c8f7ae9a6 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm.out.yaml
@@ -257,6 +257,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-cross-ns-target.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-cross-ns-target.out.yaml
index a8b448e942..9d5b30f795 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-cross-ns-target.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-cross-ns-target.out.yaml
@@ -73,6 +73,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
index 60e3870c65..5a22aea078 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
@@ -99,6 +99,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
index 8487721fbf..71dc6b3ee5 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
@@ -101,6 +101,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
index c01881a53f..8380061ff6 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
@@ -92,6 +92,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
index 3384b17244..d89a939044 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
@@ -128,6 +128,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/envoypatchpolicy-valid.out.yaml b/internal/gatewayapi/testdata/envoypatchpolicy-valid.out.yaml
index 8a51b955a6..72798d6520 100644
--- a/internal/gatewayapi/testdata/envoypatchpolicy-valid.out.yaml
+++ b/internal/gatewayapi/testdata/envoypatchpolicy-valid.out.yaml
@@ -122,6 +122,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml
index 9ff21d8cd8..5a2b8461c0 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-als-json.out.yaml
@@ -214,6 +214,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-backend-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-backend-invalid.out.yaml
index 48f7e4195a..1397ecce41 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-backend-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-backend-invalid.out.yaml
@@ -154,6 +154,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-backend.out.yaml
index 1fb23f97f1..d6b4f0acd9 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-backend.out.yaml
@@ -174,6 +174,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.out.yaml
index ac0b112627..b33373e264 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel-with-invalid.out.yaml
@@ -155,6 +155,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel.out.yaml
index 12f4d4d568..960a9d1ec3 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-cel.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-cel.out.yaml
@@ -205,6 +205,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
index b41bc7198f..5e5dbefaf8 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
@@ -140,6 +140,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json.out.yaml
index 41506085fc..4a95b45ecc 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-file-json.out.yaml
@@ -146,6 +146,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-types.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-types.out.yaml
index 49aba1d1ab..f7604c6ad2 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-types.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-types.out.yaml
@@ -517,6 +517,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
index 5b29655ee8..81ef7ff75a 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
@@ -140,6 +140,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml
index ff7e9dc944..39f0d0d929 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-with-traffic.out.yaml
@@ -348,6 +348,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog-without-format.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog-without-format.out.yaml
index b8d80eaf34..22b9afa2e4 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog-without-format.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog-without-format.out.yaml
@@ -232,6 +232,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-accesslog.out.yaml b/internal/gatewayapi/testdata/envoyproxy-accesslog.out.yaml
index a6629d4f2b..3282cf8a2d 100644
--- a/internal/gatewayapi/testdata/envoyproxy-accesslog.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-accesslog.out.yaml
@@ -244,6 +244,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml
index dde8928c34..a2ee7395e4 100644
--- a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing-for-gateway.out.yaml
@@ -124,6 +124,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml
index 7bab55618f..5b2dfc3cd7 100644
--- a/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-endpoint-routing.out.yaml
@@ -119,6 +119,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-metric-backend-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-metric-backend-invalid.out.yaml
index 9277838ba1..e5007ed641 100644
--- a/internal/gatewayapi/testdata/envoyproxy-metric-backend-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-metric-backend-invalid.out.yaml
@@ -147,6 +147,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-metric-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-metric-backend.out.yaml
index 2033adafe7..314fa0dda6 100644
--- a/internal/gatewayapi/testdata/envoyproxy-metric-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-metric-backend.out.yaml
@@ -140,6 +140,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-metric-enabled-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-metric-enabled-backend.out.yaml
index 192195730a..a91305f04d 100644
--- a/internal/gatewayapi/testdata/envoyproxy-metric-enabled-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-metric-enabled-backend.out.yaml
@@ -143,6 +143,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-preserve-route-order.out.yaml b/internal/gatewayapi/testdata/envoyproxy-preserve-route-order.out.yaml
index 1ed76b65dc..0d3c1fb46d 100644
--- a/internal/gatewayapi/testdata/envoyproxy-preserve-route-order.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-preserve-route-order.out.yaml
@@ -169,6 +169,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml
index 621550d1f4..6433a3ba8c 100644
--- a/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml
@@ -295,6 +295,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml b/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml
index e9c9f65815..3dae49ff5f 100644
--- a/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-service-routing-for-gateway.out.yaml
@@ -124,6 +124,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml b/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml
index 6ec375dbd1..2d804ec1b3 100644
--- a/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-service-routing.out.yaml
@@ -119,6 +119,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml
index 1f95311a89..bec21583dd 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml
@@ -242,6 +242,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-tls-e5408cf3
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-tls-e5408cf3
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml
index 3fe6a03da2..11310ac983 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml
@@ -241,6 +241,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-tls-e5408cf3
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-tls-e5408cf3
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml
index eb7cc1ea3c..9195a5e735 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml
@@ -238,6 +238,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-tls-e5408cf3
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-tls-e5408cf3
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tracing-backend-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tracing-backend-invalid.out.yaml
index 4d31590c36..e86a3a997c 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tracing-backend-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tracing-backend-invalid.out.yaml
@@ -147,6 +147,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tracing-backend-uds.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tracing-backend-uds.out.yaml
index 0ed4dbb3db..3e90cefbc4 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tracing-backend-uds.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tracing-backend-uds.out.yaml
@@ -188,6 +188,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml
index d49cecd062..db0d60b89b 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tracing-backend.out.yaml
@@ -167,6 +167,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-valid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-valid.out.yaml
index 3dc708cc51..1da633d190 100644
--- a/internal/gatewayapi/testdata/envoyproxy-valid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-valid.out.yaml
@@ -131,6 +131,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/envoyproxy-with-statname.out.yaml b/internal/gatewayapi/testdata/envoyproxy-with-statname.out.yaml
index 5754348d91..2124d24181 100644
--- a/internal/gatewayapi/testdata/envoyproxy-with-statname.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-with-statname.out.yaml
@@ -177,6 +177,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
index 6ee615cb2c..fb97fb60e7 100644
--- a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
@@ -108,6 +108,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
index 3c80546ef9..4462b0661c 100644
--- a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
@@ -108,6 +108,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-http-listener-with-hostname-intersection.out.yaml b/internal/gatewayapi/testdata/gateway-http-listener-with-hostname-intersection.out.yaml
index c64f2454db..21d466d5dd 100644
--- a/internal/gatewayapi/testdata/gateway-http-listener-with-hostname-intersection.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-http-listener-with-hostname-intersection.out.yaml
@@ -184,6 +184,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml b/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml
index 42df949952..3c6f19ced4 100644
--- a/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml
@@ -126,6 +126,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml b/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml
index 4077bcb62d..b970e69846 100644
--- a/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml
@@ -292,6 +292,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
@@ -352,6 +354,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-default-gateway-2-5e70ed84
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-2-5e70ed84
     http:
@@ -423,6 +427,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-test-ns-gateway-3-3ac1f097
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-test-ns-gateway-3-3ac1f097
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-addresses-with-ipaddress.out.yaml b/internal/gatewayapi/testdata/gateway-with-addresses-with-ipaddress.out.yaml
index c2f98c5b12..988d1f6b14 100644
--- a/internal/gatewayapi/testdata/gateway-with-addresses-with-ipaddress.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-addresses-with-ipaddress.out.yaml
@@ -78,6 +78,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-infrastructure-parametersref.out.yaml b/internal/gatewayapi/testdata/gateway-with-infrastructure-parametersref.out.yaml
index a281b54977..2054eb28a9 100644
--- a/internal/gatewayapi/testdata/gateway-with-infrastructure-parametersref.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-infrastructure-parametersref.out.yaml
@@ -135,6 +135,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-does-not-exist.out.yaml b/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-does-not-exist.out.yaml
index 3fa0a6183c..986194060b 100644
--- a/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-does-not-exist.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-does-not-exist.out.yaml
@@ -118,6 +118,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-fallback.out.yaml b/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-fallback.out.yaml
index 424af5cb41..12f70d310a 100644
--- a/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-fallback.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-invalid-infrastructure-parametersref-fallback.out.yaml
@@ -135,6 +135,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
index 26e1d6f54d..b63fc63a2f 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
@@ -103,6 +103,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
index 40662f8433..43d1181099 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
@@ -94,6 +94,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
index 25a338280a..cd81402314 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
@@ -96,6 +96,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
index 56465c120b..21ebc08a31 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
@@ -94,6 +94,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
index aebdfa24b3..6342a6483a 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
@@ -94,6 +94,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
index 870fb825d8..884ff7683a 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
@@ -109,6 +109,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
index 7c4d7deead..9931e6e3f6 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
@@ -102,6 +102,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
index ed7deba70c..4ee20e85f8 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
@@ -97,6 +97,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
index 3155125f75..e44aa883f9 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
@@ -104,6 +104,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
index 690ad904a7..d4635f66f1 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
@@ -101,6 +101,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
index 7afdcd0954..4019a6e52a 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
@@ -103,6 +103,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
index 5c3d31a157..b48f7e3d80 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
@@ -101,6 +101,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
index e90bbe127f..82c4197387 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
@@ -96,6 +96,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
index 355aa80e4a..a2eb7dc6b9 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
@@ -59,6 +59,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
index fe4eea4e49..d7cc0d7853 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
@@ -103,6 +103,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
index a8e12e5ceb..ba1b0a1d8b 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
@@ -107,6 +107,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
index bea8b7c5ad..22899cdf80 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
@@ -103,6 +103,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
index 4030436c73..13c4972248 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -115,6 +115,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
index e060b74230..361f64fbd4 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
@@ -184,6 +184,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
index 2b22da463a..9e2aec6e24 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
@@ -59,6 +59,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
index b33160c7b7..5bf63d9e38 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
@@ -103,6 +103,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
index 0d6ee4d449..6929283b95 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
@@ -107,6 +107,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
index c0734fa11f..0a4ead2feb 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
@@ -103,6 +103,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
index b8625d8f6a..8874752a0b 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
@@ -71,6 +71,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
index b57a3f6c41..47898bd95e 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
@@ -71,6 +71,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
index 616c194486..4be3310a67 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
@@ -96,6 +96,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
index 04ff13065a..5a2f73e993 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
@@ -117,6 +117,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
index 21e89cba76..a8910a4afa 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
@@ -117,6 +117,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
index 99e967932d..5ceb26d1e0 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
@@ -114,6 +114,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-certs.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-certs.out.yaml
index 43cce1fc13..286417198b 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-certs.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-certs.out.yaml
@@ -201,6 +201,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs-merged-gateways.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs-merged-gateways.out.yaml
index ca583fd9d5..3582aed908 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs-merged-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs-merged-gateways.out.yaml
@@ -188,6 +188,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs.out.yaml
index f0f1a25883..f6d2426040 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-and-certs.out.yaml
@@ -165,6 +165,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-merged-gateways.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-merged-gateways.out.yaml
index 85ca6d6585..e98a366e43 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-merged-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames-merged-gateways.out.yaml
@@ -224,6 +224,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames.out.yaml b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames.out.yaml
index 77c51b3af1..c0f6ee8aec 100644
--- a/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-multiple-https-listeners-with-overlapping-hostnames.out.yaml
@@ -201,6 +201,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml b/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml
index 76b84f43ea..e9dc717f9b 100644
--- a/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml
@@ -108,6 +108,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml b/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
index 1e4c557ec1..67ee6d42c2 100644
--- a/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
@@ -134,6 +134,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml b/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
index 0b38fdb2d3..5a3cbd1c4c 100644
--- a/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
@@ -134,6 +134,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml b/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml
index 77875fe54e..cdf37030bf 100644
--- a/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml
@@ -114,6 +114,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
index 873ee91ae5..d924cccae6 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
@@ -127,6 +127,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
index 59ad562d31..34afc37a71 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
@@ -130,6 +130,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
index 6db90b59e4..d9301da42f 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
@@ -163,6 +163,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
index cf41890000..cf975604de 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
@@ -180,6 +180,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
index fb19e839d9..348d42b074 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
@@ -131,6 +131,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
index 6723d247d8..9f1527e6fe 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
@@ -131,6 +131,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
index 8f4b136987..b360c5e7f5 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
@@ -175,6 +175,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
index eb9297e97a..3f9d19742d 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
@@ -175,6 +175,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
index 7e6b30d464..00f54bdc01 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
@@ -172,6 +172,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
index 983126f411..b6310b0365 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
@@ -168,6 +168,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
index 01cecc4421..e6f45de969 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
@@ -172,6 +172,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
index 7ffac9a6e0..6938d809d6 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
@@ -168,6 +168,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-backend.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-backend.out.yaml
index 6447053ded..960e37c7ba 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-backend.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-backend.out.yaml
@@ -135,6 +135,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-empty-backends.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-empty-backends.out.yaml
index 5ccc18e6a4..ced6b0e8c7 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-empty-backends.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-empty-backends.out.yaml
@@ -108,6 +108,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml
index e6570b785e..e04dee55f3 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml
index b380d8402d..a0de796725 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml
@@ -116,6 +116,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml
index 1f19f20772..347f537ba9 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml
@@ -114,6 +114,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml
index beaccc8987..8a3e174c0b 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml
@@ -118,6 +118,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml
index b8f58798f6..c71a1a0503 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml
@@ -114,6 +114,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
index 7928f14c5a..7484710e0c 100644
--- a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
@@ -146,6 +146,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
index 7adbf33127..38b6d3f8cb 100644
--- a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
@@ -265,6 +265,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -336,6 +338,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
index 740759df19..bd44ffda42 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
@@ -368,6 +368,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
index c8330506b3..b74e23fa45 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
@@ -319,6 +319,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
index f0760aa458..f1a871a6b9 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
@@ -150,6 +150,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
index 88c0ed4a4c..265e84a093 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
@@ -139,6 +139,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
index a8b6a47539..5ed04b212d 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
@@ -108,6 +108,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml
index a19d95ffa0..557a73815b 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
index 45595ff84b..f2b1d8a16e 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
@@ -141,6 +141,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-and-core-backendrefs.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-and-core-backendrefs.out.yaml
index 8b496af1ce..f8d83c11d3 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-and-core-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-and-core-backendrefs.out.yaml
@@ -214,6 +214,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref-mixed-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref-mixed-address-type.out.yaml
index 8a107920a6..099fa787d1 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref-mixed-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref-mixed-address-type.out.yaml
@@ -271,6 +271,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
index 103ec37be6..a22cf4f8c8 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-backend-backendref.out.yaml
@@ -354,6 +354,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-diff-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-diff-address-type.out.yaml
index 4ba901a396..d5d31b0608 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-diff-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-diff-address-type.out.yaml
@@ -294,6 +294,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-same-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-same-address-type.out.yaml
index 7908019b29..ae51a9d46c 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-same-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-backend-backendrefs-same-address-type.out.yaml
@@ -303,6 +303,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
index 87ad67caad..e58f62ae27 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
@@ -116,6 +116,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
index fe913cc5bf..c5ee60d93a 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
@@ -116,6 +116,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
index ed2c06a177..3a0c675364 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
index 1ebf1c5004..ccafdc9929 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
@@ -113,6 +113,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
index f5429403d0..78d93ad042 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
index 4174f87333..5529befc00 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
@@ -110,6 +110,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml
index 262f1e50e5..c62ec1648f 100644
--- a/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-dynamic-resolver-with-mutliple-backends.out.yaml b/internal/gatewayapi/testdata/httproute-dynamic-resolver-with-mutliple-backends.out.yaml
index 61f13cd437..36f653e7bc 100644
--- a/internal/gatewayapi/testdata/httproute-dynamic-resolver-with-mutliple-backends.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-dynamic-resolver-with-mutliple-backends.out.yaml
@@ -148,6 +148,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml b/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml
index 0420e077f6..aca1890ee8 100644
--- a/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml
@@ -186,6 +186,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml b/internal/gatewayapi/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
index 66ccab5b42..3e2078c7ee 100644
--- a/internal/gatewayapi/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
@@ -111,6 +111,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml
index 645cdbbc4c..15e1683cbd 100644
--- a/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-retry.out.yaml b/internal/gatewayapi/testdata/httproute-retry.out.yaml
index 38bee8653a..10c4425e0f 100644
--- a/internal/gatewayapi/testdata/httproute-retry.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-retry.out.yaml
@@ -249,6 +249,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -287,6 +289,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
index 5394af23d2..54f028cfef 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
@@ -105,6 +105,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
index 28268678b4..cc033c0588 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
index ace58bcfc9..5eba153f72 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
@@ -118,6 +118,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-app-protocols.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-app-protocols.out.yaml
index 32fe94631c..f69b03275a 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-app-protocols.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-app-protocols.out.yaml
@@ -187,6 +187,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-weights.out.yaml
index ad8532cd96..025055cf47 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-weights.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-weights.out.yaml
@@ -185,6 +185,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.out.yaml b/internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.out.yaml
index 2165fdf00c..fec01515b7 100644
--- a/internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.out.yaml
@@ -148,6 +148,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-add-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-add-multiple-filters.out.yaml
index 6ff6606bfe..1ac1bb370e 100644
--- a/internal/gatewayapi/testdata/httproute-with-backendref-add-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-add-multiple-filters.out.yaml
@@ -141,6 +141,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
index 802d45f01b..3fe2698ebe 100644
--- a/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -110,6 +110,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
index 119a13852b..18d8f8ef6f 100644
--- a/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-cors-filter.out.yaml b/internal/gatewayapi/testdata/httproute-with-cors-filter.out.yaml
index 2f58044860..4c629f25c9 100644
--- a/internal/gatewayapi/testdata/httproute-with-cors-filter.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-cors-filter.out.yaml
@@ -179,6 +179,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-credential-injection.out.yaml b/internal/gatewayapi/testdata/httproute-with-credential-injection.out.yaml
index 6afa25dcd3..2f115067c6 100644
--- a/internal/gatewayapi/testdata/httproute-with-credential-injection.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-credential-injection.out.yaml
@@ -176,6 +176,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml b/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml
index ecc94c5130..de34df2dbd 100644
--- a/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-direct-response.out.yaml
@@ -206,6 +206,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml b/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml
index 5b341c08b1..0ac2c8904b 100644
--- a/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml
@@ -107,6 +107,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-enable-zone-discovery.out.yaml b/internal/gatewayapi/testdata/httproute-with-enable-zone-discovery.out.yaml
index 488788c438..cbeda1ea5a 100644
--- a/internal/gatewayapi/testdata/httproute-with-enable-zone-discovery.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-enable-zone-discovery.out.yaml
@@ -130,6 +130,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
index bd560dac02..a36c80079f 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -128,6 +128,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
index aeac921a32..9154b1e67d 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
@@ -138,6 +138,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
index 9d405bb01e..fea5ed44cd 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -124,6 +124,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
index d158e9be26..994b64b3fa 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
@@ -119,6 +119,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml
index e7c9cf017a..f149ec18e7 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml
@@ -123,6 +123,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-headers.out.yaml
index e68741289c..617c963140 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-headers.out.yaml
@@ -124,6 +124,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-header-values.out.yaml
index c6e12c8e9a..c1b8bac66d 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-header-values.out.yaml
@@ -124,6 +124,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-headers.out.yaml
index 40a08c7484..10b3f5c799 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-invalid-headers.out.yaml
@@ -218,6 +218,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml
index 3a8e13c96a..371a0ff59c 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml
@@ -116,6 +116,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-no-valid-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
index c060f6c205..1aecff46e8 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
@@ -120,6 +120,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml
index c42ef161ce..190ffaa59f 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml
@@ -120,6 +120,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-match-diff-number.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-match-diff-number.out.yaml
index 0d2186e4c8..28c6be9c10 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-match-diff-number.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-match-diff-number.out.yaml
@@ -164,6 +164,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-header-match-diff-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-match-diff-type.out.yaml
index e53d79e676..d2d3a96033 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-match-diff-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-match-diff-type.out.yaml
@@ -161,6 +161,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml b/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml
index 7ab249860c..c212685228 100644
--- a/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml
@@ -116,6 +116,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-headless-service-service-routing.out.yaml b/internal/gatewayapi/testdata/httproute-with-headless-service-service-routing.out.yaml
index c1f5807683..4b09b45ffb 100644
--- a/internal/gatewayapi/testdata/httproute-with-headless-service-service-routing.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-headless-service-service-routing.out.yaml
@@ -117,6 +117,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
index 2d39e2c8dd..5938cfa254 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
@@ -110,6 +110,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
index ea4da9e6e7..c10c912469 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
@@ -114,6 +114,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
index 66190e16a9..b2228f798b 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
@@ -111,6 +111,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml
index c4823beaba..048a85f2ca 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-mixed-kind.out.yaml
@@ -133,6 +133,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
index 9557bbe82e..5e8580cc91 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
@@ -109,6 +109,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
index 14cc7dc48e..94c0c6ef02 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
index c91cf7b824..e6ef14bb9b 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
@@ -110,6 +110,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
index cf7e9a40e5..1157520981 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
@@ -117,6 +117,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
index 1565872c71..b1edc43f2c 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
@@ -111,6 +111,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml
index e5ea6f1259..64d1efb816 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml
@@ -164,6 +164,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -202,6 +204,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml b/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml
index 14d27cc508..aebc200380 100644
--- a/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-metadata.out.yaml
@@ -120,6 +120,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml
index 9de7949218..42fd44169e 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml
@@ -126,6 +126,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml
index 980c80337a..f38c14551d 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml
@@ -138,6 +138,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-percentage-mirroring.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-percentage-mirroring.out.yaml
index 594fe8a459..71234bcac3 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-percentage-mirroring.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-percentage-mirroring.out.yaml
@@ -130,6 +130,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
index eadbb2c4f6..102b858799 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
@@ -120,6 +120,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
index 4260dd9642..070df69776 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
@@ -121,6 +121,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml
index 099bff53ba..835bd8bbdf 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml
@@ -120,6 +120,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml b/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml
index 331ab86f9a..a1647215ff 100644
--- a/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml
@@ -127,6 +127,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -165,6 +167,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml b/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml
index 96b04d6ebd..107af5f08f 100644
--- a/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml
@@ -168,6 +168,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
@@ -228,6 +230,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml
index 7cb5121790..126dd5c2af 100644
--- a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml
@@ -192,6 +192,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-default-gateway-a-573db404
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-a-573db404
     http:
@@ -265,6 +267,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-b-3a004b3a
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-b-3a004b3a
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml
index cbe983dfff..27e90a5f07 100644
--- a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml
@@ -187,6 +187,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-a-37c12ef1
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-a-37c12ef1
     http:
@@ -243,6 +245,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-b-3a004b3a
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-b-3a004b3a
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-multiple-invalid-rules.out.yaml b/internal/gatewayapi/testdata/httproute-with-multiple-invalid-rules.out.yaml
index a11f92afb7..d3804f0c70 100644
--- a/internal/gatewayapi/testdata/httproute-with-multiple-invalid-rules.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multiple-invalid-rules.out.yaml
@@ -133,6 +133,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
index 5c47abfe1f..066185b673 100644
--- a/internal/gatewayapi/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-query-match-diff-number.out.yaml b/internal/gatewayapi/testdata/httproute-with-query-match-diff-number.out.yaml
index 77cf3b4c4b..30780d7811 100644
--- a/internal/gatewayapi/testdata/httproute-with-query-match-diff-number.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-query-match-diff-number.out.yaml
@@ -164,6 +164,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-query-match-diff-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-query-match-diff-type.out.yaml
index 757aa003d5..debae688c6 100644
--- a/internal/gatewayapi/testdata/httproute-with-query-match-diff-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-query-match-diff-type.out.yaml
@@ -161,6 +161,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
index a61d83aec2..146001cbee 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
@@ -118,6 +118,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml
index 12493f47fc..22645315b1 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml
@@ -116,6 +116,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
index d05424af1f..f70f729534 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
@@ -119,6 +119,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
index 326f314e0c..4d66c9ba4d 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
@@ -116,6 +116,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-status.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
index f00500d19f..a7520edc34 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
@@ -115,6 +115,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
index 49341a8cb9..4ae0c44b36 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
@@ -119,6 +119,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml
index 7b79dd714f..015d9c615b 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml
@@ -134,6 +134,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
index 879a68dd55..fed37ac858 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -128,6 +128,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
index d55a1cde2e..dd88bdb332 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
@@ -138,6 +138,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
index 91ec3fef72..9f8a792e49 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -124,6 +124,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
index a2e0a61d80..bb8da9e4c0 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
@@ -119,6 +119,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
index 214a88516b..d6e20f2b6d 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
@@ -123,6 +123,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
index f0c67fdd57..d4590274c3 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
@@ -124,6 +124,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-header-values.out.yaml
index 3ce870826d..d3252e579a 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-header-values.out.yaml
@@ -124,6 +124,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
index b4fbe42d17..02b9de779e 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
@@ -216,6 +216,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml
index 5ebec2948f..960026e440 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml
@@ -116,6 +116,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
index d161745283..64941c818e 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
@@ -120,6 +120,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml
index 9c96daf31e..af6ee037d2 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml
@@ -120,6 +120,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
index 535f1e63d6..f71af7fcd2 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
@@ -109,6 +109,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
index d1160f1cb4..d28d8ecc75 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
@@ -107,6 +107,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
index 140d02e60e..2643bd5376 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
@@ -140,6 +140,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
index 63efa5b39e..b7e522a31b 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
@@ -113,6 +113,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml b/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
index 6f9f2fcb00..5111e6b13a 100644
--- a/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
@@ -115,6 +115,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
index 9754452a8e..2bd137d812 100644
--- a/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -111,6 +111,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
index 8f08f25c67..ff97b78f21 100644
--- a/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -112,6 +112,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
index e37a8bf5f3..b340742b6f 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
@@ -119,6 +119,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
index a9f7ee21cf..99c94de731 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
@@ -120,6 +120,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
index ee5e07fff9..4a7b739bf6 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
@@ -117,6 +117,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
index 79630af376..c137ed2ea3 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
@@ -117,6 +117,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
index 96b4b0868d..c3846f7783 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
@@ -123,6 +123,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
index db646bef4e..c7e317ab89 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
@@ -125,6 +125,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
index 9d3d839b59..bedab141c3 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
@@ -121,6 +121,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
index 54826ecbd6..e7ef5efc2c 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
@@ -120,6 +120,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
index 65a190d701..ac8dd61db7 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
@@ -118,6 +118,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
index 6e7ef878b4..8bbaa7a3d9 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
@@ -119,6 +119,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-http.out.yaml
index 4326f5c2d4..8f885bad2b 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-http.out.yaml
@@ -257,6 +257,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-invalid.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-invalid.out.yaml
index 8ddde8ac90..0882311d6f 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-regex-match-replace-invalid.out.yaml
@@ -354,6 +354,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.out.yaml
index 5dd0f8f588..4612121b79 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.out.yaml
@@ -360,6 +360,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml
index ab4fcd32cb..99276f2da1 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml
@@ -261,6 +261,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
index 4ff2739d3d..62684663fd 100644
--- a/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
@@ -110,6 +110,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml b/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml
index 542c8f479b..e194c7e2c7 100644
--- a/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml
+++ b/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml
@@ -295,6 +295,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/merge-invalid-multiple-gateways.out.yaml b/internal/gatewayapi/testdata/merge-invalid-multiple-gateways.out.yaml
index ebce0daea8..9aabbcd964 100644
--- a/internal/gatewayapi/testdata/merge-invalid-multiple-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/merge-invalid-multiple-gateways.out.yaml
@@ -148,6 +148,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
index 9bb0541a21..163c54a8ee 100644
--- a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
+++ b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
@@ -184,6 +184,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
index de633d0e13..f98d6b7987 100644
--- a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
+++ b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
@@ -235,6 +235,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/merge-valid-multiple-gateways.out.yaml b/internal/gatewayapi/testdata/merge-valid-multiple-gateways.out.yaml
index 4d5a589bdc..6deaebb3fc 100644
--- a/internal/gatewayapi/testdata/merge-valid-multiple-gateways.out.yaml
+++ b/internal/gatewayapi/testdata/merge-valid-multiple-gateways.out.yaml
@@ -157,6 +157,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml b/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml
index 6cbb413e39..c5ec4734f7 100644
--- a/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml
+++ b/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml
@@ -513,6 +513,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml b/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml
index 6469b2954a..2497a9996c 100644
--- a/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml
+++ b/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml
@@ -305,6 +305,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml b/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
index 72689e65ea..682b075a49 100644
--- a/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
@@ -102,6 +102,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-listener.out.yaml b/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-listener.out.yaml
index 3a65eeef37..4933c402fe 100644
--- a/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-listener.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-listener.out.yaml
@@ -144,6 +144,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml
index 648ed206d1..2bc1152d33 100644
--- a/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml
@@ -524,6 +524,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
index 84ffbfd88b..6c9784d4e5 100644
--- a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
@@ -427,6 +427,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -486,6 +488,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-client-cidr.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-client-cidr.out.yaml
index dd03e105f7..ff89dd4a6b 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-client-cidr.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-client-cidr.out.yaml
@@ -297,6 +297,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-headers-and-methods.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-headers-and-methods.out.yaml
index 99f4ffcc15..ee614141c9 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-headers-and-methods.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-headers-and-methods.out.yaml
@@ -153,6 +153,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-jwt-claim.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-jwt-claim.out.yaml
index ebe198049d..ec72edf3e6 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-jwt-claim.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-authoriztion-jwt-claim.out.yaml
@@ -166,6 +166,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml
index 3b733f84b4..5c439c2c36 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml
@@ -229,6 +229,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
index ad248dcaaf..9c6ab45542 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
@@ -357,6 +357,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -419,6 +421,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
@@ -474,6 +478,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
index c12b72177e..5f3ff6601f 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
@@ -417,6 +417,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -495,6 +497,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
@@ -585,6 +589,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml
index 4e152f11ce..1b3a2bca1b 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backend.out.yaml
@@ -375,6 +375,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml
index b7f2de2e97..4803ee7b42 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendref.out.yaml
@@ -240,6 +240,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml
index d3ec9167e1..322cbdcd1c 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-body.out.yaml
@@ -215,6 +215,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
index 6a4adeb1df..db6d68123c 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
@@ -148,6 +148,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
index d5b39433be..75efe71ee0 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
@@ -148,6 +148,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
index edcdd43af9..8527c556d8 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
@@ -149,6 +149,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
index 2090e18a00..7681785465 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
@@ -148,6 +148,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
index 071c336b9a..49e724b6e3 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-recomputation.out.yaml
@@ -214,6 +214,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
index c4223ca7ae..60e44e51ea 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
@@ -293,6 +293,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
index d1c412c6ed..8fb81761f8 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
@@ -234,6 +234,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
index 40695d70b1..7e83661b5b 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
@@ -246,6 +246,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-backendcluster.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-backendcluster.out.yaml
index 671f7b0b92..f302ac78f4 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-backendcluster.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-backendcluster.out.yaml
@@ -218,6 +218,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-local-jwks.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-local-jwks.out.yaml
index 3ebf87dfcb..78b3db1801 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-local-jwks.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-local-jwks.out.yaml
@@ -378,6 +378,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml
index 81852ab6f4..1515ba569c 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml
@@ -292,6 +292,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -377,6 +379,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
index a357eeb262..965e1f03d0 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
@@ -291,6 +291,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -376,6 +378,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
index cb5e2eb1be..29479ddce7 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
@@ -283,6 +283,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -368,6 +370,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-and-jwt-passthrough.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-and-jwt-passthrough.out.yaml
index 38585dd628..15ea1fc11a 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-and-jwt-passthrough.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-and-jwt-passthrough.out.yaml
@@ -157,6 +157,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml
index 745e277509..3c895f1483 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml
@@ -223,6 +223,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies-samesite.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies-samesite.out.yaml
index 238a3f2a53..233b3b47a3 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies-samesite.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies-samesite.out.yaml
@@ -154,6 +154,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies.out.yaml
index 14d0018e9f..2423a8db28 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-custom-cookies.out.yaml
@@ -152,6 +152,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-deny-redirect.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-deny-redirect.out.yaml
index 772c2c535e..2043be28eb 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-deny-redirect.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-deny-redirect.out.yaml
@@ -168,6 +168,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
index 3feb2689db..da537056c8 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
@@ -109,6 +109,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
index d41d9c569d..0bfe54f8d2 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
@@ -296,6 +296,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-1-bfd08ef4
     http:
@@ -326,6 +328,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-default-gateway-2-5e70ed84
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-2-5e70ed84
     http:
@@ -367,6 +371,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-default-gateway-3-206418d2
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-default-gateway-3-206418d2
     http:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
index ed23eb4d8f..27cd0de8bd 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
@@ -247,6 +247,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
diff --git a/internal/gatewayapi/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml b/internal/gatewayapi/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
index b5a6db3e89..30b0921d1d 100644
--- a/internal/gatewayapi/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
+++ b/internal/gatewayapi/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
@@ -178,6 +178,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tcproute-rule-with-multiple-backends-and-zero-weights.out.yaml b/internal/gatewayapi/testdata/tcproute-rule-with-multiple-backends-and-zero-weights.out.yaml
index cda0191ef7..2a132aaa52 100644
--- a/internal/gatewayapi/testdata/tcproute-rule-with-multiple-backends-and-zero-weights.out.yaml
+++ b/internal/gatewayapi/testdata/tcproute-rule-with-multiple-backends-and-zero-weights.out.yaml
@@ -113,6 +113,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tcproute-with-backend.out.yaml b/internal/gatewayapi/testdata/tcproute-with-backend.out.yaml
index ebc77c28ae..a21e27cfdb 100644
--- a/internal/gatewayapi/testdata/tcproute-with-backend.out.yaml
+++ b/internal/gatewayapi/testdata/tcproute-with-backend.out.yaml
@@ -123,6 +123,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tlsroute-attaching-to-gateway.out.yaml b/internal/gatewayapi/testdata/tlsroute-attaching-to-gateway.out.yaml
index 762ee649c4..24f7fd3ef9 100644
--- a/internal/gatewayapi/testdata/tlsroute-attaching-to-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-attaching-to-gateway.out.yaml
@@ -106,6 +106,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tlsroute-invalid-reference-grant.out.yaml b/internal/gatewayapi/testdata/tlsroute-invalid-reference-grant.out.yaml
index 8886594ab6..b9b1288722 100644
--- a/internal/gatewayapi/testdata/tlsroute-invalid-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-invalid-reference-grant.out.yaml
@@ -109,6 +109,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-gateway-conformance-infra-gateway-tlsroute-refer-1a02781b
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-gateway-conformance-infra-gateway-tlsroute-refer-1a02781b
     readyListener:
diff --git a/internal/gatewayapi/testdata/tlsroute-multiple.out.yaml b/internal/gatewayapi/testdata/tlsroute-multiple.out.yaml
index 71e77c3a2b..cb3c5c0017 100644
--- a/internal/gatewayapi/testdata/tlsroute-multiple.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-multiple.out.yaml
@@ -140,6 +140,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml b/internal/gatewayapi/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
index 2b33ed37cf..6990d40f08 100644
--- a/internal/gatewayapi/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
@@ -92,6 +92,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tlsroute-with-backend.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-backend.out.yaml
index 9dd0fb3715..86399774f9 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-backend.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-backend.out.yaml
@@ -126,6 +126,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
index 777ce96bb9..b9d717c1ba 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -107,6 +107,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tlsroute-with-empty-hostname.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-empty-hostname.out.yaml
index efa4ca1503..864f6eae84 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-empty-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-empty-hostname.out.yaml
@@ -105,6 +105,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tlsroute-with-empty-listener-hostname.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-empty-listener-hostname.out.yaml
index 43ed8d8635..d330891d14 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-empty-listener-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-empty-listener-hostname.out.yaml
@@ -107,6 +107,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml b/internal/gatewayapi/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
index 87cce61528..1f90c845d8 100644
--- a/internal/gatewayapi/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
+++ b/internal/gatewayapi/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
@@ -97,6 +97,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/tracing-merged-multiple-routes.out.yaml b/internal/gatewayapi/testdata/tracing-merged-multiple-routes.out.yaml
index 6ee03992fa..1ea0b98ae0 100644
--- a/internal/gatewayapi/testdata/tracing-merged-multiple-routes.out.yaml
+++ b/internal/gatewayapi/testdata/tracing-merged-multiple-routes.out.yaml
@@ -242,6 +242,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml b/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml
index ea9c32beef..468fd9ba41 100644
--- a/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml
+++ b/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml
@@ -266,6 +266,8 @@ xdsIR:
       proxyInfraCluster:
         destination:
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     http:
@@ -356,6 +358,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
diff --git a/internal/gatewayapi/testdata/tracing-sampling-fraction.out.yaml b/internal/gatewayapi/testdata/tracing-sampling-fraction.out.yaml
index 18e272ee9b..9e604bac15 100644
--- a/internal/gatewayapi/testdata/tracing-sampling-fraction.out.yaml
+++ b/internal/gatewayapi/testdata/tracing-sampling-fraction.out.yaml
@@ -244,6 +244,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-class-3b1df594
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-class-3b1df594
     http:
diff --git a/internal/gatewayapi/testdata/udproute-rule-with-multiple-backends-and-zero-weights.out.yaml b/internal/gatewayapi/testdata/udproute-rule-with-multiple-backends-and-zero-weights.out.yaml
index 319143d515..aba3013ae8 100644
--- a/internal/gatewayapi/testdata/udproute-rule-with-multiple-backends-and-zero-weights.out.yaml
+++ b/internal/gatewayapi/testdata/udproute-rule-with-multiple-backends-and-zero-weights.out.yaml
@@ -113,6 +113,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:
diff --git a/internal/gatewayapi/testdata/udproute-with-backend.out.yaml b/internal/gatewayapi/testdata/udproute-with-backend.out.yaml
index ff363ba686..1da899d4a5 100644
--- a/internal/gatewayapi/testdata/udproute-with-backend.out.yaml
+++ b/internal/gatewayapi/testdata/udproute-with-backend.out.yaml
@@ -123,6 +123,8 @@ xdsIR:
             port: 8080
             zone: zone1
           name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
           protocol: HTTP
         name: envoy-envoy-gateway-gateway-1-196ae069
     readyListener:

From 4470719ffe61ed5d9b8c34984754891536854929 Mon Sep 17 00:00:00 2001
From: Jukie <10012479+Jukie@users.noreply.github.com>
Date: Tue, 22 Jul 2025 20:41:36 -0600
Subject: [PATCH 6/6] regen

Signed-off-by: Jukie <10012479+Jukie@users.noreply.github.com>
---
 .../testdata/accesslog-als-grpc.out.yaml      |  13 ++
 .../testdata/backend-with-hostname.out.yaml   |  13 ++
 ...olicy-status-conditions-truncated.out.yaml | 200 ++++++++++++++++++
 ...olicy-status-conditions-truncated.out.yaml | 200 ++++++++++++++++++
 ...olicy-status-conditions-truncated.out.yaml | 200 ++++++++++++++++++
 ...trafficpolicy-stream-idle-timeout.out.yaml |  13 ++
 ...olicy-status-conditions-truncated.out.yaml | 200 ++++++++++++++++++
 ...ith-invalid-lua-validation-syntax.out.yaml |  13 ++
 ...y-with-wasm-invalid-configuration.out.yaml |  35 +++
 ...r-by-creation-date-and-route-name.out.yaml |  13 ++
 .../httproute-order-by-creation-date.out.yaml |  13 ++
 ...nvalid-no-section-name-route-rule.out.yaml |  13 ++
 ...licy-status-conditions-route-rule.out.yaml |  13 ++
 ...olicy-status-conditions-truncated.out.yaml | 200 ++++++++++++++++++
 ...y-with-extauth-invalid-no-service.out.yaml |  32 ++-
 ...uth-invalid-no-serviceimport-port.out.yaml |  13 ++
 ...-extauth-invalid-no-serviceimport.out.yaml |  13 ++
 ...policy-with-extauth-serviceimport.out.yaml |  13 ++
 ...ritypolicy-with-jwt-serviceimport.out.yaml |  13 ++
 ...itypolicy-with-oidc-serviceimport.out.yaml |  13 ++
 .../override-prometheus-annotations.yaml      |  37 ++--
 .../override-prometheus-annotations.yaml      |  37 ++--
 22 files changed, 1271 insertions(+), 39 deletions(-)

diff --git a/internal/gatewayapi/testdata/accesslog-als-grpc.out.yaml b/internal/gatewayapi/testdata/accesslog-als-grpc.out.yaml
index efe420cc8e..ed8df4567a 100644
--- a/internal/gatewayapi/testdata/accesslog-als-grpc.out.yaml
+++ b/internal/gatewayapi/testdata/accesslog-als-grpc.out.yaml
@@ -100,6 +100,19 @@ xdsIR:
             protocol: GRPC
         name: envoy-gateway-system/als-backend
         type: HTTP
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backend-with-hostname.out.yaml b/internal/gatewayapi/testdata/backend-with-hostname.out.yaml
index de6179b098..06c900533f 100644
--- a/internal/gatewayapi/testdata/backend-with-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/backend-with-hostname.out.yaml
@@ -143,6 +143,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.out.yaml
index cb1160f86b..90ba88d2fb 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.out.yaml
@@ -2105,6 +2105,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2156,6 +2164,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2207,6 +2223,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2258,6 +2282,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-4-a293650b
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2309,6 +2341,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-5-e35ee57f
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2360,6 +2400,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-6-703894b8
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2411,6 +2459,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-7-8f166bcc
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2462,6 +2518,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-8-18a274e2
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2513,6 +2577,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-9-3f4aa2eb
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2564,6 +2636,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-10-323a05f0
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2615,6 +2695,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-11-7cd86d79
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2666,6 +2754,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-12-b05135f7
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2717,6 +2813,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-13-5ef9b255
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2768,6 +2872,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-14-2b849e6e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2819,6 +2931,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-15-473da5fd
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2870,6 +2990,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-16-bc2b5d3e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2921,6 +3049,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-17-686d5dd1
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2972,6 +3108,70 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-18-80e55fa6
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions-truncated.out.yaml
index 4858c51cc7..144a1ef2c6 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions-truncated.out.yaml
@@ -2409,6 +2409,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2462,6 +2470,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2515,6 +2531,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2568,6 +2592,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-4-a293650b
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2621,6 +2653,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-5-e35ee57f
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2674,6 +2714,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-6-703894b8
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2727,6 +2775,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-7-8f166bcc
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2780,6 +2836,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-8-18a274e2
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2833,6 +2897,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-9-3f4aa2eb
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2886,6 +2958,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-10-323a05f0
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2939,6 +3019,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-11-7cd86d79
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2992,6 +3080,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-12-b05135f7
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3045,6 +3141,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-13-5ef9b255
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3098,6 +3202,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-14-2b849e6e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3151,6 +3263,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-15-473da5fd
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3204,6 +3324,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-16-bc2b5d3e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3257,6 +3385,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-17-686d5dd1
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3310,6 +3446,70 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-18-80e55fa6
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions-truncated.out.yaml
index d16377f342..69ce9225a6 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions-truncated.out.yaml
@@ -1608,6 +1608,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1632,6 +1640,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1656,6 +1672,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1680,6 +1704,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-4-a293650b
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1704,6 +1736,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-5-e35ee57f
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1728,6 +1768,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-6-703894b8
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1752,6 +1800,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-7-8f166bcc
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1776,6 +1832,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-8-18a274e2
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1800,6 +1864,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-9-3f4aa2eb
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1824,6 +1896,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-10-323a05f0
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1848,6 +1928,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-11-7cd86d79
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1872,6 +1960,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-12-b05135f7
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1896,6 +1992,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-13-5ef9b255
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1920,6 +2024,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-14-2b849e6e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1944,6 +2056,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-15-473da5fd
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1968,6 +2088,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-16-bc2b5d3e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -1992,6 +2120,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-17-686d5dd1
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2016,6 +2152,70 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-18-80e55fa6
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-stream-idle-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-stream-idle-timeout.out.yaml
index 71ef791bd2..6f27684439 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-stream-idle-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-stream-idle-timeout.out.yaml
@@ -132,6 +132,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-966d2c13
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-966d2c13
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions-truncated.out.yaml
index cb62b14f17..3f5283f668 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions-truncated.out.yaml
@@ -2409,6 +2409,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2462,6 +2470,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2515,6 +2531,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2568,6 +2592,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-4-a293650b
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2621,6 +2653,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-5-e35ee57f
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2674,6 +2714,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-6-703894b8
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2727,6 +2775,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-7-8f166bcc
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2780,6 +2836,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-8-18a274e2
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2833,6 +2897,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-9-3f4aa2eb
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2886,6 +2958,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-10-323a05f0
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2939,6 +3019,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-11-7cd86d79
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2992,6 +3080,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-12-b05135f7
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3045,6 +3141,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-13-5ef9b255
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3098,6 +3202,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-14-2b849e6e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3151,6 +3263,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-15-473da5fd
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3204,6 +3324,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-16-bc2b5d3e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3257,6 +3385,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-17-686d5dd1
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3310,6 +3446,70 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-18-80e55fa6
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-syntax.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-syntax.out.yaml
index c9dc018783..e1537d09f7 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-syntax.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-syntax.out.yaml
@@ -237,6 +237,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-invalid-configuration.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-invalid-configuration.out.yaml
index abc0d3fde1..fc248761cb 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-invalid-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-invalid-configuration.out.yaml
@@ -702,6 +702,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
@@ -849,6 +857,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-2-5e70ed84
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-default-gateway-2-5e70ed84
     http:
     - address: 0.0.0.0
       hostnames:
@@ -932,6 +948,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-3-206418d2
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-default-gateway-3-206418d2
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-default-order-by-creation-date-and-route-name.out.yaml b/internal/gatewayapi/testdata/httproute-default-order-by-creation-date-and-route-name.out.yaml
index b6b5eb715f..3cb79c9db7 100644
--- a/internal/gatewayapi/testdata/httproute-default-order-by-creation-date-and-route-name.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-default-order-by-creation-date-and-route-name.out.yaml
@@ -335,6 +335,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/httproute-order-by-creation-date.out.yaml b/internal/gatewayapi/testdata/httproute-order-by-creation-date.out.yaml
index 21d9d23244..e078e60528 100644
--- a/internal/gatewayapi/testdata/httproute-order-by-creation-date.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-order-by-creation-date.out.yaml
@@ -229,6 +229,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-route-rule.out.yaml b/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-route-rule.out.yaml
index e3bf8410d3..d38560aef6 100644
--- a/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-route-rule.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-invalid-no-section-name-route-rule.out.yaml
@@ -135,6 +135,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-status-conditions-route-rule.out.yaml b/internal/gatewayapi/testdata/securitypolicy-status-conditions-route-rule.out.yaml
index 9cb21fc6e2..2a8cb3e0c6 100644
--- a/internal/gatewayapi/testdata/securitypolicy-status-conditions-route-rule.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-status-conditions-route-rule.out.yaml
@@ -239,6 +239,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/securitypolicy-status-conditions-truncated.out.yaml
index 6811013796..37c982c1eb 100644
--- a/internal/gatewayapi/testdata/securitypolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-status-conditions-truncated.out.yaml
@@ -2409,6 +2409,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2462,6 +2470,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-2-4a0e4eb9
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2515,6 +2531,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-3-32e857a6
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2568,6 +2592,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-4-a293650b
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2621,6 +2653,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-5-e35ee57f
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2674,6 +2714,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-6-703894b8
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2727,6 +2775,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-7-8f166bcc
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2780,6 +2836,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-8-18a274e2
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2833,6 +2897,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-9-3f4aa2eb
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2886,6 +2958,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-10-323a05f0
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2939,6 +3019,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-11-7cd86d79
     http:
     - address: 0.0.0.0
       hostnames:
@@ -2992,6 +3080,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-12-b05135f7
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3045,6 +3141,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-13-5ef9b255
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3098,6 +3202,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-14-2b849e6e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3151,6 +3263,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-15-473da5fd
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3204,6 +3324,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-16-bc2b5d3e
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3257,6 +3385,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-17-686d5dd1
     http:
     - address: 0.0.0.0
       hostnames:
@@ -3310,6 +3446,70 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-18-80e55fa6
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
index e2e7d9db94..3910655351 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
@@ -569,11 +569,6 @@ xdsIR:
     globalResources:
       proxyInfraCluster:
         destination:
-          addressType: IP
-          endpoints:
-          - host: 7.6.5.4
-            port: 8080
-            zone: zone1
           name: envoy-default-gateway-1-bfd08ef4
           preferLocal:
             minEndpointsThreshold: 1
@@ -698,6 +693,14 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          name: envoy-default-gateway-2-5e70ed84
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-default-gateway-2-5e70ed84
     http:
     - address: 0.0.0.0
       hostnames:
@@ -753,6 +756,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-3-206418d2
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-default-gateway-3-206418d2
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-serviceimport-port.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-serviceimport-port.out.yaml
index 64765bd9b1..ce35b720a9 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-serviceimport-port.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-serviceimport-port.out.yaml
@@ -186,6 +186,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-serviceimport.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-serviceimport.out.yaml
index 628bd999f7..cb6e8e96c9 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-serviceimport.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-serviceimport.out.yaml
@@ -186,6 +186,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.out.yaml
index dbd453397e..ba084a14d0 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.out.yaml
@@ -229,6 +229,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-serviceimport.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-serviceimport.out.yaml
index 8fc6f3c665..b2955d819a 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-serviceimport.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-serviceimport.out.yaml
@@ -191,6 +191,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-default-gateway-1-bfd08ef4
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-default-gateway-1-bfd08ef4
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-serviceimport.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-serviceimport.out.yaml
index c265650be7..f7179da700 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-serviceimport.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-serviceimport.out.yaml
@@ -196,6 +196,19 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyInfraCluster:
+        destination:
+          addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          preferLocal:
+            minEndpointsThreshold: 1
+          protocol: HTTP
+        name: envoy-envoy-gateway-gateway-1-196ae069
     http:
     - address: 0.0.0.0
       hostnames:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-prometheus-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-prometheus-annotations.yaml
index 099d5a225e..ba68c59484 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-prometheus-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-prometheus-annotations.yaml
@@ -54,7 +54,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -129,22 +129,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
@@ -216,6 +215,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -303,6 +304,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle:
diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-prometheus-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-prometheus-annotations.yaml
index 7a7fe26c70..2ddcfb81f4 100644
--- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-prometheus-annotations.yaml
+++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-prometheus-annotations.yaml
@@ -60,7 +60,7 @@ spec:
                 address: 127.0.0.1
                 port_value: 19000
           cluster_manager:
-            local_cluster_name: local_cluster
+            local_cluster_name: $(ENVOY_PROXY_INFRA_NAME)
           node:
             locality:
               zone: $(ENVOY_SERVICE_ZONE)
@@ -135,22 +135,21 @@ spec:
                           address: 127.0.0.1
                           port_value: 19000
             - connect_timeout: 10s
-              lb_policy: ROUND_ROBIN
-              load_assignment:
-                cluster_name: local_cluster
-                endpoints:
-                - lb_endpoints:
-                  - endpoint:
-                      address:
-                        socket_address:
-                          address: 127.0.0.1
-                          port_value: 10080
-                    load_balancing_weight: 1
-                  load_balancing_weight: 1
-                  locality:
-                    zone: $(ENVOY_SERVICE_ZONE)
-              name: local_cluster
-              type: STATIC
+              eds_cluster_config:
+                eds_config:
+                  ads: {}
+                  resource_api_version: 'V3'
+                service_name: $(ENVOY_PROXY_INFRA_NAME)
+              load_balancing_policy:
+                policies:
+                  - typed_extension_config:
+                      name: 'envoy.load_balancing_policies.least_request'
+                      typed_config:
+                        '@type': 'type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest'
+                        locality_lb_config:
+                          locality_weighted_lb_config: {}
+              name: $(ENVOY_PROXY_INFRA_NAME)
+              type: EDS
             - connect_timeout: 10s
               load_assignment:
                 cluster_name: xds_cluster
@@ -222,6 +221,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/envoy:distroless-dev
         imagePullPolicy: IfNotPresent
         lifecycle:
@@ -309,6 +310,8 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.annotations['topology.kubernetes.io/zone']
+        - name: ENVOY_PROXY_INFRA_NAME
+          value: envoy-default-37a8eec1
         image: docker.io/envoyproxy/gateway-dev:latest
         imagePullPolicy: IfNotPresent
         lifecycle: